Tiny11 Builder — Ultimate Edition (2026)

Turn Microsoft's official Windows 11 ISO into a small, clean, private one, with a graphical builder for the common options, or detailed command-line control.

With the built-in Default preset, it requests these changes to the resulting installation:

• remove planned bloat apps, Edge and OneDrive, and disable targeted AI/Widgets/advertising policies;
• send minimal telemetry;
• install without a Microsoft account or a network connection;
• skip the TPM / Secure Boot / CPU / RAM checks.

Default retains the Update, Defender and Store components; effective policy/runtime behavior depends on Windows edition/version and target testing.

This project is a fork of ntdevlabs/tiny11builder. Its full history is kept on main, and the 2026 edition follows as regular commits on top. It selectively adapts fixes from 20 community projects (see Credits and the branch comparison).

Implementation reviewed at 2ae045d, 2026-10-05; version label remains 2026.09. Start with the documentation map, agent handoff, architecture/pipeline and verification matrix. Together they explain current behavior, constraints, history and unfinished validation from Markdown alone.

The latest app checks passed in PowerShell 5.1 and 7 (CI). Two earlier fresh Standard x64 Pro builds measured 9m18s / 14.75 GB uncompressed with cleanup skipped and 21m06s / 6.23 GB maximum with normal cleanup. These were at 7aa45d5, before later PR/reference safeguards. No latest-revision full ISO or VM installation is claimed. The historical final output is absent at its recorded path; source ISO and compact evidence remain. See PERFORMANCE.md.

• Current state and documentation
• Highlights
• Quick start
• The GUI
• Standard or Core
• Presets
• Command line
• What a build does
• After installing
• Customising
• Troubleshooting
• Project layout
• Development
• History and credits

1. Download a Windows 11 ISO from microsoft.com/software-download/windows11.
2. Double-click LAUNCH_TINY11.bat and press 1 (graphical builder). It asks for administrator rights.
3. In Source, browse to the ISO and choose an edition, for example Windows 11 Pro. Its editions load automatically without mounting. For a typed path or existing drive, click Load editions.
4. Optionally adjust the other tabs, then click Build ISO. Time depends on source/options/storage/CPU; the measured maximum run took 21 minutes. See the performance report.
5. Write the ISO to a USB stick with Rufus (keep its default options) or attach it to a VM.

From an elevated PowerShell prompt, the same in one line:

.\tiny11maker.ps1 -ISO C:\iso\Win11_25H2_English_x64.iso -Edition Pro -Yes

The ISO is written next to the scripts as tiny11.iso (tiny11core.iso for Core), with tiny11.iso.json (what was built and how) and tiny11.iso.sha256. Logs go to logs\.

• Windows 10 or 11 (x64 or ARM64) and an administrator account.
• Windows PowerShell 5.1 (powershell.exe, built into Windows) or PowerShell 7 (pwsh.exe, including the Microsoft Store build). Under PowerShell 7 the in-box DISM module fails on mounted images ("Class not registered"), so the builder loads it through the Windows PowerShell compatibility session automatically; nothing to configure.
• About 25 GB free on an NTFS drive: 1.5 × the image size, at least 20 GB. The GUI shows the free space and warns before you start.
• oscdimg.exe is taken from the Windows ADK if installed. Otherwise it is downloaded before image work and retained in tools\oscdimg\2.56, from Microsoft's symbol server and verified against a pinned SHA-256.

tiny11gui.ps1 (option 1 of LAUNCH_TINY11.bat) exposes the common build choices. -WorkDirectory is currently CLI-only. Compression engine/effort/thread settings can be stored in profiles and forwarded, but do not have dedicated visible controls.

• It remembers your last settings in gui-settings.json (never the password).
• Save profile / Load profile stores a whole configuration, so you can rebuild it for every new Windows release in two clicks.
• Everything maps 1:1 to the command line; the Build tab shows the exact command.

The build runs as a hidden, non-interactive PowerShell process of the same edition as the GUI (powershell.exe or pwsh.exe). Its arguments go through a temporary file that is deleted immediately, so a password never appears on a command line.

