Skip to content

ruslanbay/immutable-windows

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

12 Commits
 
 

Repository files navigation

Immutable Windows with atomic updates (kinda... not really)

Загрузить установочный iso образ можно с официального сайта Microsoft. Прямые ссылки на редакции Windows 11 25H2 на английском языке:

Link SHA256
Win11_25H2_EnglishInternational_x64.iso BAAEB6C90DD51648154B64C40C9E0C14D93A427F611A1BB49C8077FA2FF73364
Win11_25H2_English_x64.iso D141F6030FED50F75E2B03E1EB2E53646C4B21E5386047CB860AF5223F102A32

Я буду использовать Win11_25H2_EnglishInternational_x64.iso. Размер файла составляет примерно 7.5 GB.

Подготовка базового образа

Проверка размер файла

Get-ChildItem D:\images\Win11_25H2_EnglishInternational_x64.iso | Format-Table -Property Name, Length

Name                                        Length
----                                        ------
Win11_25H2_EnglishInternational_x64.iso 7754645504

Валидация файла

Get-FileHash -algorithm sha256 D:\images\Win11_25H2_EnglishInternational_x64.iso | Format-Table -Property Algorithm, Hash

Algorithm Hash
--------- ----
SHA256    BAAEB6C90DD51648154B64C40C9E0C14D93A427F611A1BB49C8077FA2FF73364

Монтирование iso-образа

$imagePath = "D:\images\Win11_25H2_EnglishInternational_x64.iso"

Mount-DiskImage -ImagePath $imagePath

Копирование файла sources\install.wim в каталог D:\images\

$volume = Get-Volume | Where-Object { $_.FileSystemLabel -eq "CCCOMA_X64FRE_EN-GB_DV9" }

Copy-Item -Path "$($volume.DriveLetter):\sources\install.wim" -Destination "D:\images\"

Dismount-DiskImage -ImagePath $imagePath

Список редакций Windows

Dism /Get-ImageInfo /ImageFile:"D:\images\install.wim"

Deployment Image Servicing and Management tool
Version: 10.0.26100.5074

Details for image : D:\images\install.wim

Index : 1
Name : Windows 11 Home
Description : Windows 11 Home
Size : 22,210,088,637 bytes

Index : 2
Name : Windows 11 Home N
Description : Windows 11 Home N
Size : 21,592,038,394 bytes

Index : 3
Name : Windows 11 Home Single Language
Description : Windows 11 Home Single Language
Size : 22,187,952,138 bytes

Index : 4
Name : Windows 11 Education
Description : Windows 11 Education
Size : 23,152,922,900 bytes

Index : 5
Name : Windows 11 Education N
Description : Windows 11 Education N
Size : 22,518,969,111 bytes

Index : 6
Name : Windows 11 Pro
Description : Windows 11 Pro
Size : 23,175,273,005 bytes

Index : 7
Name : Windows 11 Pro N
Description : Windows 11 Pro N
Size : 22,540,028,526 bytes

Index : 8
Name : Windows 11 Pro Education
Description : Windows 11 Pro Education
Size : 23,152,973,538 bytes

Index : 9
Name : Windows 11 Pro Education N
Description : Windows 11 Pro Education N
Size : 22,518,994,880 bytes

Index : 10
Name : Windows 11 Pro for Workstations
Description : Windows 11 Pro for Workstations
Size : 23,153,024,176 bytes

Index : 11
Name : Windows 11 Pro N for Workstations
Description : Windows 11 Pro N for Workstations
Size : 22,519,020,649 bytes

"N" означает "Not with Media Player", эта редакция не включает кодеки и некоторые другие фичи. Я выберу Windows 11 Pro. Чтобы посмотреть дополнительную информацию об этой редакции выполним ту же самую команду с параметром /index:6

Dism /Get-ImageInfo /ImageFile:"D:\images\install.wim" /index:6

Deployment Image Servicing and Management tool
Version: 10.0.26100.5074

Details for image : D:\images\install.wim

Index : 6
Name : Windows 11 Pro
Description : Windows 11 Pro
Size : 23,175,273,005 bytes
WIM Bootable : No
Architecture : x64
Hal : <undefined>
Version : 10.0.26200
ServicePack Build : 6584
ServicePack Level : 0
Edition : Professional
Installation : Client
ProductType : WinNT
ProductSuite : Terminal Server
System Root : WINDOWS
Directories : 30581
Files : 137312
Created : 9/15/2025 - 9:05:52 PM
Modified : 9/15/2025 - 9:38:30 PM
Languages :
        en-GB (Default)

Сделаем файл install.wim доступным для записи

Set-ItemProperty -Path "D:\images\install.wim" -Name IsReadOnly -Value $false

Создание каталога D:\images\mnt

New-Item -ItemType Directory -Path "D:\images\mnt"

Монтирование образа install.wim в каталог D:\images\mnt

Dism /Mount-Image /ImageFile:"D:\images\install.wim" /index:6 /MountDir:"D:\images\mnt"

Список активированных фич

Dism /Image:"D:\images\mnt" /Get-Features /English /Format:Table | Select-String -pattern ".+Enabled.*" | Sort-Object

MediaPlayback                               | Enabled
MSRDC-Infrastructure                        | Enabled
NetFx4-AdvSrvs                              | Enabled
Printing-Foundation-Features                | Enabled
Printing-Foundation-InternetPrinting-Client | Enabled
Printing-PrintToPDFServices-Features        | Enabled
SearchEngine-Client-Package                 | Enabled
SmbDirect                                   | Enabled
WCF-Services45                              | Enabled
WCF-TCP-PortSharing45                       | Enabled
Windows-Defender-Default-Definitions        | Enabled
WindowsMediaPlayer                          | Enabled
WorkFolders-Client                          | Enabled

Удаление неиспользуемых фич

Dism /Image:"D:\images\mnt" /Disable-Feature /FeatureName:MediaPlayback
Dism /Image:"D:\images\mnt" /Disable-Feature /FeatureName:Microsoft-RemoteDesktopConnection
Dism /Image:"D:\images\mnt" /Disable-Feature /FeatureName:MSRDC-Infrastructure
Dism /Image:"D:\images\mnt" /Disable-Feature /FeatureName:NetFx4-AdvSrvs
Dism /Image:"D:\images\mnt" /Disable-Feature /FeatureName:Printing-Foundation-Features
Dism /Image:"D:\images\mnt" /Disable-Feature /FeatureName:Printing-Foundation-InternetPrinting-Client
Dism /Image:"D:\images\mnt" /Disable-Feature /FeatureName:Printing-PrintToPDFServices-Features
Dism /Image:"D:\images\mnt" /Disable-Feature /FeatureName:SearchEngine-Client-Package
Dism /Image:"D:\images\mnt" /Disable-Feature /FeatureName:SmbDirect
Dism /Image:"D:\images\mnt" /Disable-Feature /FeatureName:WCF-Services45
Dism /Image:"D:\images\mnt" /Disable-Feature /FeatureName:WCF-TCP-PortSharing45
Dism /Image:"D:\images\mnt" /Disable-Feature /FeatureName:Windows-Defender-Default-Definitions
Dism /Image:"D:\images\mnt" /Disable-Feature /FeatureName:WorkFolders-Client

Список предустановленных системных компонентов

Dism /Image:"D:\images\mnt" /Get-Capabilities /Format:Table | Select-String "Installed" | Sort-Object

