OpenWin - Unattended Windows 11 install with Brave, Chrome or Edge and 7-Zip, no bloat

OpenWin is an answer file (autounattend.xml) plus an $OEM$ folder that you add to the official Windows 11 installer from Microsoft. Windows Setup does the rest. It installs Windows 11 with open-source apps by default, without most of the preinstalled apps, and with a local account.

It comes in three editions: with Brave, with Google Chrome, or with Microsoft Edge. The Brave and Chrome editions uninstall Edge.

Downloads

• Brave: OpenWin-Brave.zip for a USB drive, autounattend-Brave.iso for a virtual machine
• Chrome: OpenWin-Chrome.zip for a USB drive, autounattend-Chrome.iso for a virtual machine
• Edge: OpenWin-Edge.zip for a USB drive, autounattend-Edge.iso for a virtual machine
• Source code, instructions and all releases: GitHub - cris2k47/OpenWin: What if Windows were open source? An unattended Windows 11 install with Brave and 7-Zip by default, no Edge, no bloat and a local account. Add autounattend.xml and $OEM$ to the official installer.

The zip files are for a USB drive made with the Media Creation Tool. Every download contains only autounattend.xml and the $OEM$ folder, always with the latest 7-Zip, plus the latest Brave or Chrome in those editions.

What you get
Open-source apps by default

• Brave is the default browser and PDF viewer in the Brave edition. It's pinned to the Start menu and taskbar and follows the Windows display language. New users start without the VPN, Leo AI, Wallet and Rewards buttons, sponsored images, Brave News, the welcome page or P3A usage statistics. Apart from the welcome page, they can turn any of these back on in Brave's settings.
• 7-Zip opens archives and disk images: zip, 7z, rar, tar, gz, xz, zst, iso, cab, wim, vhd(x), dmg and more.

In the Chrome edition

• Google Chrome replaces Brave as the default browser and PDF viewer, in the Start menu and on the taskbar. Chrome itself keeps all its default settings.

In the Edge edition

• Microsoft Edge stays installed instead of Brave, as Windows ships it, pinned to the Start menu and taskbar. New users start without Edge's welcome screens, its prompt to use the recommended browser settings or the Copilot button, and with the Downloads button always shown. They can show the Copilot button or hide the Downloads button again in Edge's settings.

No bloat

• Microsoft Edge is uninstalled, except in the Edge edition.
• These preinstalled apps are removed: Clipchamp, Clock, Camera, Copilot, Dev Home, Family, Feedback Hub, Get Help, Microsoft 365 Copilot, Microsoft Bing, News, Outlook (new), Phone Link, Power Automate, Quick Assist, Solitaire Collection, Sound Recorder, Sticky Notes, Teams, To Do, Weather, Widgets and Xbox.
• OneDrive is removed.
• The Start menu pins only the edition's browser (Brave, Chrome or Edge), Microsoft Store, Settings, Photos, Paint, Calculator, Notepad, Snipping Tool and File Explorer, and the taskbar pins only File Explorer and the browser.
• No web suggestions in Search.

Sensible defaults

• Dark theme and the classic right-click menu.
• File Explorer opens to This PC and shows file extensions and hidden files.
• Mouse acceleration is off.

Easier setup

• Works on PCs without TPM 2.0, Secure Boot or 4 GB of RAM.
• Lets you choose the edition of Windows 11, such as Home or Pro, without asking for a product key.
• Uses a local account: no Microsoft account and no internet connection needed.
• Skips the privacy settings screen, leaving its optional settings off.

How it works
OpenWin doesn't modify install.wim or boot.wim. It only uses Windows Setup's own unattended features:

• windowsPE: skips the TPM, Secure Boot and RAM checks and the product key page, and has Setup copy $OEM$ to the new installation.
• specialize: removes the provisioned apps and OneDrive with DISM, uninstalls Edge (except in the Edge edition), installs 7-Zip and Brave or Chrome silently, and imports the registry tweaks for the machine and the default user profile.
• oobeSystem: hides the Microsoft account screens and the privacy settings screen.

Apart from the official Brave, Chrome and 7-Zip installers, everything is plain text (XML, .cmd, .reg, JSON) that you can read on GitHub before you use it.

Always up to date
A GitHub Actions workflow checks for new Brave, Chrome and 7-Zip releases every 5 minutes. When one is out, it verifies the official installer: Brave's against Brave's signed checksums, Chrome's against Google's digital signature (Google doesn't publish checksums), and 7-Zip's against the SHA-256 of its GitHub release. It then commits the update and publishes a new OpenWin release. Older releases are kept. Edge comes with Windows and updates itself.

