Windows 11 - first impressions?

[MrMobodies]

I happened to launch Edge on a Windows 10 machine the other day, because I wanted a fresh clean browser with no history, and oh boy, was it annoying! I dropped it like a hot potato and will never launch it again.

I have not actually tried it myself since the early days of Win10 when I was forced to use it at work, I've only casually followed and knew it was now more or less a reskin of Chrome. I almost don't know why they even bother, it's so clear Microsoft lost the most recent browser war. The percentage of Win10 users using Edge is/was in the single digits, despite the fact that it was the default and they went out of their way to make it difficult to switch.

I remembered at a firm, when I disabled the updates in about 2013 due to them breaking stuff where I had to restore it back from a disk image frequently  and it also happened one of the Surface RT tablets and it broke the touchpad and other stuff and after a factory reset. In a warehouse, 4 machines with Nvidia graphics card drivers mistakenly targeted for a GPU no longer supported caused them to go into bluescreen. I set it ignore the driver as it came in from the Windows update but they igot nstalled again. So I thought I'd manually update stuff from now on.

In 2015 I was hearing about Microsoft abusing this Windows update by loading Windows 10 on it. Then I had many customers with laptops around my house unable to boot and found the last activity on quite a few was a folder called "Panther" and a partial installation of the new operating system. I found by renaming the windows 7 folder back to "Windows" sometimes worked again so it looked like for those the work was not done on the bootloader for Windows 10 to properly start.

After two years of tweaking stuff I managed to get a  Windows 10 Enterprise 2019 LTSC copy pretty much to the way I want but still some work to do on it.

When I want another copy all I do is just copy that one over.

I was thinking that with the "app store" and the constant updating and changing of everything in there in the background (in the Home and Pro editions) why not just call them "WINDOWS LIVE" instead.

[james_s]

When they started abusing Windows Update to push Win10 out that's when I decided I'd had enough and disabled it completely, never looked back. They instantly threw away all of the trust they had built up over a decade or so for Windows Update.

[PKTKS]

. If they want to recommend a TPM that's fine, but there is no good reason to require it.

There is absolute none

This a tracking device at least..
A back door probably

Paul

[ataradov]

This a tracking device at least..
A back door probably

While there are not too many benefits from TPM, especially for home users, it is not a tracking device or a backdoor. There is no need to spread this nonsense.

[PKTKS]

This a tracking device at least..
A back door probably

While there are not too many benefits from TPM, especially for home users, it is not a tracking device or a backdoor. There is no need to spread this nonsense.

Well...   it is not a secret that BLACK BOXES are not to be considered secure..

The other way around .. I deal with MS "folks" long enough to assume
if they made another black box and made that mandatory...

it should be a tracking device and probably allows "indemnification" 
(using their own terms) probably pushed by underneath business they do not disclosure

I ditched all this non sense by 90s and got really rid of them by early 2000s

Nevertheless things do not seem to change.

This whole post is a laugh.. a shit show..

Very very easy to just tell them to fuck off...

Paul

[SiliconWizard]

A TPM can't act as any kind of backdoor in itself indeed.
Note that MS has actually been requiring TPM 2.0 since 2016 (so, for Win 10) for all OEM installations. So the requirement is not quite new - they were just not requiring it for upgrades and non-OEM installs.
https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-tpm

Another thought is that if not required by the mere will of MS or another particular vendor, chances are that TPMs (and other forms of improved security measures) are not unlikely to become mandatory from regulations one of these days. I wouldn't be hugely surprised for instance if the EU didn't make it mandatory to include TPMs in any sold computer within a few years. (And if this is already in the pipe, please forgive my ignorance but recognize my foresight )

Now is that a good thing? I have mixed feelings about it.

[PKTKS]

Don't miss by any chance the real requirement: UEFI integration

MS has done the shit hell to make difficult (really ..) to boot anything..
apart their own stuff. The landlord model won't last if so.

UEFI can boot anything using HTTP !!! as long as induced to do so.
TPM was just a shallow piece of the schema.

By trust or identify and manage the most critical piece of PCs.
(aka UEFI is like flashing an MCU for a CPU...) you can literally do anything.

No surprises. They have really messed the PC hardware  trying to hold
users (OWNERS) hostage of their business..

