Guide to install and optimize Windows 10 LTSC

Last update: 1 Nov 2025

/!\ PAY ATTENTION /!\ :
Previously there was an ISO debloating section in this guide which I have now REMOVED as it's causing too many problems for people following it that shouldn't be following it. This guide should be removed from the /fwt/ paste to be honest.

Note: Some of the optimizations here might not work for you or they might not be useful for the kind of usage you do with your computer. Simply take them as inspiration for your optimization and pick what's useful for your particular case.


This guide loads screenshot images from a third-party site: Imgbb.


Table of Contents


Backup your important files (browser configs, photos, documents, passwords etc) in a safe place before installing a new Windows!


A note on Windows versions

You might still be wondering which version of Windows 10 LTSC you should install.
The answer is always Windows 10 IoT Enterprise LTSC and the reason why is because LTSC IoT has longer servicing support, ending in 2032 versus 2027 for non-IoT LTSC. There are no other differences between the two versions, outside of the activation methods.

Although the tweaks will work for other versions of Windows, they require more work and debloating.
LTSC is the best base to start because it doesn't come with a lot of the annoying "features" and Microsoft integration of Windows 10 Home/Pro.

I want to install X language instead of English.

Always get the en-US image, we can install other language packs during optimization or after we're done installing the system.
LTSC IoT only has an English ISO, non-IoT has other languages.

Can LTSC IoT play vidya?

Yes, it can. There are no compatibility differences between versions.

Is LTSC slower than other versions of Windows?

No, and not since version 20H2 (guessing you're talking about the Windows 10 thread scheduler and Ryzen CPUs?).

Tip: Update your BIOS to the latest version your manufacturer provides so you can make full use of new Intel and AMD improvements. If you bought XMP RAM make sure the XMP profile is enabled in your BIOS to get the full benefits of your hardware.


Verify the image

This step is one of the most important when we're installing critical software on our system, yet a lot of people skip this.

Do not download weird Windows images off the internet, get your image straight from Microsoft!

After acquiring your LTSC IoT ISO you need to compare the hashes.
If you didn't download from Microsoft then go here and select your ISO version.
Look at the SHA-256 and compare it to the hash of the ISO you downloaded.

How to get hashes on Windows?

It's very simple, there are a few methods:

  • Open Powershell and type:

    get-filehash "C:\PATH\TO\MY-WINDOWS-IMAGE.iso" -Algorithm SHA256

  • Get a tiny program called HashCheck or OpenHashTab that nests itself inside the Properties menu of files, giving you an extra tab to easily calculate hashes.
  • Programs like 7-Zip are also able to generate hashes.

Create a bootable USB disk

Required: Some form of bootable media with more than 4 GB of disk space

To create a bootable USB disk and install our Windows image, we will use a tool called Ventoy.

Ventoy is extremely easy to use and most interestingly is re-usable: you don't need to reformat the disk every time you want to try a new image.
It's as simple as dragging and dropping an image into the Ventoy partition and Ventoy will do all the heavy-lifting for you, you can even keep multiple images if you have the space for it.

Download the latest Ventoy release and unzip it, then launch Ventoy2Disk.exe.

ventoyGUI

Select your USB device, click Install and we're done!
Ventoy is now installed on the USB key and a large partition named "Ventoy" is ready for us to put our ISO images in.

ATTENTION: If you're installing a custom Windows image on your main and only machine, I HIGHLY (!!) recommend you keep an untouched, original Windows 10 ISO in your Ventoy partition as well. Trust me on this one, it'll save your ass if you need to re-install Windows and the custom image doesn't work correctly.


Before installing Windows

It's important to do some preparation before we boot into the Windows install process.
After backing up all our configs, drivers and files into a safe place, we should download a few tools we will need to configure our system without an internet connection.

Tools you should have:

  • Graphics card drivers and driver trimming utility like NvCleanstall for Nvidia or Radeon Software Slimmer for AMD cards
  • An archive file utility like 7-Zip, WinRAR, PeaZip etc.
  • A software firewall for WFP (Windows Filtering Platform) such as SimpleWall, TinyWall or one to control the native Windows Firewall more easily e.g. Windows Firewall Control
  • Your favorite tool to tweak Windows settings: e.g. Winaero Tweaker, Autoruns
  • A full package (i.e. not the net installer) browser like Firefox or Chrom* flavor if you fully removed IE and Edge
  • Other software you commonly install and registry tweaks you like to apply
  • This guide!

Tip: If you have the space for it, you can put these files in a separate folder in the Ventoy partition.


Boot into USB

After rebooting simply press F10, F12, Delete, Esc or the equivalent for your BIOS to boot into the Ventoy USB key.

I can't boot into my USB.

Disable Secure Boot in your BIOS settings.
Check if you're booting in UEFI mode, alternatively that CSM support is disabled or configured for UEFI.


Install Windows

The installation process should be pretty straight-forward.

Please double, triple check where you are installing Windows and which partitions you are deleting if any.

At this point of the install, I recommend you disconnect your device from the Internet so Windows won't be able to connect just yet.