App.StepsRecorder~~~~0.0.1.0                                   | Installed  
Browser.InternetExplorer~~~~0.0.11.0                           | Installed
DirectX.Configuration.Database~~~~0.0.1.0                      | Installed
Hello.Face.20134~~~~0.0.1.0                                    | Installed
Language.Basic~~~en-GB~0.0.1.0                                 | Installed
Language.Handwriting~~~en-GB~0.0.1.0                           | Installed  
Language.OCR~~~en-GB~0.0.1.0                                   | Installed  
Language.Speech~~~en-GB~0.0.1.0                                | Installed
Language.TextToSpeech~~~en-GB~0.0.1.0                          | Installed
MathRecognizer~~~~0.0.1.0                                      | Installed
Media.WindowsMediaPlayer~~~~0.0.12.0                           | Installed  
Microsoft.Wallpapers.Extended~~~~0.0.1.0                       | Installed
Microsoft.Windows.Ethernet.Client.Intel.E1i68x64~~~~0.0.1.0    | Installed
Microsoft.Windows.Ethernet.Client.Intel.E2f68~~~~0.0.1.0       | Installed
Microsoft.Windows.Ethernet.Client.Realtek.Rtcx21x64~~~~0.0.1.0 | Installed
Microsoft.Windows.Ethernet.Client.Vmware.Vmxnet3~~~~0.0.1.0    | Installed
Microsoft.Windows.Notepad.System~~~~0.0.1.0                    | Installed
Microsoft.Windows.PowerShell.ISE~~~~0.0.1.0                    | Installed
Microsoft.Windows.Sense.Client~~~~                             | Installed
Microsoft.Windows.Wifi.Client.Broadcom.Bcmpciedhd63~~~~0.0.1.0 | Installed
Microsoft.Windows.Wifi.Client.Broadcom.Bcmwl63a~~~~0.0.1.0     | Installed
Microsoft.Windows.Wifi.Client.Broadcom.Bcmwl63al~~~~0.0.1.0    | Installed
Microsoft.Windows.Wifi.Client.Intel.Netwbw02~~~~0.0.1.0        | Installed
Microsoft.Windows.Wifi.Client.Intel.Netwew00~~~~0.0.1.0        | Installed  
Microsoft.Windows.Wifi.Client.Intel.Netwew01~~~~0.0.1.0        | Installed
Microsoft.Windows.Wifi.Client.Intel.Netwlv64~~~~0.0.1.0        | Installed
Microsoft.Windows.Wifi.Client.Intel.Netwns64~~~~0.0.1.0        | Installed
Microsoft.Windows.Wifi.Client.Intel.Netwsw00~~~~0.0.1.0        | Installed
Microsoft.Windows.Wifi.Client.Intel.Netwtw02~~~~0.0.1.0        | Installed
Microsoft.Windows.Wifi.Client.Intel.Netwtw04~~~~0.0.1.0        | Installed
Microsoft.Windows.Wifi.Client.Intel.Netwtw06~~~~0.0.1.0        | Installed
Microsoft.Windows.Wifi.Client.Intel.Netwtw08~~~~0.0.1.0        | Installed
Microsoft.Windows.Wifi.Client.Intel.Netwtw10~~~~0.0.1.0        | Installed
Microsoft.Windows.Wifi.Client.Marvel.Mrvlpcie8897~~~~0.0.1.0   | Installed  
Microsoft.Windows.Wifi.Client.Qualcomm.Athw8x~~~~0.0.1.0       | Installed
Microsoft.Windows.Wifi.Client.Qualcomm.Athwnx~~~~0.0.1.0       | Installed
Microsoft.Windows.Wifi.Client.Qualcomm.Qcamain10x64~~~~0.0.1.0 | Installed
Microsoft.Windows.Wifi.Client.Ralink.Netr28x~~~~0.0.1.0        | Installed
Microsoft.Windows.Wifi.Client.Realtek.Rtl8192se~~~~0.0.1.0     | Installed
Microsoft.Windows.Wifi.Client.Realtek.Rtwlane~~~~0.0.1.0       | Installed
Microsoft.Windows.Wifi.Client.Realtek.Rtwlane01~~~~0.0.1.0     | Installed
Microsoft.Windows.Wifi.Client.Realtek.Rtwlane13~~~~0.0.1.0     | Installed
OneCoreUAP.OneSync~~~~0.0.1.0                                  | Installed  
OpenSSH.Client~~~~0.0.1.0                                      | Installed
Print.Management.Console~~~~0.0.1.0                            | Installed
VBSCRIPT~~~~                                                   | Installed
Windows.Kernel.LA57~~~~0.0.1.0                                 | Installed
WMIC~~~~                                                       | Installed

Удаление неиспользуемых компонентов

Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:App.StepsRecorder~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Browser.InternetExplorer~~~~0.0.11.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:DirectX.Configuration.Database~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Hello.Face.20134~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Language.Handwriting~~~en-GB~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Language.OCR~~~en-GB~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Language.Speech~~~en-GB~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Language.TextToSpeech~~~en-GB~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:MathRecognizer~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Media.WindowsMediaPlayer~~~~0.0.12.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Wallpapers.Extended~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Ethernet.Client.Intel.E1i68x64~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Ethernet.Client.Intel.E2f68~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Ethernet.Client.Realtek.Rtcx21x64~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Ethernet.Client.Vmware.Vmxnet3~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Notepad.System~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.PowerShell.ISE~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Broadcom.Bcmpciedhd63~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Broadcom.Bcmwl63al~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Broadcom.Bcmwl63a~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Intel.Netwbw02~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Intel.Netwew00~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Intel.Netwew01~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Intel.Netwlv64~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Intel.Netwns64~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Intel.Netwsw00~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Intel.Netwtw02~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Intel.Netwtw04~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Intel.Netwtw06~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Intel.Netwtw08~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Intel.Netwtw10~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Marvel.Mrvlpcie8897~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Qualcomm.Athw8x~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Qualcomm.Athwnx~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Qualcomm.Qcamain10x64~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Ralink.Netr28x~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Realtek.Rtl8192se~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Realtek.Rtwlane01~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Realtek.Rtwlane13~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Microsoft.Windows.Wifi.Client.Realtek.Rtwlane~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:OneCoreUAP.OneSync~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:OpenSSH.Client~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:Print.Management.Console~~~~0.0.1.0
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:VBSCRIPT~~~~
Dism /Image:"D:\images\mnt" /Remove-Capability /CapabilityName:WMIC~~~~

Список предустановленных пакетов

Dism /Image:"D:\images\mnt" /Get-Packages | Select-String -pattern "Package Identity : .+" | Sort-Object

