So I just need to run Windows in a vm with some decent privacy. I just need to run an exe and use a web browser like LibreWolf so my usecase is minimal.
I saw someone on Reddit link this page for Windows’ ISOs is it safe?
(I ask because as I use Mullvad Microsoft blocks my requests to download ISOs directly from their website)
So in summary, what version of windows is best and why, after that what scripts should I run to remove some telemetry? I heard privacy.sexy is good.
Thanks in advance
Take a look at Windows LTSC.
You can basically disable most if not all telementry when you use LTSC. Just make sure you are happy with LTSC’s features.
In this case, I would pause the VPN and download the ISO from MS, rather than downloading it from non-official sites.
Telemetry options are the same as Enterprise but it does come without preinstalled bloat
Does it not work on Wine/Proton?
If this is a home PC, try to have Steam use the “Add a non-Steam game to Library” function and have Steam do the heavy lifting of compatibility for you.
It’s definitely worth paying a little extra to buy Windows 10/11 Pro over Windows Home as this gives you more control when you can install updates and AFAIK Home version forces you to create an online account.
Windows 10 LTSC is the most private stock version, and yes it still has secuirty updates.
Then, a more advance choice is to make your own ISO like I do.
Pro doesn’t require using an MS account?
Windows 11 Education (which is the same as Enterprise but I prefer this one), but it’s quite laborious & manual to harden it for privacy. I would not use LTSC as a daily driver.
Nope. You don’t need to create an online account. You get other benefits as well like having more time to install Win11 updates
Education has some restrictions, like forced SafeSearch, and Edge will send an “X-Ms-Edu” header. So, better use Enterprise unless you actually have an education license.
I can’t find SafeSearch in my settings, must be an Edge/Bing/MS Account thing, none of which I use.
Semi-related: after a fresh installation, you can select an EEA country in the Out of Box Experience and enable optional diagnostic data. This will allow you to uninstall Edge & Bing as if they were normal programs - the only clean way to get rid of them AFAIK. As I said, configuring W11 for privacy is a headache and requires these special “runbook steps”.
As for Enterprise, it’s not included in the Consumer ISO, so you will need to download the Business ISO from a 3rd party and then verify the file is genuine by comparing checksums. Using Microsoft’s media creation tool is just easier and includes Education.
Last time I checked it was possible to download the Enterprise ISO by downloading the windows media creation tool and then running MediaCreationTool.exe /EULA Accept /Retail /MediaArch x64 /MediaLangCode en-US /MediaEdition Enterprise in powershell
I beg everyone who has some knowledge to offer to contribute to the community wikis. You do not have to edit the wiki either. You can simply reply to the wiki to provide information, and that would be a thousand times more helpful than dispersed threads.
Setting your region to EEA is enough. But if you turn on “optional diagnostic data,” you’ll be sending a ton of telemetry about yourself.
ISO doesn’t matter unless it’s LTSC. To install Enterprise, just enter the Enterprise GVLK key when installing from a Consumer ISO. You can also enter this key after installation and the edition will change. The only difference between Consumer and Business is that these keys are already included in Business.
Thanks, good to know!
Yeah, I should have said you obviously will revert the Optional Diagnostic Data option when you’re disabling all that telemetry (via Settings, User Group Policy editing, these internet scripts, or otherwise).
No, this can be bypassed.