Building a Truly Native Windows 11 24H2 Unattend.xml (Debloat + Tweaks + Deployment)

[rh1363]

Hi everyone,

As many of you probably know, Windows 11 is usually shipped with a lot of limitations, cloud integrations, telemetry components, advertisements, placeholders, and preinstalled bloat that many power users and deployment engineers don’t actually want.

I know that some of these limitations can be bypassed through autounattend.xml, and some of the bloat can be removed during installation.
However, after researching many existing unattended/debloat projects, I noticed that a lot of them are not truly native solutions anymore.

Many projects:

download third-party tools,

run external debloat scripts,

install additional applications,

or rely heavily on post-install hacks.

That is NOT my goal.

My goal is to build a mostly native and clean Windows deployment approach using:

official Windows setup passes,

native unattend functionality,

supported policies,

registry-based deployment methods,

and built-in Windows tools as much as possible.

The purpose is to:

reduce manual post-install work,

automate repetitive tweaks,

speed up deployment on different systems,

and create a reusable, reliable, and lightweight Windows 11 installation workflow.

Current Testing Environment

Windows 11 24H2

Virtual machine testing

Custom autounattend.xml

Native registry/policy tweaks

No third-party debloat applications

The XML itself loads correctly and all setup phases execute successfully.
Features That Worked Successfully
Hardware Requirement Bypasses

These worked correctly:

TPM bypass

Secure Boot bypass

RAM check bypass

CPU check bypass

Storage/Disk requirement bypass

OOBE / Setup Automation

These also worked:

Local account creation

OOBE online-account bypass

AutoLogon

EULA skipping

OneDrive / Provisioned App Cleanup

Mostly successful:

OneDrive setup executables removed

Teams removed

Outlook mostly removed

Several Store placeholders prevented from auto-installing

Widgets / News / Taskbar Cleanup

Widgets are no longer visible

News/Feeds appear disabled

Fast Startup

Successfully disabled

Many Registry Policies

A large number of privacy and policy-related registry entries were written successfully.
Features That Did NOT Fully Work

This is the interesting part.

Some tweaks successfully changed registry values, but the actual Windows behavior did NOT change accordingly.
Driver Download Disable

The related registry values exist, but Windows still appears willing to download drivers automatically.

sysdm.cpl still showed the setting enabled until I manually changed it.
Explorer LaunchTo = This PC

Registry values exist, but File Explorer still opens to Home / Quick Access instead of This PC.
SmartScreen Disable

The registry keys were applied, but SmartScreen still remains enabled in Windows Security.
Telemetry Disable

Telemetry-related registry values exist, but services like DiagTrack are still running.
Consumer Features / Cloud Content

The related policies exist, but it is difficult to verify whether Windows internally still delivers recommendations, cloud content, suggested apps, etc.
Windows Feeds / Widgets Packages

Widgets are visually disabled, but small placeholder packages still remain under Installed Apps.
Feedback Hub

Feedback Hub still remained installed.
Edge Removal

I understand Edge is now deeply integrated into the OS, but I am still researching whether there is a deployment-safe/native way to:

remove Edge,

prevent reinstall,

while avoiding WebView2 breakage.

Start Menu Binary Tweaks (VisiblePlaces)

I tested binary Start Menu tweaks, but they appear inconsistent or ignored in 24H2.
Main Question

It seems many older Windows tweak methods still write registry values successfully, but no longer fully affect actual Windows behavior in modern Windows 11 builds.

So my main question is:

Which of these features are still realistically achievable:

natively,

cleanly,

reliably,

and deployment-safe

through:

autounattend.xml

native Windows setup passes

official policy-based configuration

provisioning

DISM

or supported Microsoft deployment methods

WITHOUT heavily relying on:

third-party debloaters,

external tools,

aggressive post-install scripts,

scheduled task deletion,

or unsupported hacks?

Looking for Collaboration / Ideas

I would really appreciate feedback, ideas, testing results, or collaboration from people who are actively working on:

Windows deployment,

unattended installation,

debloating,

enterprise imaging,

MDT/Sysprep,

or modern Windows 11 customization.