Package Identity : Microsoft-Windows-Client-LanguagePack-Package~31bf3856ad364e35~amd64~en-GB~10.0.26100.1742
Package Identity : Microsoft-Windows-Client-LanguagePack-Package~31bf3856ad364e35~amd64~en-GB~10.0.26100.6584
Package Identity : Microsoft-Windows-FodMetadata-Package~31bf3856ad364e35~amd64~~10.0.26100.1
Package Identity : Microsoft-Windows-FodMetadataServicing-Desktop-CompDB-Package~31bf3856ad364e35~amd64~~10.0.26100.1
Package Identity : Microsoft-Windows-FodMetadataServicing-Desktop-Metadata-Package~31bf3856ad364e35~amd64~~10.0.26100.1742
Package Identity : Microsoft-Windows-FodMetadataServicing-Desktop-Metadata-Package~31bf3856ad364e35~amd64~~10.0.26100.6584
Package Identity : Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~10.0.26100.1
Package Identity : Microsoft-Windows-Kernel-LA57-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.1742
Package Identity : Microsoft-Windows-Kernel-LA57-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.6584
Package Identity : Microsoft-Windows-LanguageFeatures-Basic-en-gb-Package~31bf3856ad364e35~amd64~~10.0.26100.1742
Package Identity : Microsoft-Windows-LanguageFeatures-Basic-en-gb-Package~31bf3856ad364e35~amd64~~10.0.26100.6584
Package Identity : Microsoft-Windows-Licenses-Professional-Package~31bf3856ad364e35~amd64~~10.0.26100.1742
Package Identity : Microsoft-Windows-Licenses-Professional-Package~31bf3856ad364e35~amd64~~10.0.26100.6584
Package Identity : Microsoft-Windows-Licenses-Professional-Package~31bf3856ad364e35~amd64~en-GB~10.0.26100.1742
Package Identity : Microsoft-Windows-Licenses-Professional-Package~31bf3856ad364e35~amd64~en-GB~10.0.26100.6584
Package Identity : Microsoft-Windows-NetFx3-OnDemand-Package~31bf3856ad364e35~amd64~en-GB~10.0.26100.6584
Package Identity : Microsoft-Windows-SenseClient-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.1
Package Identity : Microsoft-Windows-SenseClient-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.6584
Package Identity : Microsoft-Windows-SenseClient-FoD-Package~31bf3856ad364e35~amd64~en-GB~10.0.26100.1
Package Identity : Microsoft-Windows-SenseClient-FoD-Package~31bf3856ad364e35~amd64~en-GB~10.0.26100.6584
Package Identity : Package_for_DotNetRollup_481~31bf3856ad364e35~amd64~~10.0.9319.1
Package Identity : Package_for_KB5054156~31bf3856ad364e35~amd64~~26100.5503.1.1
Package Identity : Package_for_RollupFix~31bf3856ad364e35~amd64~~26100.1742.1.10
Package Identity : Package_for_RollupFix~31bf3856ad364e35~amd64~~26100.6584.1.20
Package Identity : Package_for_ServicingStack_5074~31bf3856ad364e35~amd64~~26100.5074.1.7

Удаление неиспользуемых пакетов

Dism /Image:"D:\images\mnt" /Remove-Package /PackageName:Microsoft-Windows-NetFx3-OnDemand-Package~31bf3856ad364e35~amd64~en-GB~10.0.26100.6584

Список пакетов, которые устанавливаются автоматически для каждого нового пользователя

Dism /Image:"D:\images\mnt" /Get-ProvisionedAppxPackages | Select-String -pattern "PackageName : .+" | Sort-Object

PackageName : Clipchamp.Clipchamp_4.3.10120.0_neutral_~_yxz26nhyzhsrt
PackageName : Microsoft.ApplicationCompatibilityEnhancements_1.2401.10.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.AV1VideoExtension_1.3.20.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.AVCEncoderVideoExtension_1.1.17.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.BingNews_4.1.24002.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.BingSearch_2022.1.33.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.BingWeather_4.54.63017.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.DesktopAppInstaller_2024.1108.1842.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.GamingApp_2025.523.601.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.GetHelp_10.2407.22193.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.HEIFImageExtension_1.2.20.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.HEVCVideoExtension_2.4.13.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.MicrosoftOfficeHub_19.2506.56051.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.MicrosoftSolitaireCollection_4.22.3190.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.MicrosoftStickyNotes_6.1.5.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.MPEG2VideoExtension_1.2.10.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.OutlookForWindows_1.0.0.0_neutral__8wekyb3d8bbwe
PackageName : Microsoft.Paint_11.2412.295.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.PowerAutomateDesktop_11.2506.143.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.RawImageExtension_2.5.5.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.ScreenSketch_2022.2307.59.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.SecHealthUI_1000.26100.6584.0_x64__8wekyb3d8bbwe
PackageName : Microsoft.StorePurchaseApp_22408.1400.1.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.Todos_2.120.7961.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.VP9VideoExtensions_1.2.6.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.WebMediaExtensions_2.1.20.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.WebpImageExtension_1.2.10.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.Windows.DevHome_0.1701.597.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.Windows.Photos_24.24070.23002.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.WindowsAlarms_2021.2503.4.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.WindowsCalculator_2021.2502.2.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.WindowsCamera_2022.2505.2.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.WindowsFeedbackHub_2024.125.1522.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.WindowsNotepad_11.2501.31.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.WindowsSoundRecorder_2021.2504.0.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.WindowsStore_22503.1400.1.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.WindowsTerminal_3001.18.10301.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.Xbox.TCUI_1.23.28005.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.XboxGamingOverlay_7.325.7221.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.XboxIdentityProvider_12.110.15002.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.XboxSpeechToTextOverlay_1.111.30001.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.YourPhone_1.25062.84.0_neutral_~_8wekyb3d8bbwe
PackageName : Microsoft.ZuneMusic_11.2501.9.0_neutral_~_8wekyb3d8bbwe
PackageName : MicrosoftCorporationII.QuickAssist_2025.331.2057.0_neutral_~_8wekyb3d8bbwe
PackageName : MicrosoftWindows.Client.WebExperience_525.18101.90.9_neutral_~_cw5n1h2txyewy
PackageName : MicrosoftWindows.CrossDevice_1.25062.28.0_neutral_~_cw5n1h2txyewy
PackageName : MSTeams_1.0.0.0_x64__8wekyb3d8bbwe

Удаление неиспользуемых пакетов

Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Clipchamp.Clipchamp_4.3.10120.0_neutral_~_yxz26nhyzhsrt
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.ApplicationCompatibilityEnhancements_1.2401.10.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.BingNews_4.1.24002.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.BingSearch_2022.1.33.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.BingWeather_4.54.63017.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.GamingApp_2025.523.601.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.GetHelp_10.2407.22193.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.HEIFImageExtension_1.2.20.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.HEVCVideoExtension_2.4.13.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.MicrosoftOfficeHub_19.2506.56051.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.MicrosoftSolitaireCollection_4.22.3190.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.MicrosoftStickyNotes_6.1.5.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.MPEG2VideoExtension_1.2.10.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.OutlookForWindows_1.0.0.0_neutral__8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.Paint_11.2412.295.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.PowerAutomateDesktop_11.2506.143.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.RawImageExtension_2.5.5.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.ScreenSketch_2022.2307.59.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.StorePurchaseApp_22408.1400.1.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.Todos_2.120.7961.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.WebpImageExtension_1.2.10.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.Windows.DevHome_0.1701.597.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.Windows.Photos_24.24070.23002.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.WindowsAlarms_2021.2503.4.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.WindowsCalculator_2021.2502.2.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.WindowsCamera_2022.2505.2.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.WindowsFeedbackHub_2024.125.1522.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.WindowsNotepad_11.2501.31.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.WindowsSoundRecorder_2021.2504.0.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.WindowsStore_22503.1400.1.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.WindowsTerminal_3001.18.10301.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.Xbox.TCUI_1.23.28005.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.XboxGamingOverlay_7.325.7221.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.XboxIdentityProvider_12.110.15002.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.XboxSpeechToTextOverlay_1.111.30001.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.YourPhone_1.25062.84.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:Microsoft.ZuneMusic_11.2501.9.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:MicrosoftCorporationII.QuickAssist_2025.331.2057.0_neutral_~_8wekyb3d8bbwe
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:MicrosoftWindows.Client.WebExperience_525.18101.90.9_neutral_~_cw5n1h2txyewy
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:MicrosoftWindows.CrossDevice_1.25062.28.0_neutral_~_cw5n1h2txyewy
Dism /Image:"D:\images\mnt" /Remove-ProvisionedAppxPackage /PackageName:MSTeams_1.0.0.0_x64__8wekyb3d8bbwe

Активация пакетов

Я использую Hyper-V. В качестве примера добавлю его в систему:

