OpenWin - Unattended Windows 11 install with Brave and 7-Zip, no Edge, no bloat

OpenWin is an answer file (autounattend.xml) plus an $OEM$ folder that you add to the official Windows 11 installer from Microsoft. Windows Setup does the rest. It installs Windows 11 Pro with open-source apps by default, without Edge and most of the preinstalled apps, and with a local account.

Downloads

• OpenWin.zip: for a USB drive made with the Media Creation Tool
• autounattend.iso: for a virtual machine
• Source code, instructions and all releases: GitHub - cris2k47/OpenWin: What if Windows were open source? An unattended Windows 11 install with Brave and 7-Zip by default, no Edge, no bloat and a local account. Add autounattend.xml and $OEM$ to the official installer.

Both downloads contain only autounattend.xml and the $OEM$ folder, always with the latest Brave and 7-Zip.

What you get
Open-source apps by default

• Brave is the default browser and PDF viewer. It's pinned to the taskbar and follows the Windows display language. New users start without the VPN, Leo AI, Wallet and Rewards buttons, sponsored images, Brave News, the welcome page or P3A usage statistics. They can turn any of these back on in Brave's settings.
• 7-Zip opens archives and disk images: zip, 7z, rar, tar, gz, xz, zst, iso, cab, wim, vhd(x), dmg and more.

No bloat

• Microsoft Edge is uninstalled.
• These preinstalled apps are removed: Clipchamp, Clock, Camera, Copilot, Dev Home, Family, Feedback Hub, Get Help, News, Outlook (new), Phone Link, Power Automate, Quick Assist, Solitaire Collection, Sound Recorder, Sticky Notes, Teams, Terminal, To Do, Weather, Widgets and Xbox.
• OneDrive isn't set up for new users.
• The Start menu only has Brave, Microsoft Store, Settings, Photos, Paint, Calculator, Notepad, Snipping Tool and File Explorer. The taskbar has File Explorer and Brave.
• No web suggestions in Search.

Sensible defaults

• Dark theme and the classic right-click menu.
• File Explorer opens to This PC and shows file extensions and hidden files.
• Mouse acceleration is off.
• Windows Update doesn't replace your drivers.

Easier setup

• Works on PCs without TPM 2.0, Secure Boot or 4 GB of RAM.
• Uses a local account: no Microsoft account and no internet connection needed.
• Skips the privacy settings screen, leaving its optional settings off.

How it works
OpenWin doesn't modify install.wim or boot.wim. It only uses Windows Setup's own unattended features:

• windowsPE: skips the TPM, Secure Boot and RAM checks, picks Windows 11 Pro with Microsoft's generic key, and has Setup copy $OEM$ to the new installation.
• specialize: removes the provisioned apps with DISM, uninstalls Edge, installs 7-Zip and Brave silently, and imports the registry tweaks for the machine and the default user profile.
• oobeSystem: hides the Microsoft account screens and the privacy settings screen.

Apart from the official Brave and 7-Zip installers, everything is plain text (XML, .cmd, .reg, JSON) that you can read on GitHub before you use it.

Always up to date
A GitHub Actions workflow checks for new Brave and 7-Zip releases every 5 minutes. When one is out, it verifies the official installer: Brave's against Brave's GPG-signed checksums, and 7-Zip's against the SHA-256 of its GitHub release. It then commits the update and publishes a new OpenWin release. Older releases are kept.

How to use it
USB drive

1. Make a Windows 11 USB drive with the Media Creation Tool.
2. Extract OpenWin.zip and copy autounattend.xml and the $OEM$ folder to the root of the USB drive, next to setup.exe.
3. Boot the PC from the USB drive.

Virtual machine

1. Create the VM with at least 2 CPUs and the Windows 11 ISO from Microsoft as its boot CD/DVD drive.
2. Add a second CD/DVD drive with autounattend.iso.
3. Boot from the Windows 11 ISO. Setup finds autounattend.xml on the second drive by itself.

In VirtualBox and VMware, turn off their own unattended installation (Easy Install in VMware), otherwise OpenWin is ignored. The README has tips for VirtualBox, VMware, Hyper-V and QEMU.

Setup still asks for your language and keyboard, the drive to install to, your region, a Wi-Fi network on PCs without a wired connection, and your account name and password. Setup can erase the drive you pick, so back up first.

Activation
OpenWin installs Windows 11 Pro with Microsoft's generic installation key, which doesn't activate Windows. A PC with a Windows 10 or 11 Pro digital license activates on its own once it's online. Otherwise, enter your own Pro key. No activators are included.