If they do not own the hardware control...
they can not push the licensee schema ..
DRM schema...

and dictate what the owner can and can not do with the hardware.

The other fruit ... made a choice to own the hardware and lock out even repair-mans...
and people still pay for these shits...

It seems to me that is being a question of time until they lock the PC hardware again..
for good with these UEFI+TPM   identification and "TRUSTY"  schema

Paul

[SiliconWizard]

and dictate what the owner can and can not do with the hardware.

Yeah, that's part of my mixed feelings about it all. While I'm all for good security, all the other implications, such as the ones you mentioned, are horrible.

And as I mentioned, at least I sincerely hope this will strictly remain vendor requirements (even if this already can be a pain and metastasize to other vendors or even become a de facto standard quickly (see indeend the UEFI thing...) But the second it becomes a requirement by LAW - this is something else, and I hope this never happens. But seeing how things are going, I wouldn't hold my breath.

[ptluis]

you're all forgetting iOS and Android that monitors your actions up to the bones, you're all loosing your brains 

[Ed.Kloonk]

you're all forgetting iOS and Android that monitors your actions up to the bones, you're all loosing your brains 

That doesn't mean it's alright for the PC do it.

[MrMobodies]

No surprises. They have really messed the PC hardware  trying to hold
users (OWNERS) hostage of their business..

and dictate what the owner can and can not do with the hardware.

Reminds me of a service called SBSCORE that I found in a 2003 Small Business Server edition...

As I remember once this service is running it will;
If you don't want to install the active directory/domain controller from the next cd, it will eventually shut down.
If there is a broadcast message or something from another machine indicating that is it running a domain controller on the same network it will report it to the logs about violating the license agreement and shut down.

Removing the SBSCORE service stops that but at first I had problems trying to shut it down and get rid of it. It basically held them to ransom. Close SBSCORE.exe and it will shut down and they set the permissions to prevent it being removed and also once it started. So I tooK the drive out, connect it to a sata controller, remove sbscore.exe and the other associated files in the same name and the service, removed them from registry, put it drive back in and it was perfectly fine after that. All we were using it for was a backup file server.

A simple warning in the logs to indicate a license violation but shutting it down like that...

I class that as malware/rootkit like behaviour.

[bson]

Presumably all W11 system components are attestable, meaning they need to match a certain hash to execute.  Replacing that hash in turn requires the cooperation of an installer, which is also an attestable component.  And so on - this creates a chain of trust, all the way back to the secure boot.  Having this in turn permits for example a game vendor of an online game to prevent cheating by tampering with executables or inserting cheats.  It can prevent everything form circumventing licensing to prevent malware from executing automatically.  MS might do like Apple and refuse to permit bypassing the chain of trust for kernel components like drivers and certain executables - which is about the only downside to the scheme.  (In tech speak, Apple kernel components have to be notarized with a developer certificate.)  For something like a game or other software you'll likely be able to bypass it, but if you do you may not be able to use it for online play for example as you might have a cheat installed.

[ptluis]

you're all forgetting iOS and Android that monitors your actions up to the bones, you're all loosing your brains 

That doesn't mean it's alright for the PC do it.

Anything that is created to control us is bad. And when it's free, there's always something hidden. When Microsoft kindly offered Windows 7, 8 users the free upgrade to the new version 10, they actually offered us a Trojan horse. If I develop software, I don't want any crap spy software controlling my work or my life. The solution is not to upgrade and if you really need version 10 or 11, create a dual boot system or use a VM machine. or better yet, a second PC. Win 10, 11 and all future versions are rubbish if they continue to follow this strategy

[coromonadalix]

The way Msoft had us is by setting up windows 10  "as a service",   now  where stuck with telemetry and publicity / tracking  etc .... 

I'm using a few softwares to kill most of them, but thats not enough, i'm on Entreprise and we had the possibility to completly kill telemetry, i have to check if thru win10 updates, Msoft has played new tricks again


Same for Win11, in no way i find this OS productive, it's more restrictive than ever for the menus / contexts  etc ...  you have to battle the ''OS'' to choose a web browser, what a joke.