Dism /Image:"D:\images\mnt" /Enable-Feature /all /FeatureName:Microsoft-Hyper-V

Удаление браузера Microsoft Edge

Dism /Image:"D:\images\mnt" /Remove-EdgeBrowser
Dism /Image:"D:\images\mnt" /Remove-EdgeWebView

Оптимизация образа

Dism /Image:"D:\images\mnt" /Optimize-ProvisionedAppxPackages

Правка реестра

Set system-wide geographical location to Ireland to apply EU policy settings from C:/Windows/System32/IntegratedServicesRegionPolicySet.json

reg load   HKLM\OFFLINE D:\images\mnt\Windows\System32\config\SYSTEM
reg add "HKLM\OFFLINE\ControlSet001\Control\Nls\Geo" /v Nation /t REG_DWORD /d 68 /f
reg unload HKLM\OFFLINE

reg load HKU\OFFLINE D:\images\mnt\Users\Default\NTUSER.DAT
reg add "HKU\OFFLINE\Control Panel\International\Geo" /v Nation /t REG_SZ /d "68" /f
reg add "HKU\OFFLINE\Control Panel\International" /v sCountry /t REG_SZ /d "Ireland" /f
reg add "HKU\OFFLINE\Control Panel\International\Geo" /v Name /t REG_SZ /d "IE" /f
reg unload HKU\OFFLINE

reg load HKLM\OFFLINE D:\images\mnt\Windows\System32\config\SOFTWARE
reg add "HKLM\OFFLINE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" /v NoRemove /t REG_DWORD /d 0 /f
reg add "HKLM\OFFLINE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" /v NoRemove /t REG_DWORD /d 0 /f
reg add "HKLM\OFFLINE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft EdgeWebView" /v NoRemove /t REG_DWORD /d 0 /f
reg unload HKLM\OFFLINE

Правка HKLM\SOFTWARE

reg load HKLM\OFFLINE D:\images\mnt\Windows\System32\config\SOFTWARE
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\OOBE                 /v BypassNRO                     /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\OOBE                       /v DisablePrivacyExperience      /t REG_DWORD /d 1 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows\Windows Chat"             /v ChatIcon                      /t REG_DWORD /d 3 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows\Windows Search"           /v AllowCloudSearch              /t REG_DWORD /d 0 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows\Windows Search"           /v AllowCortana                  /t REG_DWORD /d 0 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows\Windows Search"           /v ConnectedSearchUseWeb         /t REG_DWORD /d 0 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows\Windows Search"           /v DisableSearch                 /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\CloudContent     /v DisableWindowsConsumerFeatures     /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\CloudContent     /v DisableSoftLanding                 /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\CloudContent     /v DisableCloudOptimizedContent       /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\CloudContent     /v DisableConsumerAccountStateContent /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\AppCompat        /v AITEnable                          /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\AppCompat        /v VDMDisallowed                      /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\AppCompat        /v DisableEngine                      /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\AppCompat        /v DisablePCA                         /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\AppCompat        /v DisableUAR                         /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\DataCollection   /v AllowTelemetry                     /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\DataCollection   /v "Allow Telemetry"                  /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\DataCollection   /v AllowDeviceNameInTelemetry         /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\DataCollection   /v DisableOneSettingsDownloads        /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\DataCollection   /v DoNotShowFeedbackNotifications     /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\DataCollection   /v EnableOneSettingsAuditing          /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\DataCollection   /v LimitDiagnosticLogCollection       /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\DataCollection   /v LimitDumpCollection                /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Dsh                      /v AllowNewsAndInterests              /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\InputPersonalization     /v RestrictImplicitTextCollection     /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\InputPersonalization     /v RestrictImplicitInkCollection      /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Microsoft\PolicyManager\default\NewsAndInterests\AllowNewsAndInterests /v value   /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v AllowTelemetry         /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v "AllowTelemetry"       /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v MaxTelemetryAllowed    /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v MicrosoftEdgeDataOptIn /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\Privacy                 /v TailoredExperiencesWithDiagnosticDataEnabled /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\Policies\Explorer  /v NoRecentDocsHistory            /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\Policies\Explorer  /v NoDesktop                      /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\Policies\Explorer  /v AllowOnlineTips                /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\Policies\System    /v DisableStartupSound            /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\Explorer\Advanced  /v Start_TrackDocs                /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers /v DisableAutoplay         /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers /v DisableAutoplay  /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\CameraAlternate\ShowPicturesOnArrival /v "(Default)" /t REG_SZ /d MSTakeNoAction /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\StorageOnArrival                      /v "(Default)" /t REG_SZ /d MSTakeNoAction /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\CameraAlternate\ShowPicturesOnArrival     /v "(Default)" /t REG_SZ /d MSTakeNoAction /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\StorageOnArrival                          /v "(Default)" /t REG_SZ /d MSTakeNoAction /f
reg add  HKLM\OFFLINE\Microsoft\input\Settings                            /v IsVoiceTypingKeyEnabled        /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\input\Settings                            /v RestrictImplicitInkCollection  /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Microsoft\input\Settings                            /v RestrictImplicitTextCollection /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Microsoft\input\Settings                            /v DictationEnabled               /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\input\Settings                            /v DisablePersonalization         /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Microsoft\input\Settings                            /v HarvestContacts                /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\input\Settings                            /v IsVoiceTypingKeyEnabled        /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\input\Settings                            /v InsightsEnabled                /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\InputPersonalization                      /v InsightsEnabled                /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\InputPersonalization\TrainedDataStore     /v HarvestContacts                /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\InputPersonalization\TrainedDataStore     /v TouchKeyboard_EnableKeyAudioFeedback /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\Personalization\Settings                  /v AcceptedPrivacyPolicy          /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy /v HasAccepted /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CPSS\Store\AdvertisingInfo                                  /v Value /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CPSS\Store\InkingAndTypingPersonalization                   /v Value /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\activity                     /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appDiagnostics               /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appointments                 /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\bluetoothSync                /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\broadFileSystemAccess        /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\cellularData                 /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\chat                         /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\contacts                     /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\documentsLibrary             /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\downloadsFolder              /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\email                        /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\gazeInput                    /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\graphicsCaptureProgrammatic  /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\graphicsCaptureWithoutBorder /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location                     /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone                   /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\musicLibrary                 /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\phoneCall                    /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\phoneCallHistory             /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\picturesLibrary              /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\radios                       /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userAccountInformation       /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userDataTasks                /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userNotificationListener     /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\videosLibrary                /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam                       /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\wifiData                     /v Value /t REG_SZ /d Deny /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Camera                     /v AllowCamera                                      /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\AdvertisingInfo    /v DisabledByGroupPolicy                            /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\AppPrivacy         /v LetAppsAccessMicrophone                          /t REG_DWORD /d 2 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\AppPrivacy         /v LetAppsAccessMicrophone_ForceAllowTheseApps      /t REG_MULTI_SZ /d \0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\AppPrivacy         /v LetAppsAccessMicrophone_ForceDenyTheseApps       /t REG_MULTI_SZ /d \0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\AppPrivacy         /v LetAppsAccessMicrophone_UserInControlOfTheseApps /t REG_MULTI_SZ /d \0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\LocationAndSensors /v DisableLocation                                  /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\LocationAndSensors /v DisableWindowsLocationProvider                   /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\LocationAndSensors /v DisableLocationScripting                         /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\LocationAndSensors /v DisableSensors                                   /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\FileHistory        /v Disabled                                         /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\HomeGroup          /v DisableHomeGroup                                 /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\System             /v PublishUserActivities                            /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\System             /v UploadUserActivities                             /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\System             /v EnableActivityFeed                               /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\System             /v EnableCdp                                        /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\System             /v EnableMmx                                        /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\System             /v AllowClipboardHistory                            /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\System             /v AllowCrossDeviceClipboard                        /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\System             /v AllowCrossDeviceClipboard                        /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Messenger\Client           /v CEIP                                             /t REG_DWORD /d 2 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\SQMClient\Windows          /v CEIPEnable                                       /t REG_DWORD /d 0 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows\Registration Wizard Control" /v NoRegistration                        /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\PCHealth\HelpSvc           /v Headlines                                        /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\PCHealth\HelpSvc           /v MicrosoftKBSearch                                /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\PCHealth\ErrorReporting    /v DoReport                                         /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\PCHealth\ErrorReporting    /v AllOrNone                                        /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\PCHealth\ErrorReporting    /v IncludeMicrosoftApps                             /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\PCHealth\ErrorReporting    /v IncludeWindowsApps                               /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\PCHealth\ErrorReporting    /v IncludeKernelFaults                              /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\PCHealth\ErrorReporting    /v IncludeShutdownErrs                              /t REG_DWORD /d 0 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Control Panel\International" /v PreventGeoIdChange                            /t REG_DWORD /d 1 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows\Windows Error Reporting" /v Disabled                                  /t REG_DWORD /d 1 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows\Windows Error Reporting" /v LoggingDisabled                           /t REG_DWORD /d 1 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows\Windows Error Reporting" /v AutoApproveOSDumps                        /t REG_DWORD /d 0 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows\Windows Error Reporting" /v DontSendAdditionalData                    /t REG_DWORD /d 1 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultConsent                    /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\SearchCompanion            /v DisableContentFileUpdates                        /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\TabletPC           /v PreventHandwritingDataSharing                    /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\HandwritingErrorReports /v PreventHandwritingErrorReports              /t REG_DWORD /d 1 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows\Windows Feeds"    /v EnableFeeds                                      /t REG_DWORD /d 0 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows NT\DNSClient"     /v DoHPolicy                                        /t REG_DWORD /d 3 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows NT\Printers"      /v DisableWebPrinting                               /t REG_DWORD /d 1 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows NT\Printers"      /v PublishPrinters                                  /t REG_DWORD /d 0 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows NT\Printers"      /v RegisterSpoolerRemoteRpcEndPoint                 /t REG_DWORD /d 2 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows NT\Printers"      /v DisableWebPnPDownload                            /t REG_DWORD /d 1 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows NT\Printers"      /v DisableHTTPPrinting                              /t REG_DWORD /d 1 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows NT\IIS"           /v PreventIISInstall                                /t REG_DWORD /d 1 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Windows NT\Terminal Services" /v fDenyTSConnections                           /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Peernet                    /v Disabled                                         /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\FindMyDevice               /v AllowFindMyDevice                                /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\MicrosoftAccount           /v DisableUserAuth                                  /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\MicrosoftEdge\Main         /v PreventLiveTileDataCollection                    /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\MicrosoftEdge\Main         /v PreventFirstRunPage                              /t REG_DWORD /d 1 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\MicrosoftEdge\Internet Settings" /v ProvisionedHomePages                      /t REG_SZ    /d "https://en.wikipedia.org/wiki/Main_Page" /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\MicrosoftEdge\Internet Settings" /v DisableLockdownOfStartPages               /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Conferencing               /v NoRDS                                            /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Biometrics                 /v Enabled                                          /t REG_DWORD /d 0 /f
reg add  "HKLM\OFFLINE\Policies\Microsoft\Biometrics\Credential Provider" /v Enabled                                      /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\WindowsFirewall\StandardProfile /v DoNotAllowExceptions                        /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy /v DisableQueryRemoteServer         /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\Troubleshooting\AllowRecommendations /v TroubleshootingAllowRecommendations /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy   /v EnableQueryRemoteServer        /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\ScriptedDiagnostics                  /v EnableDiagnostics              /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager /v AllowSharedLocalAppData        /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\PreviewBuilds                        /v AllowBuildPreview              /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\SettingSync                          /v DisableSettingSync             /t REG_DWORD /d 2 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\PushToInstall                                /v DisablePushToInstall               /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Speech                                       /v AllowSpeechModelUpdate             /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\OneDrive                                     /v DisableFileSyncNGSC                /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\OneDrive                                     /v PreventNetworkTrafficPreUserSignIn /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\OneDrive                             /v DisableFileSyncNGSC                /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\OneDrive                             /v PreventNetworkTrafficPreUserSignIn /t REG_DWORD /d 1 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\GameDVR                              /v AllowGameDVR                       /t REG_DWORD /d 0 /f
reg add  HKLM\OFFLINE\Policies\Microsoft\Windows\WinRM\Service\WinRS                  /v AllowRemoteShellAccess             /t REG_DWORD /d 0 /f
reg unload HKLM\OFFLINE