My goal is not to create another “aggressive debloat script,” but rather to build a clean, stable, reusable, and mostly native Windows 11 unattended deployment setup.

Thanks in advance.

This is my autounattend.xml file:

`

true 1 reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassTPMCheck /t REG_DWORD /d 1 /f 2 reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassSecureBootCheck /t REG_DWORD /d 1 /f 3 reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassRAMCheck /t REG_DWORD /d 1 /f 4 reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassCPUCheck /t REG_DWORD /d 1 /f 5 reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassStorageCheck /t REG_DWORD /d 1 /f 6 reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassDiskCheck /t REG_DWORD /d 1 /f 1 reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f 2 reg add "HKLM\Software\Policies\Microsoft\Windows\OneDrive" /v DisableFileSyncNGSC /t REG_DWORD /d 1 /f 3 cmd /c if exist %SystemRoot%\System32\OneDriveSetup.exe del /f /q %SystemRoot%\System32\OneDriveSetup.exe 4 cmd /c if exist %SystemRoot%\SysWOW64\OneDriveSetup.exe del /f /q %SystemRoot%\SysWOW64\OneDriveSetup.exe 5 PowerShell -NonInteractive -WindowStyle Hidden -Command "Get-AppxProvisionedPackage -Online | Where-Object {$_.PackageName -like '*Outlook*'} | Remove-AppxProvisionedPackage -Online" 6 PowerShell -NonInteractive -WindowStyle Hidden -Command "Get-AppxPackage -AllUsers *Outlook* | Remove-AppxPackage -AllUsers" 7 PowerShell -NonInteractive -WindowStyle Hidden -Command "Get-AppxProvisionedPackage -Online | Where-Object {$_.PackageName -like '*Teams*'} | Remove-AppxProvisionedPackage -Online" 8 PowerShell -NonInteractive -WindowStyle Hidden -Command "Get-AppxPackage -AllUsers *Teams* | Remove-AppxPackage -AllUsers"

  <!-- Local account — skips Microsoft account screen entirely -->
  <UserAccounts>
    <LocalAccounts>
      <LocalAccount wcm:action="add">
        <Name>Shiny</Name>
        <Group>Administrators</Group>
        <Password>
          <Value></Value>
          <PlainText>true</PlainText>
        </Password>
      </LocalAccount>
    </LocalAccounts>
  </UserAccounts>

  <!-- Auto-login once so FirstLogonCommands run under the right user -->
  <AutoLogon>
    <Username>Shiny</Username>
    <Enabled>true</Enabled>
    <LogonCount>1</LogonCount>
    <Password>
      <Value></Value>
      <PlainText>true</PlainText>
    </Password>
  </AutoLogon>

  <OOBE>
    <HideEULAPage>true</HideEULAPage>
    <ProtectYourPC>3</ProtectYourPC>
    <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
    <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
    <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
    <SkipMachineOOBE>true</SkipMachineOOBE>
    <SkipUserOOBE>true</SkipUserOOBE>
  </OOBE>