A preset is a set of on/off flags (presets/*.json). The tweak matrix shows which registry groups each preset applies, and docs/APPS.md shows which apps depend on the preset.

To make your own preset, change the checkboxes in the GUI and click Save as preset, or copy a JSON file. Then use it with -Preset .\my-preset.json. Missing flags inherit from Default.

Both builders share the main options. -LowRam, -DisableDriverUpdates and -Custom are Standard-only CLI parameters; Core does not accept them. Core asks about .NET 3.5 when run interactively. Run Get-Help .\tiny11maker.ps1 -Full for the built-in help.

# Check everything first, build nothing
.\tiny11maker.ps1 -ISO C:\iso\Win11.iso -Edition Pro -DryRun

# Gaming preset, keep Paint and Snipping Tool, install Firefox at first sign-in
.\tiny11maker.ps1 -ISO E -Edition Pro -Preset Gaming -Keep Paint,SnippingTool -Browser Firefox -Yes

# Unattended VM install that WIPES DISK 0, with a UK locale and a named account
.\tiny11maker.ps1 -ISO E -Edition Pro -ZeroTouch -User Alice -Password "S3cret!" `
    -Locale en-GB -TimeZone "GMT Standard Time" -ComputerName TINY11-VM -Yes

# Smallest possible image for throw-away VMs
.\tiny11Coremaker.ps1 -ISO E -Edition Pro -Yes

Source and output

maximum means solid LZMS compression; balanced means LZX. The old recovery and max spellings remain accepted for existing commands and saved profiles. DISM's API still requires those historical names internally. Maximum compression is applied once, at the end. The initial edition export reuses ordinary WIM compressed resources where possible; solid ESD sources are converted to a standard WIM for servicing. See performance measurements and dependency audit. The build bug investigation records reproduced failures, upstream size/Setup regressions, safeguards and the limits of current verification.

What is removed

What is added

Installation and first start (built into the ISO's answer file)

Build behaviour

In PowerShell, lists work as -Keep Paint,Camera; from cmd, write -Keep "Paint,Camera".

1. Normalizes/validates options and loads the servicing prerequisites. A real build prepares the ISO writer early, before long image work; a dry run skips its download.
2. Resolves the source, selects the actual edition and records source metadata. Source/work-tree overlap is rejected. Prefer a fresh isolated -WorkDirectory for manual runs; legacy root layout includes stale-state recovery and is not safe alongside another writer.
3. Tests a disposable offline hive before copying/mounting, copies setup media excluding the original install image, and exports only the chosen source edition. Ordinary WIM resources can be reused without re-encoding; solid ESD becomes a mountable WIM.
4. Mounts the image and performs planned app/capability/Edge/OneDrive changes and optional .NET/driver injection. Core also reduces component packages, WinRE and WinSxS.
5. Loads owned offline hives, applies the tweak catalog and removes offline telemetry tasks. SYSTEM template paths follow the image's Select\Default; denied DWORDs receive verified file-only repair after unload.
6. Stages generated/custom answer files and SetupComplete/FirstLogon hooks, applies normal component cleanup unless skipped, then commits/unmounts.
7. Exports the final selected compression format once and validates actual source edition/language/product metadata. Only missing source-derived fields may be restored via supported wimlib operations; conflicts fail.
8. Patches small Setup hive files without a boot mount where supported; driver/fallback servicing uses a separate boot mount. Writes the final answer file.
9. Refuses duplicate/intermediate installation images, masters the ISO with the prepared Oscdimg path, hashes it and writes JSON/SHA sidecars. Releases owned attachments and cleans safe work folders.

Failure and GUI Cancel attempt cleanup. If dismount fails or mount state is unknown, image files are retained. Check the actual state before any replacement; cleanup is not guaranteed, separate folders are not a global concurrency lock, and counted warnings need inspection. See PROJECT_GUIDE.md for the complete mechanism and BUILD_BUG_REPORT.md for unresolved failures.