Pick Custom Install and delete any partitions on the disk, let Windows fill the whole disk.
We can deal with shrinking or making new partitions later as Windows likes to install a 500 MB recovery partition right after the Windows partition and this complicates disk management.

Out Of Box Experience

After Windows installs, the system will boot into Out Of Box Experience (OOBE) where you get to select your language, keyboard, user name and privacy settings.

  • When it asks you to connect to the Internet (if you're offline), pick Continue with limited setup at the bottom.
  • When it asks you for a Microsoft account, pick Domain join instead or Use Local Account at the bottom.
  • Disable everything when it asks you to "Choose your privacy settings".

Proceed with the configuration, let it reboot and you should finally set foot in your shiny new Windows system.
If you did everything correctly, this is how barebones it should look:

install02

Perfection, now on to configuring everything...


Common questions and problems

The initial setup is asking me for a product key.

Choose "I don't have a product key", if you have a genuine key stored on your system it will activate Windows automatically.
If not, then you'll have to use HWID activation with MAS once you login into Windows.

Which operating system should I install?

If you did things right in the guides before it wouldn't be asking that question, but always pick IoT Enterprise LTSC.

The installation crashes during setup (OOBE).

You removed essential Windows install components and the setup can't proceed. Start over.

The installation crashes after setup (OOBE) and doesn't boot into Windows (Why did my PC restart?).

Let it connect to the internet and try to repair itself, if it doesn't and gets stuck in a boot loop you likely removed some essential Windows component and will need to start over.

Help! I'm getting an error that a media driver is missing during install and can't proceed.

That usually means the ISO is bad, but sometimes the solution is to disconnect all drives except the one you want to install Windows on.
Check your USB settings in the BIOS and try other USB ports.


Everything below is done at your own risk!

Post-install tweaking

Before connecting to the Internet and launching Windows Update, we have a few tasks to do.

Install drivers

Right after installing we should look for any missing drivers in our system.
Point Windows to the backup folder of your drivers if you have any.

install03

Install and debloat graphics card drivers

Both AMD and Nvidia driver packages have increased tremendously in features and telemetry over the past years, but we don't want any of that on our system. Using tools like NvCleanstall for Nvidia and Radeon Software Slimmer for AMD cards, we can seriously trim down the drivers to the bare minimum we need and remove all the phoning home.

AMD:

  • Disable all packages except for AMD Catalyst Settings and the drivers
  • Disable all Scheduled Tasks

Nvidia:

  • Keep only the required display driver components
  • Depending on your needs keep PhysX, HD Audio via HDMI, Optimus (for laptops)
  • Disable all types of telemetry
  • Enable MSI (leave at default) and any patches

Once installed launch their respective control panels and configure everything.
You should disable their background services after so they don't run in the background doing nothing.


Install a firewall

Nowadays, almost all malware tries to phone home so we don't want anything connecting to the internet without our consent, I highly recommend you install one of the firewalls mentioned above and familiarize yourself with the one that suits you best. They are all lightweight, fairly easy to use and will be your first line of defense.

About Windows Firewall

Even though they can both work together, you don't need Windows Firewall to be enabled to use firewalls like Simplewall or Tinywall because they use the Windows Filtering Platform (WFP) which is the underlying technology the Windows Firewall rests upon.

You should note however that if you still have Windows Firewall enabled that it can take precedence over the other firewalls, and most importantly that in its default configuration pretty much any software can introduce and remove rules from it, sometimes even without your knowledge. Windows Filtering Platform has several layers that traffic goes through and some layers have higher priority over others as shown in the documentation ("Network traffic traverses sub-layers from the highest priority to the lowest priority. "). This is a complicated technical topic, I recommend you read these simplewall issues here and here if you're interested.

gpo02

If you find the native Windows Firewall too complicated to configure then I can recommend Windows Firewall Control, it's what I personally use (not a shill, it's been bought out by Malwarebytes recently but it's still excellent software!). This program has the ability to protect Windows Firewall from external tampering and only firewall rules made through the program are allowed to be set. If you use use this, don't use Simplewall or TinyWall at the same time of course.


Antivirus & Security

I don't recommend you use an active antivirus (including Windows Defender) unless you're permanently downloading and using files from dodgy places. They can slow down your computer and introduce stutters and latency when you're doing CPU/GPU intensive tasks.
Anti-viruses continually run in the background and scan your every move, most commercial ones also like to phone home frequently.

How to scan for viruses

If you suspect something is wrong, Windows has a native virus scanner for most common infections called Windows Malicious Software Removal Tool (MRT) that gets updated every month through Windows Update.
You can launch it by simply searching for MRT from the Start menu.

Use an online scan service like VirusTotal before you open a suspicious file or archive.
Keep a portable instance of ClamAV for whenever you need it.

User Account Control

Keep this enabled at the Default setting, it's good to have and keeps you alert even if it can be annoying.


Configure Windows


Services

This is where we can reduce the footprint and resource usage of our system quite a bit. Check the official Microsoft documentation on disabling services if you want a more safe guide.

This part is a lot more experimental and highly dependent on the usage you make of your system. Disabling the wrong services for things you need WILL lead to breakage!