Правка HKLM\SYSTEM

Отключаем гибернацию, файл подкачки и удалённый доступ к системе

reg load   HKLM\OFFLINE D:\images\mnt\Windows\System32\config\SYSTEM
reg add    HKLM\OFFLINE\ControlSet001\Control\Power                                   /v HibernateEnabled        /t REG_DWORD /d 0 /f
reg add    HKLM\OFFLINE\ControlSet001\Control\Power                                   /v HibernateEnabledDefault /t REG_DWORD /d 0 /f
reg add    "HKLM\OFFLINE\ControlSet001\Control\Session Manager\Memory Management"     /v SwapfileControl         /t REG_DWORD /d 0 /f
reg add    "HKLM\OFFLINE\ControlSet001\Control\Remote Assistance"                     /v fAllowFullControl       /t REG_DWORD /d 0 /f
reg add    "HKLM\OFFLINE\ControlSet001\Control\Remote Assistance"                     /v fAllowToGetHelp         /t REG_DWORD /d 0 /f
reg add    "HKLM\OFFLINE\ControlSet001\Control\Remote Assistance"                     /v fEnableChatControl      /t REG_DWORD /d 0 /f
reg add    HKLM\OFFLINE\ControlSet001\Services\Dnscache\Parameters                    /v EnableMDNS              /t REG_DWORD /d 0 /f
reg unload HKLM\OFFLINE

Заблокируем все входящие соединения на уровне системного Firewall

Warning

Блокировка всех входящих подключений отключит в том числе возможность беспроводного подключения ко внешним дисплеям (miracast)

reg load   HKLM\OFFLINE D:\images\mnt\Windows\System32\config\SYSTEM
reg add    HKLM\OFFLINE\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules /v AllBlocked /t REG_SZ /d "v2.32|Action=Block|Active=TRUE|Dir=In|Name=AllBlocked|" /f
reg unload HKLM\OFFLINE

Правка HKU

В Windows по умолчанию присутствует пользователь Default и его настройки автоматически наследуются для каждого нового пользователя системы. Таким образом, если мы отредактируем файлы, регистр для Default, то эти изменения автоматически применятся для всех пользователей, которых мы создадим после установки системы.