• Setup creates your account and signs in once automatically, unless you chose to create the account in OOBE.
• Software: winget (App Installer) is always kept, e.g. winget install Mozilla.Firefox 7zip.7zip VideoLAN.VLC.
• Logs on the installed system: C:\Windows\Setup\Tiny11\setupcomplete.log and firstlogon.log.
• Undoing a tweak: every value is listed in docs/TWEAKS.md. Most are policies under HKLM\SOFTWARE\Policies; delete the value to restore the Windows default.
• Getting Edge back: delete HKLM\SOFTWARE\Policies\Microsoft\EdgeUpdate, then run winget install Microsoft.Edge.

After editing the catalog, the presets or the answer-file generator, run .\scripts\update-generated.ps1. It refreshes docs/TWEAKS.md, docs/APPS.md, the reference answer files and the module manifests.

LAUNCH_TINY11.bat         Menu launcher (GUI / Standard / Core), elevates itself
Run.bat                   Runs tiny11maker.ps1 with your arguments
tiny11gui.ps1             Graphical builder (every option, live build log)
tiny11maker.ps1           Standard (serviceable) builder
tiny11Coremaker.ps1       Core (minimal, non-serviceable) builder
tiny11LegacyProfile.ps1   Compatibility shim for the old low-RAM profile
removePackage.txt         Apps removed by default
autounattend*.xml         Reference answer files (generated)
data/tweaks.psd1          Registry tweak catalog, the single source of truth
presets/*.json            Build presets
lib/tiny11utils.psm1      Build library: DISM/registry helpers, catalog engine, answer-file
                          generator, removal planning, shared build stages, ISO creation
lib/tiny11gui.psm1        Windows Forms window, state -> builder arguments, build runner
lib/tiny11media.psm1      Read-only bundled optical/WIM metadata reader
lib/OfflineRegistry.cs   File-only protected image-hive DWORD repair
data/reference-repos.json Exact reference URLs and branches
payload/                  Your post-install scripts (-Payload)
Browsers/                 Browser installers run at the first sign-in (-Browser)
docs/                     Handoff/architecture/verification and detailed reports; generated catalogs
docs/verification/        Compact dated measurement/audit evidence
scripts/                  Tests, parse check, linter, generators, test fixtures
repos/                    Reference forks (git-ignored, for study only)

.\scripts\parse-check.ps1         # every file parses, every command resolves
.\scripts\test-core-helpers.ps1   # ~1,900 checks, no admin rights and no ISO needed
.\scripts\test-media-progress.ps1 # real ISO metadata/progress fixtures
.\scripts\test-export-pipeline.ps1 # real small WIM/ESD fixtures
.\scripts\update-generated.ps1    # docs, reference answer files, manifests (-Check fails if stale)
.\scripts\linter.ps1              # PSScriptAnalyzer, high-signal rules
.\scripts\update-screenshots.ps1  # re-render docs\gui-*.png (window-only rendering)

The tests cover:

• every catalog entry and the presets;
• the generated and reference answer files, checked against an allow-list of real unattend settings (one unknown element makes Windows Setup abort);
• app, capability and package removal planning;
• the build stages, run against mocked DISM and registry functions;
• the GUI logic, the build launcher, and the whole window driven end to end with a fake builder that never touches the system.

CI checks both Windows PowerShell 5.1 and PowerShell 7. A real ISO build needs admin rights and a Windows ISO: test those changes in a VM (dry run first) and mention the build you used in the pull request. See CONTRIBUTING.md and CHANGELOG.md.

main holds the complete history of ntdevlabs/tiny11builder (100 commits), followed by the 2026 edition as regular commits, so every change can be traced back to the original with git log / git blame.

Ideas and fixes were studied in these projects and selectively adapted (code is downloaded under repos/). The tracked reference list, refresh script and comparison report record all 21 checkouts, exact branches and revisions:

MIT, see LICENSE. Windows is a trademark of Microsoft. This project ships no Microsoft files; you supply your own ISO.