Feedback, bug reports and suggestions are welcome, here or on GitHub.

OpenWin is under the MIT License. Brave is by Brave Software (MPL 2.0) and 7-Zip is by Igor Pavlov (GNU LGPL). Windows is a trademark of Microsoft. OpenWin isn't affiliated with Microsoft, Brave Software or 7-Zip.

JMO but I think you need to make it clear in your opening statement that this is for PRO only, rather than as an afterthought at the end.

glasskuter said:

JMO but I think you need to make it clear in your opening statement that this is for PRO only, rather than as an afterthought at the end.

Click to expand...

true, i will either change it so the user chooses which version to install or just clarify that it installs pro.

the problem about installing home is that this reg key wouldnt work:
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"ExcludeWUDriversInQualityUpdate"=dword:00000001

glasskuter said:

JMO but I think you need to make it clear in your opening statement that this is for PRO only, rather than as an afterthought at the end.

Click to expand...

Hmmm, I'll bet that we could modify this easily to work with Home as well. I'll have to obtain this and test it tomorrow if I have time.

hsehestedt said:

Hmmm, I'll bet that we could modify this easily to work with Home as well. I'll have to obtain this and test it tomorrow if I have time.

Click to expand...

some policies works on home and some not, this one is not working sadly, let me know if you fix it tho

cris2k47 said:

some policies works on home and some not, this one is not working sadly, let me know if you fix it tho

Click to expand...

This is true. MS deliberately doesn't want a business to "cheap out" and purchase Home (not Pro) PC's for the workplace.

cris2k47 said:

the problem about installing home is that this reg key wouldnt work:
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"ExcludeWUDriversInQualityUpdate"=dword:00000001

Click to expand...

Would that not be because there are 3 registry entries that deal with disabling include drivers with Windows Update? I have used this registry tweak in both home and pro.
reference: Enable or Disable Include Drivers with Windows Updates in Windows 11

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"ExcludeWUDriversInQualityUpdate"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching]
"SearchOrderConfig"=dword:00000003

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\PolicyState]
"ExcludeWUDrivers"=dword:00000001

Referring to the CSP docs, this policy excludes Home.

ExcludeWUDriversInQualityUpdate​

"SearchOrderConfig" works on all versions, because it pre-dates most of the later policies.

glasskuter said:

Would that not be because there are 3 registry entries that deal with disabling include drivers with Windows Update? I have used this registry tweak in both home and pro.
reference: Enable or Disable Include Drivers with Windows Updates in Windows 11

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"ExcludeWUDriversInQualityUpdate"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching]
"SearchOrderConfig"=dword:00000003

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\PolicyState]
"ExcludeWUDrivers"=dword:00000001

Click to expand...

i dont want to disable searchorderconfig since MSI Driver Utility Installer installs through that, ASUS driverhub installs through WPBT

@cris2k47 A promising start. I personally prefer not to have your choice of a browser imposed but rather no browser installed. No problem having the installers included but not installed. Same deal with 7Zip. Why do so many of these "debloated" versions feel the need to install one persons choice, another persons bloat? I might try this out with some edits to not install Brave or 7Zip.
What is the state of default disk encryption? I am guessing that "local account" prevents the default disk encryption?
Keep developing this to work on an unmolested MS Win11 iso to set it apart from the many molested lite isos. Maybe give people a choice to pre-process the scripts and make some of their own choices?
Watching how this goes

jajk said:

@cris2k47 A promising start. I personally prefer not to have your choice of a browser imposed but rather no browser installed. No problem having the installers included but not installed. Same deal with 7Zip. Why do so many of these "debloated" versions feel the need to install one persons choice, another persons bloat? I might try this out with some edits to not install Brave or 7Zip.
What is the state of default disk encryption? I am guessing that "local account" prevents the default disk encryption?
Keep developing this to work on an unmolested MS Win11 iso to set it apart from the many molested lite isos. Maybe give people a choice to pre-process the scripts and make some of their own choices?
Watching how this goes

Click to expand...

The initial idea was actually a website that looks like an IDE, that lets you edit the files and lets you choose which browser to install, but that would cost money to me.

There is not much open-source browser, also making a website with ads kind off goes against the idea of the project being open-source.

Device Encryption (or full BitLocker) can happen regardless of whether you're using a Local Account.

A MS Account allows the keys to be mirrored in the cloud. You can disable disk encryption using a simple reg change, which a number of ISO debloating or customizing scripts will do for you.

I might add a RemovePkgs.cmd that removes OneDrive, recall and bitlocker packages with DISM /Remove-Package, but i need to make sure It doesnt break Windows update.