buswedg/rebuilding_win11_machine_from_scratch.md

Rebuilding a Windows 11 Machine from Scratch

What?

My very opinionated view of how to build a Windows 11 machine (from completely fresh OS install), with a focus on privacy and reduced bloat.

Why?

I normally rebuild my Windows machines a couple times a year. I've learnt various things along the way, and would like to have something laid out that I can consistently follow. So, I'm going to use this guide for my own reference, but also share it for anyone interested.

Note

This guide is based on an install of Windows 11 Pro 10.0.26200 Build 26200.

Steps

Download a Windows 11 ISO image builder from UUP dump (https://uupdump.net/). When downloading the builder, I recommend you:
- Use the 'Latest Public Release' build.
- Include only the Windows edition you intend to install (e.g., Windows 11 Pro).
- Select 'Download and convert to ISO' as the download method.
- In the conversion options page:
  - Select 'Include updates'.
  - Avoid selecting 'Run component cleanup'.
Build the Windows 11 ISO by extracting the builder package and running uup_download_windows.cmd.
Burn the ISO to a freshly FAT32-formatted USB drive using Rufus (https://rufus.ie/en/). In the 'Customize Windows Installation' prompt, select:
- Remove requirement for 4GB+ RAM, Secure Boot and TPM 2.0.
- Remove requirement for an online Microsoft account.
- Create a local account with your desired username.
Boot from the USB (you may need to invoke boot options on startup or change your boot priority via BIOS/UEFI).
Install Windows 11. I recommend you:
- Set up the machine as a 'new device' (if you connect your Microsoft account).
- Turn off all data sharing options on the privacy settings page.
- Decline all targeted experience customizations.
- Skip mobile phone integration.
- Decline M365 and additional cloud storage offers.
Open Windows Updates and perform any available updates. To do so:
- Press Win + R and run ms-settings:windowsupdate.
- Uncheck the option to 'Get the latest updates as soon as they're available'.
- Select 'Check for updates'.
- Install any (non-preview) updates, allowing for any necessary reboots.
Rename your computer (if not prompted during install). To do so:
- Press Win + R and run ms-settings:about.
- Click 'Rename this PC', enter your desired name, and follow the prompts to restart.
Update your full display name (if using a local account). To do so:
- Press Win + R and run lusrmgr.msc.
- Open the Users folder, double-click your user account.
- Enter a new 'Full name' and apply.
Update your sign-in options (if using a local account). To do so:
- Press Win + R and run ms-settings:signinoptions.
- Select 'PIN (Windows Hello)' and configure.
Update OneDrive settings (if using a Microsoft account). To do so:
- Open OneDrive and its settings.
- Turn off 'Save space and download files as you use them'.
- In Backup > Manage backup, stop the backup of Desktop, Documents, and Pictures.
Run CTTWinUtil (https://github.com/ChrisTitusTech/winutil) to apply common tweaks. To do so:
- Open PowerShell as Administrator and run:
```
irm "https://christitus.com/win" | iex
```
- On the 'Tweaks' page, apply the 'Standard' tweaks.
- Also apply the following custom preferences on the 'Tweaks' page:
  - Dark Theme for Windows: enabled
  - Bing Search in Start Menu: disabled
  - Recommendations in Start Menu: disabled
  - Show Hidden Files: enabled
  - Show File Extensions: enabled
  - Search Button in Taskbar: enabled
  - Task View Button in Taskbar: disabled
  - Widgets Button in Taskbar: disabled
- On the 'Updates' page, enable 'Security Settings' for Windows Updates.

Configure virtualization features depending on the machine's purpose:

For a Gaming Machine (Disables virtualization overhead): Open PowerShell as Administrator and run:

Disable-WindowsOptionalFeature -Online -FeatureName VirtualMachinePlatform -NoRestart
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" -Name "Enabled" -Value 0

For a Development Machine (Enables Hyper-V, WSL, etc.): Open PowerShell as Administrator and run:

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All -NoRestart
Enable-WindowsOptionalFeature -Online -FeatureName VirtualMachinePlatform -NoRestart
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux -NoRestart

(Restart your machine if you applied either of these)

If you have a dedicated AMD or NVIDIA GPU, go through a process to clean/ re-install the GPU drivers manually. To do so:
- Download the latest driver for your GPU.
- Disable any network adapaters connecting you to the internet.
- Restart your machine in safe mode.
- Run Display Driver Uninstaller (https://www.guru3d.com/download/display-driver-uninstaller-download/).
- Restart your machine.
- Install the new GPU driver.
- Enable any previously disabled network adapaters.
- Restart your machine.
- Note: If you have an NVIDIA GPU, you should use NVCleanInstall (https://nvcleanstall.net/) to download and build the driver package.
Remove unnecessary programs and Windows optional features. I recommend using these PowerShell helper scripts:
- Store App Uninstaller: https://github.com/buswedg/windows-helpers/tree/main/store-app-uninstaller
- To remove Legacy Media Player and Steps Recorder, run in Admin PowerShell:
```
Remove-WindowsCapability -Online -Name "Media.WindowsMediaPlayer~~~~12.0.0.0"
Remove-WindowsCapability -Online -Name "App.StepsRecorder~~~~0.0.1.0"
```
Use WinGet to install preferred programs. I recommend using this helper script to install preferred packages in bulk:
- Helper script: https://github.com/buswedg/windows-helpers/tree/main/winget-installer
Download and install any remaining programs WinGet doesn't offer.
Manage startup apps. Press Ctrl + Shift + Esc to open Task Manager, navigate to the Startup Apps tab, and disable unnecessary items.
Disable Hibernation to save disk space (no hiberfil.sys) and avoid potential driver initialization errors from fast startup. To do so:
- Run in Admin PowerShell:
```
powercfg /hibernate off
```

Troubleshooting

Windows Repair

Repair active system files via Administrative PowerShell:

sfc /scannow

Repair the system image source by running DISM:

DISM /Online /Cleanup-Image /RestoreHealth

Reset Windows Update

Run the following in an Administrative PowerShell to clear the cache and restart update services:

net stop wuauserv
net stop bits
Remove-Item -Path "$env:windir\SoftwareDistribution\*" -Recurse -Force
net start wuauserv
net start bits

Other

Flush DNS cache:

ipconfig /flushdns

Check disk for errors (requires restart):

chkdsk c: /f