De-bloat Windows 11 Education

[synaesthesia]

On 16/05/2025 at 13:56, altecsole said:

We redirect AppData, which seems to help with this. Plus, seating plans mean that students tend to logon to the same computers each time, so quicker logons after the initial logon.

 

christ, what?

Out of interest, why? It was bad form in Windows 7, mostly decided it shouldn't be a thing any more in Windows 10 and absolutely shouldn't be done in this day and age - hence interested in what a reason might be to do it?

[altecsole]

2 minutes ago, synaesthesia said:

christ, what?

Out of interest, why? It was bad form in Windows 7, mostly decided it shouldn't be a thing any more in Windows 10 and absolutely shouldn't be done in this day and age - hence interested in what a reason might be to do it?

I was sceptical too, when I took over this setup. However, it seems to work well, with reasonable logon times and a consistent experience no matter which computer users logon to.

[6Foot3]

3 hours ago, Squelch said:

As we use Intune with A3 licenses we have to install Pro first.

Why?

 

We use Intune with A3, and we install Education.

We have no activation issues.

[Squelch]

We had "activation required" on screen when directly installing education, I think this is because the activation key in the bios was reporting a different OS version. Once we installed Pro the activation message went away and it auto upgraded to enterprise.

[6Foot3]

29 minutes ago, Squelch said:

We had "activation required" on screen when directly installing education, I think this is because the activation key in the bios was reporting a different OS version. Once we installed Pro the activation message went away and it auto upgraded to enterprise.

I think we did get this issue. I think there was a setting in Intune to activate with A3 

 

[Squelch]

MS say to install Education directly as you have done. It certainly didn't work 12 months ago.

 

 

[Olliedawg]

On 16/05/2025 at 14:31, Hoyt said:

Thom we use redirected Desktops which helps a lot.  Also if initial logins are slow check this in your Group Policy:

 

Computer Configuration, Administrative Templates, System, and open Logon

 

Disable Show first sign-in animation

 

If I am remembering correctly this is what I did years ago when we first went to Windows 10 to speed up the first login of a user to a PC.

Yea this skips the useless animation which wastes between 5-10 seconds for no reason

[talksr]

1 hour ago, Squelch said:

We had "activation required" on screen when directly installing education, I think this is because the activation key in the bios was reporting a different OS version. Once we installed Pro the activation message went away and it auto upgraded to enterprise.

 

Not sure if this would help but I have a remediation script in our tenancy for all devices. 

It has the following detection script:

Quote

#Get license activation status

$LicenseStatus = Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object { $_.PartialProductKey } | Select-Object -ExpandProperty LicenseStatus

# Check license status

if($LicenseStatus -eq 1)
{
    Write-Output "Activated"
    Exit 0

}
else 
{
    Write-Output "Not Activated"
    Exit 1
}

 

 

And then the following remediation script:
 

Quote

#Define the MAK key
$MAKKey = "MAK-CODE-HERE"

# Set the MAK key
Write-Ouput "Installing MAK Key $MAKKey..."
slmgr.vbs /ipk $MAKKey

#Activate Windows
Write-Output "Activating Windows..."

try {
    slmgr.vbs /ato
    Write-Output "Windows Activation Complete"
}
catch {
    <#Do this if a terminating exception happens#>
    $message = $_.Exception.Message
    Write-Output "Windows could not be activated: $message" 
}
 

 

 

We have never had any activation related issues since I set this up. ☺️

[Squelch]

Thank you for sharing the scripts, I am trying to move away from using a product key for activation. It was fine when we used to buy Windows Desktop licenses and effectively had unlimited activations. As I said, the problems went away when installing pro, I am going to try directly installing education again and see what happens. Either something was broken with 365 when I last tried this (12 to 18 months ago) or MS have moved the goalposts and are now allowing education direct installs.

[Hoyt]

12 hours ago, 5nowman said:

What was the big reason you used Windows 11 Education and not Professional seeing as you are doing an app cleanout.