reg load   HKU\OFFLINE D:\images\mnt\Users\Default\NTUSER.DAT
reg delete HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Run    /v OneDriveSetup /f
reg add    HKU\OFFLINE\Software\Microsoft\OneDrive                                 /v DisableFileSyncNGSC                             /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Policies\Microsoft\Windows\CloudContent            /v DisableSpotlightCollectionOnDesktop             /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Policies\Microsoft\Windows\CloudContent            /v DisableTailoredExperiencesWithDiagnosticData    /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Policies\Microsoft\Windows\CloudContent            /v DisableWindowsConsumerFeatures                  /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Policies\Microsoft\Windows\CloudContent            /v DisableWindowsSpotlightFeatures                 /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Policies\Microsoft\Windows\CloudContent            /v DisableThirdPartySuggestions                    /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Policies\Microsoft\Windows\CloudContent            /v DisableWindowsSpotlightOnActionCenter           /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Policies\Microsoft\Windows\CloudContent            /v DisableWindowsSpotlightOnSettings               /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Policies\Microsoft\Windows\CloudContent            /v DisableWindowsSpotlightWindowsWelcomeExperience /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Policies\Microsoft\Windows\Explorer                /v DisableSearchBoxSuggestions     /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\SOFTWARE\Policies\Microsoft\MicrosoftEdge\BooksLibrary      /v EnableExtendedBooksTelemetry    /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Policies\Microsoft\Windows\DataCollection          /v AllowTelemetry                  /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v MicrosoftEdgeDataOptIn    /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Privacy           /v TailoredExperiencesWithDiagnosticDataEnabled /t REG_DWORD /d 0 /f
reg add    "HKU\OFFLINE\AppEvents\Schemes\Apps\.Default\.Default\.None"            /ve /f
reg add    HKU\OFFLINE\AppEvents\Schemes                                           /ve /d ".None" /f
reg add    "HKU\OFFLINE\Control Panel\International\User Profile"                  /v HttpAcceptLanguageOptOut  /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Microsoft\GameBar                                  /v AutoGameModeEnabled       /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\GameBar                                  /v UseNexusForGameBarEnabled /t REG_DWORD /d 0 /f
reg add    "HKU\OFFLINE\Software\Microsoft\Windows NT\CurrentVersion\Windows"      /v LegacyDefaultPrinterMode  /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo   /v Enabled                   /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CDP               /v CdpSessionUserAuthzPolicy /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CDP               /v EnableRemoteLaunchToast   /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CDP               /v NearShareChannelUserAuthzPolicy /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CDP               /v RomeSdkChannelUserAuthzPolicy   /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CDP\SettingsPage  /v BluetoothLastDisabledNearShare  /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer          /v ShowRecent               /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer          /v ShowFrequent             /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer          /v ShowCloudFilesInQuickAccess /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v TaskbarAl                /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v TaskbarMn                /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Hidden                   /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt              /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v ShowTaskViewButton       /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideIcons                /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v LaunchTo                 /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Start_TrackDocs          /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Start_TrackProgs         /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Start_IrisRecommendations /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v EnableSnapBar            /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v EnableTaskGroups         /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v MultiTaskingAltTabFilter /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers /v DisableAutoplay  /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\CameraAlternate\ShowPicturesOnArrival /v "(Default)" /t REG_SZ /d MSTakeNoAction /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\StorageOnArrival                      /v "(Default)" /t REG_SZ /d MSTakeNoAction /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\CameraAlternate\ShowPicturesOnArrival     /v "(Default)" /t REG_SZ /d MSTakeNoAction /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\StorageOnArrival                          /v "(Default)" /t REG_SZ /d MSTakeNoAction /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Search            /v SearchboxTaskbarMode     /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Search            /v SearchboxTaskbarModeCache /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Search            /v BingSearchEnabled        /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\SearchSettings    /v IsAADCloudSearchEnabled  /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\SearchSettings    /v IsDeviceSearchHistoryEnabled /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\SearchSettings    /v IsDynamicSearchBoxEnabled /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\SearchSettings    /v IsMSACloudSearchEnabled  /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\SearchSettings    /v SafeSearchMode           /t REG_DWORD /d 2 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop                /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Microsoft\TabletTip\1.7                            /v EnableKeyAudioFeedback   /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\TabletTip\1.7                            /v EnableAutocorrection     /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\TabletTip\1.7                            /v EnableSpellchecking      /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\TabletTip\1.7                            /v TipbandDesiredVisibility /t REG_DWORD /d 1 /f
reg add    "HKU\OFFLINE\Keyboard Layout\Preload"                                   /v 2                        /t REG_SZ    /d 00000419 /f
reg add    HKU\OFFLINE\Software\Microsoft\input\Settings                           /v IsVoiceTypingKeyEnabled  /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\input\Settings                           /v InsightsEnabled          /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\input\Settings                           /v HarvestContacts          /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\input\Settings                           /v RestrictImplicitInkCollection  /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Microsoft\input\Settings                           /v RestrictImplicitTextCollection /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Microsoft\InputPersonalization                     /v InsightsEnabled          /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\InputPersonalization\TrainedDataStore    /v HarvestContacts          /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\InputPersonalization                     /v RestrictImplicitInkCollection  /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Microsoft\InputPersonalization                     /v RestrictImplicitTextCollection /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Microsoft\Personalization\Settings                 /v AcceptedPrivacyPolicy          /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Siuf\Rules                               /v NumberOfSIUFInPeriod           /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy /v HasAccepted /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CPSS\Store\InkingAndTypingPersonalization  /v Value /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack  /v ShowedToastAtLevel                /t REG_DWORD /d 1 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\UserProfileEngagement  /v ScoobeSystemSettingEnabled        /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v ContentDeliveryAllowed            /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v DesktopSpotlightOemEnabled        /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v FeatureManagementEnabled          /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v OemPreInstalledAppsEnabled        /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v PreInstalledAppsEnabled           /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v PreInstalledAppsEverEnabled       /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SilentInstalledAppsEnabled        /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SoftLandingEnabled                /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContent-310093Enabled   /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContent-338389Enabled   /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContent-338393Enabled   /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContent-353694Enabled   /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContent-353696Enabled   /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContent-88000326Enabled /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SystemPaneSuggestionsEnabled      /t REG_DWORD /d 0 /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\activity                     /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appDiagnostics               /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appointments                 /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\bluetoothSync                /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\broadFileSystemAccess        /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\cellularData                 /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\chat                         /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\contacts                     /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\documentsLibrary             /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\downloadsFolder              /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\email                        /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\gazeInput                    /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\graphicsCaptureProgrammatic  /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\graphicsCaptureWithoutBorder /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location                     /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone                   /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\musicLibrary                 /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\phoneCall                    /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\phoneCallHistory             /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\picturesLibrary              /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\radios                       /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userAccountInformation       /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userDataTasks                /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userNotificationListener     /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\videosLibrary                /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam                       /v Value /t REG_SZ /d Deny /f
reg add    HKU\OFFLINE\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\wifiData                     /v Value /t REG_SZ /d Deny /f
reg unload HKU\OFFLINE

Prevent the automatic disk check from running on startup

reg load   HKLM\OFFLINE D:\images\mnt\Windows\System32\config\SYSTEM
reg add "HKLM\OFFLINE\ControlSet001\Control\Session Manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk /k:C *" /f
reg unload HKLM\OFFLINE

Правка системных файлов

Windows\System32\drivers\etc\hosts

Моя система взаимодействует с DNS сервером Quad9 DNS по протоколу DNS-over-HTTPS, при этом подключение к любым портам кроме 443 блокируется на уровне firewall. Чтобы начальное подключение к DNS-серверу прошло успешно я определю IP адрес для домена dns.quad9.net в файле hosts:

Write-Output "9.9.9.9`tdns.quad9.net" > D:\images\mnt\Windows\System32\drivers\etc\hosts

Users\Default\Appdata\Local\Microsoft\Windows\Shell\LayoutModification.xml

В каталоге D:\images\mnt\Users\Default\Appdata\Local\Microsoft\Windows\Shell создадим LayoutModification.xml со списком приложений, прикрепленных к панели задач:

@'
<LayoutModificationTemplate
    xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification"
    xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout"
    xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout"
    xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout"
    Version="1">
    <CustomTaskbarLayoutCollection PinListPlacement="Replace">
      <defaultlayout:TaskbarLayout>
        <taskbar:TaskbarPinList>
          <taskbar:DesktopApp DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"/>
          <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk"/>
          <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk"/>
          <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Information.lnk"/>
          <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Services.lnk"/>
          <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk"/>
          <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Disk Cleanup.lnk"/>
          <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Hyper-V Manager.lnk"/>
          <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Registry Editor.lnk"/>
          <taskbar:UWA AppUserModelID="windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel" />
          <taskbar:DesktopApp DesktopApplicationID="Microsoft.Windows.Explorer"/>
        </taskbar:TaskbarPinList>
      </defaultlayout:TaskbarLayout>
    </CustomTaskbarLayoutCollection>
</LayoutModificationTemplate>
'@ | Out-File -FilePath D:\images\mnt\Users\Default\Appdata\Local\Microsoft\Windows\Shell\LayoutModification.xml

Users\Default\Appdata\Local\Microsoft\Windows\Shell\LayoutModification.json

Создадим LayoutModification.json со списком приложений, закрепленных в меню Start:

@'
{
  "pinnedList": [
    { "desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" },
    { "desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" },
    { "desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" },
    { "desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Services.lnk" },
    { "desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Hyper-V Manager.lnk" },
    { "desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Registry Editor.lnk" },
    { "desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" },
    { "desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" },
    { "desktopAppLink": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }
  ]
}
'@ | Out-File -FilePath D:\images\mnt\Users\Default\Appdata\Local\Microsoft\Windows\Shell\LayoutModification.json

Answer files

Для автоматизации процесса установки системы воспользуемся Answer files или Unattend files. Кроме избавления от рутинных действий, файлы ответа позволяют отключить некоторые фичи и приложения. Например, для каждого нового пользователя Windows по умолчанию устанавливает Microsoft Teams. Удалить это приложение можно только с помощью Answer files.

Note

Чтобы перейти в раздел <settings pass="oobeSystem"> я вызываю sysprep, так как по какой-то причине мне не удалось заставить работать инструкцию Reseal:

<settings pass="auditUser">
    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
       <Reseal>
           <Mode>OOBE</Mode>
           <ForceShutdownNow>false</ForceShutdownNow>
        </Reseal>
    </component>
</settings>
Copy-Item "D:\configs\unattend.xml" "D:\images\mnt\unattend.xml"
Dism /Image:"D:\images\mnt" /Apply-Unattend:"D:\configs\unattend.xml"

Пример содержимого файла unattend.xml[документация]

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="windowsPE">
        <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <UserData>
                <AcceptEula>true</AcceptEula>
            </UserData>
            <Diagnostics>
                <OptIn>false</OptIn>
            </Diagnostics>
            <EnableNetwork>false</EnableNetwork>
        </component>
        <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <SetupUILanguage>
                <UILanguage>en-IE</UILanguage>
            </SetupUILanguage>
            <UILanguage>en-IE</UILanguage>
            <InputLocale>en-US;ru-RU</InputLocale>
            <SystemLocale>en-IE</SystemLocale>
            <UserLocale>en-IE</UserLocale>
        </component>
    </settings>
    <settings pass="offlineServicing">
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <TimeZone>UTC</TimeZone>
            <ComputerName>MacOS</ComputerName>
            <ConfigureChatAutoInstall>False</ConfigureChatAutoInstall>
            <OfflineUserAccounts>
                <OfflineLocalAccounts>
                    <LocalAccount>
                        <Password>
                            <Value>password</Value>
                            <PlainText>true</PlainText>
                        </Password>
                        <Group>Administrators</Group>
                        <Name>admin</Name>
                        <DisplayName>admin</DisplayName>
                    </LocalAccount>
                </OfflineLocalAccounts>
            </OfflineUserAccounts>
        </component>
        <component name="Microsoft-Windows-LUA-Settings" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <EnableLUA>false</EnableLUA>
        </component>
    </settings>
    <settings pass="specialize">
        <component name="Microsoft-Windows-Authentication-AuthUI" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <DisableStartupSound>true</DisableStartupSound>
        </component>
        <component name="Microsoft-Windows-BLB-WSB-Online-Main" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <EnableOnlineBackup>false</EnableOnlineBackup>
        </component>
        <component name="Microsoft-Windows-ErrorReportingCore" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <DisableWER>1</DisableWER>
        </component>
        <component name="Microsoft-Windows-Printing-Spooler-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <RemoveMPDW>1</RemoveMPDW>
            <RemoveMXDW>1</RemoveMXDW>
            <Start>0</Start>
        </component>
        <component name="Microsoft-Windows-RemoteAssistance-Exe" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <CreateEncryptedOnlyTickets>true</CreateEncryptedOnlyTickets>
            <fAllowToGetHelp>false</fAllowToGetHelp>
            <fAllowFullControl>false</fAllowFullControl>
            <MaxTicketExpiry>1</MaxTicketExpiry>
            <MaxTicketExpiryUnits>0</MaxTicketExpiryUnits>
        </component>
        <component name="Microsoft-Windows-SQMAPI" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <CEIPEnabled>0</CEIPEnabled>
        </component>
        <component name="Microsoft-Windows-SystemRestore-Main" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <DisableSR>1</DisableSR>
        </component>
        <component name="Microsoft-Windows-TabletPC-Platform-Input-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <TouchKeyboardAutoInvokeEnabled>True</TouchKeyboardAutoInvokeEnabled>
        </component>
        <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <fDenyTSConnections>true</fDenyTSConnections>
        </component>
    </settings>
    <settings pass="auditUser">
        <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <RunSynchronous>
                <RunSynchronousCommand wcm:action="add">
                    <Order>1</Order>
                    <Path>C:\Windows\system32\Sysprep\sysprep.exe /reboot /oobe /unattend:C:\unattend.xml</Path>
                </RunSynchronousCommand>
            </RunSynchronous>
        </component>
    </settings>
    <settings pass="oobeSystem">
        <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <InputLocale>en-US;ru-RU</InputLocale>
            <SystemLocale>en-IE</SystemLocale> 
            <UILanguage>en-IE</UILanguage>
            <UserLocale>en-IE</UserLocale>
        </component>
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <OOBE>
               <HideEULAPage>true</HideEULAPage>
               <HideLocalAccountScreen>true</HideLocalAccountScreen>
               <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
               <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
               <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
               <ProtectYourPC>3</ProtectYourPC>
            </OOBE>
            <UserAccounts>
                <LocalAccounts>
                  <LocalAccount wcm:action="add">
                     <Name>user</Name>
                     <Password>
                        <Value>password</Value>
                        <PlainText>true</PlainText>
                     </Password>
                     <Group>Users</Group>
                  </LocalAccount>
               </LocalAccounts>
            </UserAccounts>
            <AutoLogon>
                <Enabled>true</Enabled>
                <LogonCount>1</LogonCount>
                <Password>
                    <Value>password</Value>
                    <PlainText>true</PlainText>
                </Password>
                <Username>admin</Username>
            </AutoLogon>
            <FirstLogonCommands>
                <SynchronousCommand wcm:action="add">
                    <CommandLine>powershell -command "New-VMSwitch -Name 'LAN' -SwitchType Internal"</CommandLine>
                    <Order>1</Order>
                </SynchronousCommand>
                <SynchronousCommand wcm:action="add">
                    <CommandLine>powershell -command "New-VMSwitch -Name 'WAN' -NetAdapterName 'WiFi' -AllowManagementOS 0"</CommandLine>
                    <Order>2</Order>
                </SynchronousCommand>
                <SynchronousCommand wcm:action="add">
                    <CommandLine>powershell -command "Set-VMHost -VirtualHardDiskPath 'D:\ProgramData\Microsoft\Windows\Virtual Hard Disks'"</CommandLine>
                    <Order>3</Order>
                </SynchronousCommand>
                <SynchronousCommand wcm:action="add">
                    <CommandLine>powershell -command "Set-VMHost -VirtualMachinePath 'D:\ProgramData\Microsoft\Windows\Hyper-V'"</CommandLine>
                    <Order>4</Order>
                </SynchronousCommand>
                <SynchronousCommand wcm:action="add">
                    <CommandLine>powershell -command "`$VMs = Get-ChildItem -Path 'D:\ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines' -Filter '*.vmcx'; foreach (`$vm in `$VMs) { Import-VM -Path `$vm.FullName -VHDDestinationPath 'D:\ProgramData\Microsoft\Windows\Virtual Hard Disks' -Copy }"</CommandLine>
                    <Order>5</Order>
                </SynchronousCommand>
                <SynchronousCommand wcm:action="add">
                    <CommandLine>powershell -command "Dism /Online /Set-ReservedStorageState /State:disabled"</CommandLine>
                    <Description>Disable Reserved Storage</Description>
                    <Order>6</Order>
                </SynchronousCommand>
                <SynchronousCommand wcm:action="add">
                    <CommandLine>powershell -command "Disable-ComputerRestore -Drive 'C:\'"</CommandLine>
                    <Order>7</Order>
                </SynchronousCommand>
                <SynchronousCommand wcm:action="add">
                    <CommandLine>powercfg.exe /HIBERNATE OFF</CommandLine>
                    <Order>8</Order>
                </SynchronousCommand>
            </FirstLogonCommands>
        </component>
    </settings>
</unattend>