How to use it
USB drive

1. Make a Windows 11 USB drive with the Media Creation Tool.
2. Extract OpenWin-Brave.zip, OpenWin-Chrome.zip or OpenWin-Edge.zip and copy autounattend.xml and the $OEM$ folder to the root of the USB drive, next to setup.exe.
3. Boot the PC from the USB drive.

Virtual machine

1. Create the VM with at least 2 CPUs and the Windows 11 ISO from Microsoft as its boot CD/DVD drive.
2. Add a second CD/DVD drive with autounattend-Brave.iso, autounattend-Chrome.iso or autounattend-Edge.iso.
3. Boot from the Windows 11 ISO. Setup finds autounattend.xml on the second drive by itself.

In VirtualBox and VMware, turn off their own unattended installation (Easy Install in VMware), otherwise OpenWin is ignored. The README has tips for VirtualBox, VMware, Hyper-V and QEMU.

Setup still asks for your language, time format and keyboard, the edition of Windows 11 (unless the PC has a license in its firmware), the drive to install to, your region and keyboard layout, a Wi-Fi network on PCs without a wired connection (choose I don't have internet to stay offline), and a name and password for your account, plus three security questions if you set a password. Setup can erase the drive you pick, so back up first.

Activation
Setup doesn't ask for a product key. It lets you choose which edition of Windows 11 to install instead. A PC that came with Windows usually has a license in its firmware, and Setup then installs that license's edition without asking. Windows activates on its own once it's online if the PC has a license for the edition installed, either in its firmware or as a digital license from an earlier Windows 10 or 11. Otherwise, enter a product key in Settings. No activators are included.

Feedback, bug reports and suggestions are welcome, here or on GitHub.

OpenWin is under the MIT License. Brave is by Brave Software (MPL 2.0), Google Chrome is by Google (Google Chrome Terms of Service) and 7-Zip is by Igor Pavlov (GNU LGPL with the unRAR restriction). Windows is a trademark of Microsoft. OpenWin isn't affiliated with Microsoft, Brave Software, Google or 7-Zip.

JMO but I think you need to make it clear in your opening statement that this is for PRO only, rather than as an afterthought at the end.

glasskuter said:

JMO but I think you need to make it clear in your opening statement that this is for PRO only, rather than as an afterthought at the end.

Click to expand...

true, i will either change it so the user chooses which version to install or just clarify that it installs pro.

the problem about installing home is that this reg key wouldnt work:
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"ExcludeWUDriversInQualityUpdate"=dword:00000001

glasskuter said:

JMO but I think you need to make it clear in your opening statement that this is for PRO only, rather than as an afterthought at the end.

Click to expand...

Hmmm, I'll bet that we could modify this easily to work with Home as well. I'll have to obtain this and test it tomorrow if I have time.

hsehestedt said:

Hmmm, I'll bet that we could modify this easily to work with Home as well. I'll have to obtain this and test it tomorrow if I have time.

Click to expand...

some policies works on home and some not, this one is not working sadly, let me know if you fix it tho

cris2k47 said:

some policies works on home and some not, this one is not working sadly, let me know if you fix it tho

Click to expand...

This is true. MS deliberately doesn't want a business to "cheap out" and purchase Home (not Pro) PC's for the workplace.

cris2k47 said:

the problem about installing home is that this reg key wouldnt work:
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"ExcludeWUDriversInQualityUpdate"=dword:00000001

Click to expand...

Would that not be because there are 3 registry entries that deal with disabling include drivers with Windows Update? I have used this registry tweak in both home and pro.
reference: Enable or Disable Include Drivers with Windows Updates in Windows 11

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"ExcludeWUDriversInQualityUpdate"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching]
"SearchOrderConfig"=dword:00000003

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\PolicyState]
"ExcludeWUDrivers"=dword:00000001

Referring to the CSP docs, this policy excludes Home.

