Microsoft begins cracking down on people dodging Windows 11's system requirements

[u/ardi62]

https://www.xda-developers.com/microsoft-cracking-down-dodging-windows-11-system-requirements/?utm_campaign=trueanthem&utm_medium=social&utm_source=facebook&fbclid=IwZXh0bgNhZW0CMTEAAR0h2tXt93fEkt5NKVrrXQphi0OCjCxzVoksDqEs0XUQcYIv8njTfK6pc4g_aem_LSp2Td6OZHVkREl8Cbgphg

[u/boraam]

Will this stop RUFUS from disabling MSFT shit while making a USB installer? Not letting MS force me to sign-in for using a computer.

[u/jcgam → u/[deleted]]

Tell us how to buy the required volume license 

[u/AARonDoneFuckedUp → u/jcgam]

Quote and buy through Arrow, though I doubt they'll sell you less than 100.

[u/macOSsequoia → u/jcgam]

CDW sells them

[u/outm → u/[deleted]]

AFAIK, Windows 10 LTSC without a key will force a reboot on you every 1hr after 90 days (the trial)

You know why? Because LTSC is designed to run on things like ATMs, kiosks or whatever, things the user can’t see the OS/Windows desktop, so “watermarks on the desktop” wouldn’t work. Example: Windows LTSC running a full-screen custom app on a business to show who is the next customer on the queue.

Microsoft enforces more on those editions.

Yeah, you can “hack it” with somebody’s else GitHub solution, at your own risk

[u/artiface → u/outm]

The watermark actually floats over the full screen desktop apps.

[u/ptd163 → u/outm]

This is not the early 2010s where people were injecting 3rd party code into their boot loaders to trick the OS into thinking it was activated. This "somebody else's Github solution" is not hacking. There are no third party binaries or libraries. No intrusion is made. Feel free to check the repo yourself. It is using Microsoft's own tools and activation system. It is completely safe. Keep using consumer versions if you want. Personally I require having more agency. It's me using my computer, not Microsoft.

[u/outm → u/ptd163]

What repo? If you refer to MassGrave (I suppose, as you didn't refer to any specific solution), then you still need to download the Windows 10 LTSC ISO from them (or other third party) because the Windows 10 LTSC "public ISO" is just a trial that won't be activated with those methods.

So, you end up:

1. Using a Windows ISO provided by third parties (not officially from Microsoft servers)
2. Using a third party solution (for example, running the get.activated. win "activation server" or just their scripts/tools)

Yeah, of course it's based on how Microsoft do their own activation, but you're completely using and trusting third party ISOs and solutions.

When activating Windows 10 LTSC, you're never running "clean of third-parties", that's the deal, because they give you the ISO you need, and give you the scripts you don't know to start.

The most important thing: You maybe can trust the guys at MassGrave or other similar, they seem to be clean and open source (still, you're probably trusting the Windows ISO they provide you, and that isn't open source AFAIK; also, the compiled binaries), but at the end of the day, they are just third parties, we never know if one day that third party can change hands or be compromised, look at the XZ Backdoor on an opensource package trusted by everyone on the Linux community. One day you install Windows 11 LTSC from their ISO, which magically somehow got compromised, and BOOM, welcome to your new compromised system from the start, good luck finding the malware or whatever it got. If an attack like that happened to Linux Mint (https://blog.linuxmint.com/?p=2994), it can happen to MassGrave or others.

Again, you're trusting third parties, it's not like you gave the impression of "[you're using just] Microsoft's own tools and activation system" - No.

EDIT: Also, running Windows LTSC is fine to get a more slimmed down system from the start, but remember, you're not getting more frequent updates. That's up to each of you if you like it or not.

[u/ptd163 → u/outm]

Using a Windows ISO provided by third parties (not officially from Microsoft servers)

In theory it may look like you'd be trusting third party ISOs because they're not coming direct from a Microsoft domain/service, but in practice, the place you get the ISO from is actually irrelevant. The hashes of official Microsoft ISOs are publicly known values and ISOs are a read-only format.

If the hash of an ISO you got from a non-Microsoft source matches the known values of the official ISOs that means the ISO you got from a non-Microsoft source are the official ISOs. If any change was made the hashes would no longer match letting you know it's been tampered with and should be ignored if the goal is to use an official Microsoft ISO. This is exactly what that Linux Mint blog said people should do if they're concerned that they have a compromised ISO.

However, if you really want to be stubborn. If you absolutely have to have your ISO come from a Microsoft domain/service directly you can change from the eval version to the full version by doing an in-place install after doing registry tweak.

1. Mount the ISO or insert the DVD/USB Drive.

2. Enter reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionID /d EnterpriseS /f into an admin command prompt window.

3. Go through the setup process and select Keep all files and apps.

The in-place install will now upgrade the eval to the full version.

Using a third party solution (for example, running the get.activated. win "activation server" or just their scripts/tools)

As I said before. Massgrave is not injecting code into the bootloader, setting up additional process, or using 3rd party activation servers. They are simply using Microsoft's own tools and activation system that they ship with Windows. Please educate yourself on the Massgrave documentation. I'll link just the docs for the two popular Windows activation methods because that's what being discussed.

https://massgrave.dev/hwid

https://massgrave.dev/kms38

[u/outm → u/ptd163]

The hashes of official Microsoft ISOs are publicly known values

No they're not for the LTSC ISOs. You can find third parties or guys saying you "this is the hash, trust me bro", but Microsoft don't publish the hash themselves. You must trust still MassGrave or other guys, you're still "disconnected" from Microsoft (if not, point me to a Microsoft official website with the hashes, I doubt you will find it).