 

Especially with Windows 11 Microsoft has removed a lot of management functions from all versions except for Education.  I poured over the list one time recently and was shocked at how many management options they even removed from the Enterprise version.  We don't use Intune yet but there are tons of settings in Group Policy that only work or are only present in the Education Edition.

[garethEds]

On 16/05/2025 at 13:59, aydee said:

Redirected Desktops, and using OpenShell to only show needed items in the start menu.

This is for our Win10 setup, but planning on using the same system for Win11 when we deploy it.

Can you tell me more about OpenShell?

[aydee]

9 minutes ago, garethedmondson said:

Can you tell me more about OpenShell?

OpenShell is a start menu replacement that allows us to customise the look and links contained within it. It gets rid of the standard menu, and its win10 related issues, Ads, searching the interent for files etc. 

 

 https://github.com/Open-Shell/Open-Shell-Menu/wiki

 

We have one for students with their programs, and one for staff with other exe's and programs that they might need that the students dont. This, combined with the rediredcted Desktops, and Applocker, mean the students cant navigate to any folder or file that we do not want them to, which is about as secure as it can be IMO.

Edited May 21, 2025 by aydee

[garethEds]

49 minutes ago, aydee said:

OpenShell is a start menu replacement that allows us to customise the look and links contained within it. It gets rid of the standard menu, and its win10 related issues, Ads, searching the interent for files etc. 

 

 https://github.com/Open-Shell/Open-Shell-Menu/wiki

 

We have one for students with their programs, and one for staff with other exe's and programs that they might need that the students dont. This, combined with the rediredcted Desktops, and Applocker, mean the students cant navigate to any folder or file that we do not want them to, which is about as secure as it can be IMO.

 

Shae there isn't something that good for Windows 11 that would allow me to configure it better with a similar setup interface. Or have I missed something?

[aydee]

I think it should work with Win11, but we have not started testing anything to do with 11 yet, so cant help you there unfortunatly.
The Openshell wiki has peopl ediscussing it, so it seems to be doing something.

 

https://github.com/Open-Shell/Open-Shell-Menu/discussions/

[Squelch]

On 21/05/2025 at 11:23, Squelch said:

MS say to install Education directly as you have done. It certainly didn't work 12 months ago.

 

 

 

Just to follow up on this (apologies that it isn't de-bloat related.)

I installed Education directly on the computer and it did not activate. I then tried Pro Education and it did not activate either. I then noticed error code: 0x8007232B

Turns out that my computers were trying to find a KMS server to activate the volume key against (I've never had a KMS server) so I needed them to revert back to the digital key in the bios. I found a script that does this here: SCCMentor

Once I ran the script Windows Education immediately activated.

 

 

 

[Squelch]

And then 20 minutes later they have reverted back to Enterprise. I don't get it.

Giving up for now!

[KK20]

On 21/05/2025 at 08:16, synaesthesia said:

christ, what?

Out of interest, why? It was bad form in Windows 7, mostly decided it shouldn't be a thing any more in Windows 10 and absolutely shouldn't be done in this day and age - hence interested in what a reason might be to do it?

Bad form?  Why? The only negative is on the "backend", i.e. thats a lot of network traffic, your fileserver cannot cope etc.  I dont find this at all.  I especially like this page https://jkindon.com/stop-redirecting-appdata/  all these points are fantastic IF you have 1:1 devices (I like the pictures/video section - so if you DONT redirect those and pupils save to them, they are saved to the local profile- errrrr thats not going to work on multiple devices is it?  so you redirect to  follow the documents surely?).  If you dont, then your PCs will All need larger storage drives to cope with profile size.  I know our rooms had 256 SSDs and the "popular" PCs struggled for free space without redirection.  Now we are a small school, less than 1k students.  We have a pair of servers with more cores than it needs, NVME drives running a 2 node storage spaces direct.  IOPS rarely break 5k, I could probably run cached HDD for those levels, but there was an offer on the NVME backplanes and the drives so thats what I got (plus no RAID card to worry about) - cheaper than speccing ALL pupil pcs with larger drives.   Switching is star twin stack 10gb and can easily handle the redirection.  So why not?  There isnt a technical reason not to.  Now roaming profiles can be an issue, that would be a lot of copying to and fro when logging on