ExcludeWUDriversInQualityUpdate​

"SearchOrderConfig" works on all versions, because it pre-dates most of the later policies.

glasskuter said:

Would that not be because there are 3 registry entries that deal with disabling include drivers with Windows Update? I have used this registry tweak in both home and pro.
reference: Enable or Disable Include Drivers with Windows Updates in Windows 11

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"ExcludeWUDriversInQualityUpdate"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching]
"SearchOrderConfig"=dword:00000003

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\PolicyState]
"ExcludeWUDrivers"=dword:00000001

Click to expand...

i dont want to disable searchorderconfig since MSI Driver Utility Installer installs through that, ASUS driverhub installs through WPBT

@cris2k47 A promising start. I personally prefer not to have your choice of a browser imposed but rather no browser installed. No problem having the installers included but not installed. Same deal with 7Zip. Why do so many of these "debloated" versions feel the need to install one persons choice, another persons bloat? I might try this out with some edits to not install Brave or 7Zip.
What is the state of default disk encryption? I am guessing that "local account" prevents the default disk encryption?
Keep developing this to work on an unmolested MS Win11 iso to set it apart from the many molested lite isos. Maybe give people a choice to pre-process the scripts and make some of their own choices?
Watching how this goes

jajk said:

@cris2k47 A promising start. I personally prefer not to have your choice of a browser imposed but rather no browser installed. No problem having the installers included but not installed. Same deal with 7Zip. Why do so many of these "debloated" versions feel the need to install one persons choice, another persons bloat? I might try this out with some edits to not install Brave or 7Zip.
What is the state of default disk encryption? I am guessing that "local account" prevents the default disk encryption?
Keep developing this to work on an unmolested MS Win11 iso to set it apart from the many molested lite isos. Maybe give people a choice to pre-process the scripts and make some of their own choices?
Watching how this goes

Click to expand...

The initial idea was actually a website that looks like an IDE, that lets you edit the files and lets you choose which browser to install, but that would cost money to me.

There is not much open-source browser, also making a website with ads kind off goes against the idea of the project being open-source.

Device Encryption (or full BitLocker) can happen regardless of whether you're using a Local Account.

A MS Account allows the keys to be mirrored in the cloud. You can disable disk encryption using a simple reg change, which a number of ISO debloating or customizing scripts will do for you.

I might add a RemovePkgs.cmd that removes OneDrive, recall and bitlocker packages with DISM /Remove-Package, but i need to make sure It doesnt break Windows update.

cris2k47 said:

I might add a RemovePkgs.cmd that removes OneDrive, recall and bitlocker packages with DISM /Remove-Package, but i need to make sure It doesnt break Windows update.

Click to expand...

I'm not so sure about removing BitLocker altogether. Wouldn't that also prevent you from reading BitLocker to go disks like thumb drives or external HDDs / SSDs?

My preference is to simply disable the automatic BitLocker encryption, but ironically, I then DO BitLocker encrypt my Windows drive, I just don't want it to do it automatically because I encrypt with specific keys that I can mathematically calculated in my head. This way I require no backup of the keys anywhere other than in my own head

hsehestedt said:

other than in my own head

Click to expand...

You're still sharp as a tack and can do that. But I'd be up the proverbial creek if I did that. Maybe not back in my hey-day, but, sigh.... The pills... they ain't workin' anymore.

glasskuter said:

You're still sharp as a tack and can do that. But I'd be up the proverbial creek if I did that. Maybe not back in my hey-day, but, sigh.... The pills... they ain't workin' anymore.

Click to expand...

LOL. No, I think that you would be able to do this easily. It took some research, but it is simple addition and subtraction using just two numbers at a time and those numbers are only between zero and nine, so it's very easy.

glasskuter said:

Would that not be because there are 3 registry entries that deal with disabling include drivers with Windows Update? I have used this registry tweak in both home and pro.
reference: Enable or Disable Include Drivers with Windows Updates in Windows 11

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"ExcludeWUDriversInQualityUpdate"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching]
"SearchOrderConfig"=dword:00000003

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\PolicyState]
"ExcludeWUDrivers"=dword:00000001

Click to expand...

cris2k47 said:

i dont want to disable searchorderconfig since MSI Driver Utility Installer installs through that, ASUS driverhub installs through WPBT

Click to expand...

Just use the other 2 reg. Those should block driver updates via windows update. searchorderconfig Is for when devices are connected and it searches for drivers.

dacrone said:

Just use the other 2 reg. Those should block driver updates via windows update. searchorderconfig Is for when devices are connected and it searches for drivers.

Click to expand...

cant disable searchorderconfig as users with msi motherboards wouldnt get msi driver utility installer

As someone who already runs W11 Pro with Edge uninstalled and Brave as my default browser anyway, I won’t be going back to the world of MS bloatware anytime time soon. Quite simply, my everyday PC experience without all that, imo, unnecessary garbage, is the best it’s been in years.

cris2k47 said:

cant disable searchorderconfig as users with msi motherboards wouldnt get msi driver utility installer

Click to expand...

Reread what I said