Драйверы устройств

Для компьютеров Surface Microsoft публикует драйверы в виде MSI-файла. Например, драйвера Surface Pro 7.

Распаковка msi-файла

msiexec /a "D:\drivers\SurfacePro7_Win11_22621_25.090.3489.0.msi" TargetDir="D:\drivers\tmp" /qn

Добавление распакованных драйверов в образ

Dism /Image:"D:\images\mnt" /Add-Driver /Driver:"D:\drivers\tmp" /Recurse

Список установленных драйверов

Получить список установленных 3rd-party драйверов (чтобы отобразить все дравйверы используйте опцию /all):

Dism /Image:"D:\images\mnt" /Get-Drivers /Format:Table

Удаление нежелательных драйверов

В качестве примера я удалю дравйвер для SD card reader

Dism /Image:"D:\images\mnt" /Remove-Driver /Driver:oem44.inf

Оптимизация размера образа

Проверка размер образа

Dism /Image:"D:\images\mnt" /Cleanup-Image /AnalyzeComponentStore

Deployment Image Servicing and Management tool
Version: 10.0.26100.5074

Image Version: 10.0.26200.6584

[==========================100.0%==========================] 

Component Store (WinSxS) information:

Windows Explorer Reported Size of Component Store : 9.60 GB

Actual Size of Component Store : 9.39 GB

    Shared with Windows : 6.73 GB
    Backups and Disabled Features : 2.65 GB
    Cache and Temporary Data :  0 bytes

Date of Last Cleanup : 2025-09-15 20:57:48

Number of Reclaimable Packages : 2
Component Store Cleanup Recommended : Yes

Очистка образа

Dism /Image:"D:\images\mnt" /Cleanup-Image /StartComponentCleanup /ResetBase

Deployment Image Servicing and Management tool
Version: 10.0.26100.5074

Image Version: 10.0.26200.6584

[==========================100.0%==========================] 
The operation completed successfully.

Применение изменений к образу install.wim

Dism /Unmount-Image /MountDir:"D:\images\mnt" /Commit

Развёртывание install.wim на виртуальный диск VHDX

Windows поддерживает загрузку с виртуальных дисков. Я предпочитаю иметь на диске один VHDX файл вместо нескольких системных разделов со множеством системных файлов. К тому же, чтобы создать backup достаточно скопировать VHDX файл.

Создать виртуальный диск фиксированного размера 25 ГБ

New-VHD -Path "D:\images\win11pro25h2.vhdx" -SizeBytes 25GB -Fixed
$vhd = Mount-VHD -Path "D:\images\win11pro25h2.vhdx" -Passthru
Initialize-Disk -Number $vhd.Number -PartitionStyle GPT
New-Partition -DiskNumber $vhd.Number -UseMaximumSize -DriveLetter V
Format-Volume -DriveLetter V -FileSystem NTFS -NewFileSystemLabel "VHDX" -Confirm:$true

Развернуть install.wim на виртуальном диске

Развернём на виртуальном диске образ install.wim, который мы подготовили ранее. Добавим опцию /compact, чтобы развернуть файлы операционной системы в сжатом виде и высвободить дополнительное дисковое пространство (режим Compact OS):

Dism /Apply-Image /ImageFile:"D:\images\install.wim" /index:6 /ApplyDir:V:\ /compact

Базовый образ системы готов. Извлечём его:

Dismount-VHD -Path "D:\images\win11pro25h2.vhdx"

Сделаем файлы install.wim и базовый VHDX доступными только на чтение:

Set-ItemProperty -Path "D:\images\install.wim" -Name IsReadOnly -Value $true
Set-ItemProperty -Path "D:\images\win11pro25h2.vhdx" -Name IsReadOnly -Value $true

Создать дочерний образ

Я использую базовый образ в качестве резервной копии - файл остаётся неизменным на протяжении всей жизни системы. Все изменения будут записываться в дочерний образ. В случае, например, неудачного обновления, для восстановления системы достаточно создать новый дочерний образ.

New-VHD -ParentPath "D:\images\win11pro25h2.vhdx" -Path "D:\images\win11pro25h2-202510.vhdx" -Differencing

Установить обновления Windows

Второй вторник каждого месяца Microsoft публикует commulative update для Windows - накопительный пакет обновлений, который включает все предыдущие исправления. Загрузить пакет обнволений можно из Microsoft Update Catalog. Установить обновления можно с помощью следующий команд.

Смонтировать дочерний образ

Mount-VHD -Path "D:\images\win11pro25h2-202510.vhdx"

Установить обновлений

Dism /Image:"V:\" /Add-Package /PackagePath:"D:\updates\windows11.0-kb5066128-x64-ndp481_e2239075b7e05662cbbe1b4acfe9e57e40a2b9c0.msu"

Dism /Image:"V:\" /Add-Package /PackagePath:"D:\updates\windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu"

Dism /Image:"V:\" /Add-Package /PackagePath:"D:\updates\windows11.0-kb5066835-x64_2f193bc50987a9c27e42eceeb90648af19cc813a.msu"

Добавление загрузочной записи

Смонтируем скрытый загрузочный раздел UEFI

mountvol S: /S

Добавим в BCD загрузку из D:\images\win11pro25h2-202510.vhdx. Команда bcdboot выполнена без параметра /d, поэтому новая запись будет загрузочной по умолчанию:

cd v:\windows\system32
bcdboot v:\windows /s S: /f UEFI

Установка системы завершена! Теперь во время следующего старта система автоматически загрузится из образа D:\images\win11pro25h2-202510.vhdx.

About

Immutable Windows with atomic updates (kinda... not really)

Topics

Resources

Stars

Watchers

Forks