  <FirstLogonCommands>
    <SynchronousCommand wcm:action="add">
      <Order>1</Order>
      <CommandLine>reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>2</Order>
      <CommandLine>reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowCopilotButton /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>3</Order>
      <CommandLine>reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsCopilot" /v TurnOffWindowsCopilot /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>4</Order>
      <CommandLine>reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v SearchboxTaskbarMode /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>5</Order>
      <CommandLine>reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v SearchboxTaskbarModeCache /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>6</Order>
      <CommandLine>reg add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>7</Order>
      <CommandLine>reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SystemPaneSuggestionsEnabled /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>8</Order>
      <CommandLine>reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v BingSearchEnabled /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>9</Order>
      <CommandLine>reg add "HKLM\Software\Policies\Microsoft\Dsh" /v AllowNewsAndInterests /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>10</Order>
      <CommandLine>reg add "HKLM\Software\Policies\Microsoft\Windows\Windows Feeds" /v EnableFeeds /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>11</Order>
      <CommandLine>reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Communications" /v ConfigureChatAutoInstall /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>12</Order>
      <CommandLine>reg add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v DisableCloudOptimizedContent /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>13</Order>
      <CommandLine>reg add "HKLM\Software\Policies\Microsoft\Edge" /v HideFirstRunExperience /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>14</Order>
      <CommandLine>reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_Layout /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>15</Order>
      <CommandLine>PowerShell -NonInteractive -WindowStyle Hidden -Command "Set-ItemProperty -Path 'Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Start' -Name 'VisiblePlaces' -Value $([convert]::FromBase64String('ztU0LVr6Q0WC8iLm6vd3PC+zZ+PeiVVDv85h83sYqTe8JIoUDNaJQqCAbtm7okiCRIF1/g0IrkKL2jTtl7ZjlEqwvXRK+WhPi9ZDmAcdqLyGCHNSqlFDQp97J3ZYRlnU')) -Type 'Binary'"</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>16</Order>
      <CommandLine>reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>17</Order>
      <CommandLine>reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "LaunchTo" /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>18</Order>
      <CommandLine>reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>19</Order>
      <CommandLine>reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebWebContentEvaluation" /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>20</Order>
      <CommandLine>reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DeferFeatureUpdates" /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>21</Order>
      <CommandLine>reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "ExcludeWUDriversInQualityUpdate" /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>22</Order>
      <CommandLine>reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching" /v "SearchOrderConfig" /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>23</Order>
      <CommandLine>reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>24</Order>
      <CommandLine>reg add "HKLM\SOFTWARE\Policies\Microsoft\Assistance\ControlPanel" /v "NoImplicitFeedbackLogging" /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>25</Order>
      <CommandLine>reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Location" /v "DisableLocation" /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>26</Order>
      <CommandLine>reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableSettingSync" /t REG_DWORD /d 2 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>27</Order>
      <CommandLine>reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableSettingSyncUserOverride" /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>28</Order>
      <CommandLine>reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" /v "Enabled" /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>29</Order>
      <CommandLine>reg add "HKCU\Control Panel\International\User Profile" /v "HttpAcceptLanguageOptOut" /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>30</Order>
      <CommandLine>reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Start_TrackProgs" /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>31</Order>
      <CommandLine>reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>32</Order>
      <CommandLine>reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy" /v "TailoredExperiencesWithDiagnosticDataEnabled" /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>33</Order>
      <CommandLine>reg add "HKCU\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy" /v "HasAccepted" /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>34</Order>
      <CommandLine>reg add "HKCU\Software\Microsoft\Input\Personalization" /v "RestrictImplicitInkCollection" /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>35</Order>
      <CommandLine>reg add "HKCU\Software\Microsoft\Input\Personalization" /v "RestrictImplicitTextCollection" /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>36</Order>
      <CommandLine>reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d 1 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>37</Order>
      <CommandLine>reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "PublishUserActivities" /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>38</Order>
      <CommandLine>reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableActivityFeed" /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
    <SynchronousCommand wcm:action="add">
      <Order>39</Order>
      <CommandLine>reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "CloudSearch" /t REG_DWORD /d 0 /f</CommandLine>
    </SynchronousCommand>
  </FirstLogonCommands>
</component>

<component name="Microsoft-Windows-SecureStartup-FilterDriver"
           processorArchitecture="amd64"
           publicKeyToken="31bf3856ad364e35"
           language="neutral"
           versionScope="nonSxS"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <PreventDeviceEncryption>true</PreventDeviceEncryption>
</component>

<component name="Microsoft-Windows-EnhancedStorage-Adm"
           processorArchitecture="amd64"
           publicKeyToken="31bf3856ad364e35"
           language="neutral"
           versionScope="nonSxS"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <TCGSecurityActivationDisabled>1</TCGSecurityActivationDisabled>
</component>

`