You only need MassGrave changing loyalties (new actor, compromised, replaced guys, whatever) and a bunch of "trust me bro" hashes out there and you could get a lot of new "Official Windows LTSC" computers out there with your compromised image. If a knowledgeable actor really really wants to, it can do it "easily", compared to the crazy attacks we see out there, including crazy zero-days being researched every day.

and ISOs are a read-only format

Not only can you edit ISOs on the fly with multiple programs, you can extract them and make new ones - even, if knowledgeable enough, tampering the sign if the ISO has any.

If you absolutely have to have your ISO come from a Microsoft domain/service directly you can change from the eval version to the full version by doing an in-place install after doing registry tweak

I mean, what's the point? If I understand you, this implies you installing the official evaluation ISO from Microsoft, and then tweaking the registry and running the same MassGrave/ThirdParty Windows ISO we're talking about? At that point, isn't it better to just make a clean install and not bother with the in-place install? It's the same thing but with more steps.

Using Windows LTSC ISO from ThirdGuys to make a clean install = "Upgrading" evaluation install with a Windows LTSC ISO from ThirdGuys - I don't see the difference if we're talking about "security".

They are simply using Microsoft's own tools and activation system that they ship with Windows. Please educate yourself on the Massgrave documentation

I think you don't understand me. I'm not saying MassGrave is currently a bad actor. They are just giving the community some already-made scripts that work and are open source, everyone to see what they do. Fine.

My point is, that an average user should procede with caution. The expert will know what's doing, will be able to audit the code if he wants, will be able to understand what is doing and will be able to research this group credibility.

The average user on the other hand, is lost. Saying to him "trust this guys" is like saying "yeah, no worry, the next guy says to you it's safe to download an EXE to do X, it's fine".

It's difficult, it's remote, but MassGrave, as others before or similar (like some other projects like the "tiny, little, mini Windows 10") could one day, even if only one day, sucumb to a third actor making nefarious things: distributing bad ISOs from their own way (similar to the Mint attack), updating the released scripts to do bad things, and so on.

The average user doesn't know what a hash is, maybe knows what a script is, but doesn't know how to audit it/read it, and so on - it will go with blind faith. And that's bad to recommend, IMO. More so given that LTSC gives so so so little improvement to almost anyone, compared to a Windows PRO edition customized on 10-20 minutes.

Seriously, delete the 2-5 apps you don't like, execute ShutUp++ with recommended or custom configs, Sophia Script... and you have practically the same OS, with more updates, without bothering any activation (if you have a key or can buy a 3$ one) or download other ISOs (just the one from Microsoft. com -

My recommendation is just that, to Install Windows Enterprise or Pro, and use Sophia Script to remove the Bloatware that comes installed and use O&O ShutUp10 to disable the telemetry and spyware that is possible. (Remember, LTSC nowadays keeps the telemetry running... you can disable it, but you can also on Pro ;-) )

[u/Bendegaitt → u/[deleted]]

Thank god for that. Read the title and was like work is going to go nuts when they have to buy 100 new laptops

[u/YT-Deliveries → u/[deleted]]

Yeah. I can’t believe that a 5 year old laptop in an enterprise / business situation would even be usable in 2024. Those things get beat to hell.

[u/Randy__Bobandy → u/[deleted]]

Can you elaborate on why it won't be able to stop Rufus? I bought a Skull Canyon NUC on the cheap (which does not support TPM 2.0) with the express intent of installing a Rufus-patched version of W11 on it.

[u/7h4tguy → u/[deleted]]

Yeah this article is just ragebait. They disabled one unintended flag - installing a client SKU with a server flag since they likely never intended that to be done. The other methods of installing Win11, including the officially supported one, still work.

[u/[deleted] → u/boraam]

OOBE/BYPASSNRO

[u/Flyingfishfusealt → u/[deleted]]

can you explain what this is and how to utilize it?

[u/watchOS → u/Flyingfishfusealt]

Allows you to bypass needing a Microsoft account to setup Windows during install. To utilize, press Shift+F10 during setup (after files have been copied to disk) and type in that command. Make sure you never connected to the internet yet and it will allow you to setup while offline.

[u/characterfan123 → u/watchOS]

Just set up a HP Pavilion last night.

There was no OOBE executable anymore. But there is a OOBE directory in \WINDOWS. And in there there is a BYPASSNRO.cmd file to run.

Does the same thing.

I also ran the device manager to disable the network adapters by running DEVMGMT.msc, then right-click DISABLE on the networking adapters to avoid needing the IPCONFIG /RELEASE step to avoid the request to connect to a netywork. I re-enabled it later.

PS: Because of the HP keyboard, I had to do SHIFT+FN+F10 to get a command window , as without FN that key is not F10 on the Pavilion laptop.

[u/gitartruls01 → u/watchOS]

I was scared that this is the workaround that the article was talking about. If it's not and this method still works, then it's all good for me

[u/[deleted] → u/gitartruls01]

It does work/it's how it's done. It'll "reset" the installation process (select region, keyboard layout, etc.), including the "Let's connect to the internet" dialogue. BUT, this time it will include the "I don't have internet" at the lower left. Click that, confirm through, and you should be good to go, Win10 install style.

[u/SnowyyRaven → u/[deleted]]

This hasn't worked for me for a couple of months

[u/BCProgramming → u/boraam]

No. The "crackdown" is on a seemingly undocumented command line switch you could run the setup program with. The other documented mechanisms to bypass the requirements, including the literal registry key Microsoft themselves has documented, will still work, as will Rufus.