 

It only redirects the roaming part which is, roaming!  If you dont have 1:1 devices then profiles are going to bloat your PCs.  Adobe roaming is usually 200mb bloating to 400mb on startup, unfortunately we use CC a lot, and CC really does like to bloat the appdata folder.  Redirect?  No problem!  Microsoft adds another chunk and wait till you run teams and its cache of doom.  That needs to sync too. This is per PC per user.  Even with room seating plans this can make a real mess.  We cut down from 7 day profile removal to 60 days with appdata redirection (on 256 SSDs).   The downside?  you cannot use KFR onedrive, its one or the other.  No biggie!  We have a basic quota for my documents, increased for those with video edit rights (subjects with big videos) and people use onedrive.  This is normal for us anyway as pupils are now getting their own ipads with onedrive as the primary storage, teams for homework etc.

 

I have yet to find a single program that will not work on our system.  Now granted we dont run many, but the ones we do use (MS, Adobe CC, Teams) love to cache in the roaming.

 

On 07/05/2025 at 21:41, timbo343 said:

Another update to this, I've used this - https://schneegans.de/windows/unattend-generator/ - to create a custom autounattend.xml file and added the xml to a Windows 11 ISO using AnyBurn. A feature in there is called Edit Image File where I added the autounattend.xml file to the root of the ISO.

 

 

I have no idea on this website, nor that you could remove programs during unattend!  I only used by unattend to, well, unattend and hands off my installs.  Im changing my XML next week as this will help.

[supportman]

Good news for upcoming releases.....

 

https://www.windowslatest.com/2025/07/10/removing-microsoft-apps-could-become-easy-in-windows-11-25h2/

[Hoyt]

Interesting that it didn't actually work.  In the course of testing I had found a few Group Policy settings that Windows 11 either completely ignore or are only followed on Education Edition.

 

The one thing I would have really liked to see in the list was Microsoft Store.

[5nowman]

Hi,

is there just a simple script to say.. if name is in xml file

remove app

make sure it doesn't come back.

 

I want GPO's to handle telemetry etc....   the scripts seem to add other stuff which I don't want.

 

5nowman

 

[Hoyt]

This link may be useful for the initial image:

https://schneegans.de/windows/unattend-generator/

 

As far as making sure things don't come back, Microsoft has never thought that they shouldn't be able to shove a bunch of garbage we don't ask for on our PCs.  Our GP disables Windows Update but Copilot showed up everywhere anyway.

 

We do block some things with our Sophos antivirus software to make sure folks can't launch it even if they bring a shortcut in on a flash drive.

[timbo343]

 

1 hour ago, 5nowman said:

Hi,

is there just a simple script to say.. if name is in xml file

remove app

make sure it doesn't come back.

 

I want GPO's to handle telemetry etc....   the scripts seem to add other stuff which I don't want.

 

5nowman

 

 

This:

https://www.edugeek.net/forums/topic/223315-de-bloat-windows-11-education/#findComment-1999632

 

And then add -allusers to the end of the script (remove-appxpackage) as per this post:

https://www.edugeek.net/forums/topic/223315-de-bloat-windows-11-education/#findComment-2000225

 

it's been working great for us.

 

 

 

 

 

[5nowman]

11 minutes ago, timbo343 said:

 

 

This:

https://www.edugeek.net/forums/topic/223315-de-bloat-windows-11-education/#findComment-1999632

 

And then add -allusers to the end of the script (remove-appxpackage) as per this post:

https://www.edugeek.net/forums/topic/223315-de-bloat-windows-11-education/#findComment-2000225

 

it's been working great for us.

 

 

 

 

 

When are you running these? through a startup script on group policy? or base image before capturing it?

[timbo343]

10 minutes ago, 5nowman said:

When are you running these? through a startup script on group policy? or base image before capturing it?

 

Deployment as part of the task sequence after installing any applications.

 

You could run it as part of a login script though, copying the 2 files (or the folder) to C : and then run the script at login which references the xml or maybe look at doing it at the computer level at startup instead of the user level.