The simplest way to disable services is through services.msc tool.
Go into Start Menu and search for the "Services" App.
Expand the Name column and then order everything by Status "Running", you'll see some 80 or more services running.

services

We're going to reduce this to less than 50 services (ymmv).

Certain services can only be disabled via the registry due to permissions restrictions.
In the Registry (regedit), navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and look for the Start DWORD entry.

From there, you can change their startup configuration with:

  • 1 = System (drivers)
  • 2 = Automatic
  • 3 = Manual
  • 4 = Disabled

If you use Bluetooth enable:

  • AVCTP service
  • Bluetooth Audio Gateway Service
  • Bluetooth Support Service
  • Bluetooth User Service
  • Device Association Service
  • DevicesFlow
  • DevicePicker
  • Radio Management Service

If you use Night Light enable:

  • Display Policy Service
  • Connected Devices Platform User Service (CDPUserSvc)
  • Connected Devices Platform Service (CDPSvc)
  • Network Connection Broker

If you use WiFi / Mobile Hotspot enable:

  • CNG Key Isolation
  • Extensible Authentication Protocol
  • Internet Connection Sharing (ICS)
  • Windows Mobile Hotspot Service
  • WLAN AutoConfig

If you use Windows Update enable:

  • Storage Service
  • Update Orchestrator Service
  • Windows Modules Installer
  • Windows Update
  • Windows Update Medic Service

Fix for Network and System settings pages error, enable:

error

  • Connected Devices Platform User Service
  • Windows Push Notifications System Service
  • Windows Push Notifications User Service

Services required to manually install Store apps (Appx), enable:

  • Application Information
  • AppX Deployment Service (AppXSVC)
  • Capability Access Manager Service
  • Client License Service (ClipSVC)
  • Microsoft Store Install Service
  • Storage Service
  • Windows Modules Installer
  • Windows Update

Task Scheduler

There are few interesting tasks we can take a look at disabling, they mostly involve sending telemetry to Microsoft.
Do a Start menu search for "Task Scheduler" or open Run and type taskschd.msc.

Navigate to Task Scheduler Library > Microsoft > Windows then under each of the following folders disable a task by right-clicking then selecting Disable:

  • Application Experience :file_folder:: Microsoft Compatibility Appraiser
  • Autochk :file_folder:: Proxy
  • Customer Experience Improvement Program :file_folder:: Consolidator, UsbCeip
  • Diagnosis :file_folder:: RecommendedTroubleshootingScanner
  • Disk Diagnostic :file_folder:: Microsoft-Windows-DiskDiagnosticDataCollector
  • International :file_folder:: Synchronize Language Settings
  • Windows Error Reporting :file_folder:: QueueReporting

Group Policy

To minimize the damage once we connect to the internet and launch Windows Update, we will configure a few Group Policy Object (GPO) settings.
Search the Start Menu for "Group Policy" or open Run and launch gpedit.msc.

Navigate to Computer Configuration > Administrative Templates > All Settings.
Press the first column of the list that appears to order everything alphabetically, go through the list and:

Disable the following:
gpo01 Disabling Windows Updates here makes it so Windows will only check for updates manually when we press the button to do so.

Enable the following:
Pay attention that for some of the options you have to select the correct setting in the drop-down menu after enabling them such as "Prevent Pre-Launching" for Microsoft Edge or "[0] Security [Enterprise Only]" for Allow Telemetry.
gpo02


Remove Edge

If after updating and rebooting you run into the unpleasant surprise of Microsoft Edge being installed on your machine and nagging you right away, then I suggest you run this handy script to nuke it. Microsoft seems to be ignoring all the registry tweaks to NOT install Edge, as usual.


Various Tweaks


Here I'll be adding various tweaks as I remember or find them.
As always, use at your own discretion.

Disable 8dot3 filenames

Run cmd with admin privileges and enter:
(1 = all volumes / 3 = all but system volume):

fsutil behavior set disable8dot3 1
OR
fsutil behavior set disable8dot3 3

Strip all 8dot3 files from C: (repeat for other drives if wanted/needed):
fsutil 8dot3name strip /f /s C:

Reboot.

To remove 8dot3 filenames during Windows install, read up on Schneegan's website.

Disable Microsoft Sync Center

If you don't use Offline Files and don't sync your Windows settings you should disable and prevent Sync (mobsync.exe) to launch at logon.
Even if you disable Offline Files services and Settings sync in Group Policy, mobsync.exe will still launch at logon, here's how to fix it without having to rename the executable.

Run Powershell with admin privileges and enter:

New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mobsync.exe" | New-ItemProperty -Name Debugger -PropertyType String -Value "%windir%\System32\systray.exe" -Force

Explanation:
This trick adds a registry string key to HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options for the mobsync.exe executable, preventing it from launching. Can also be used for other executables you don't want launching.


That's it for this guide, you should now have a fairly minimal Windows installation, ready to customize to your needs.

Hope it was helpful! :four_leaf_clover:

Edit

Pub: 18 Sep 2022 22:47 UTC

Edit: 01 Nov 2025 19:12 UTC

Views: 139196