"They" know that and will set/get things harder for us to choose how we want this OS to work and act the WAY I WANT, no their way

Running it on a i5-8500 for tests purposes  (sure it has no tpm for now) but not impressed at all 

[ptluis]

The way Msoft had us is by setting up windows 10  "as a service",   now  where stuck with telemetry and publicity / tracking  etc .... 

I'm using a few softwares to kill most of them, but thats not enough, i'm on Entreprise and we had the possibility to completly kill telemetry, i have to check if thru win10 updates, Msoft has played new tricks again


Same for Win11, in no way i find this OS productive, it's more restrictive than ever for the menus / contexts  etc ...  you have to battle the ''OS'' to choose a web browser, what a joke.


"They" know that and will set/get things harder for us to choose how we want this OS to work and act the WAY I WANT, no their way

Running it on a i5-8500 for tests purposes  (sure it has no tpm for now) but not impressed at all

My friends for those who don't want to "clean" every feature manually there's a tool similar to the old "XP Antispy" that's called "ShutUp10++".
Read it carefully, create a windows restore point then make a backup of your current settings, using shutup10, before doing any changes. You'll see the amount of trash that comes with the OS. Regarding Automatic Updates even if you completely disable this feature, it's not 100% disabled and MS find a way of activating again. It happened more than once with the LTSC version on the company. But anyway we get rid off most of the junk that stutters our computers and net connections. There are other ways of blocking autoupdate feature like creating a localhost loop for example.

ShutUp10++
https://www.oo-software.com/en/shutup10

[SiliconWizard]

The way Msoft had us is by setting up windows 10  "as a service",   now  where stuck with telemetry and publicity / tracking  etc .... 

Yep. But it's a general trend in the software world. Not just MS. And unfortunately, while a few people like us would gladly pay (as long as it's not unreasonable) for software that we actually "own" and won't spy on us, I guess most people these days don't want to pay for software anymore. So this is a tough industry.

[BrianHG]

 

[SiliconWizard]

The better multi-monitor support is just hilarious. Windows had perfectly fine multi-support monitor until they totally screwed it up in Win 8 and 10. Then getting back to something a bit better is sure a tremendous achievement!

[MrMobodies]

Regarding Automatic Updates even if you completely disable this feature, it's not 100% disabled and MS find a way of activating again. It happened more than once with the LTSC version on the company. But anyway we get rid off most of the junk that stutters our computers and net connections. There are other ways of blocking autoupdate feature like creating a localhost loop for example. ShutUp10++
https://www.oo-software.com/en/shutup10

There is NO WAY I am willing to put up with that behaviour.

I have found their ways of how they get it turned back on. I managed to sort a Pro edition by disabling and stripping a lot of things out of it in 2019 with a lot of anger and frustration to a point where I started to see stars in my eyes:
https://www.eevblog.com/forum/general-computing/windows-10-update-aggro/

I would take the disk in and out, do a backup, disable a group services I suspect maybe the culprit, put it back to find out if the Windows updater would turn back on secretly, and find what doesn't work as a result.

Sorted out a 2016 LTSB but I found that the LTSC 2019 was a lot of work.

Three services re-enables the "Windows update" service.

Waasmedic.exe (can be removed) 
Uscore USOSVC (that runs within the new netframe pcsettings thing but not practical to remove that. When going into pc settings and update it would just quit.
Rempl  (can be removed)
Just remembered another one:
OSRSS (can be removed)

To make it easier to obtain permissions:
https://www.tenforums.com/attachments/tutorials/314256d1610376708-add-take-ownership-context-menu-windows-10-a-add_take_ownership_to_context_menu.reg

When Usosvc runs, it would use the "SYSTEM" account to reset permissions into C:\Windows\System32\Tasks\Microsoft\Windows\updateorchestrator which is set to deny write permissions to user accounts and it's registry equvialent (using "Trusted Installer")

I took the disk out and connected up to another one running Windows 7:
I found the copy of Windows 10 Pro was on a GPT partition and I had to convert it to a basic disk to be able to do anything and then convert it back afterwards I was finished. They say you can't but I happened to do so, just don't clean disk. (Can't remember all the details.)

Mount the system registry and find USOSVC to set
Find USOCORE, USOSVC in registry settng and set  type to 10 (to give 16) and set type to 4 to disable for now so it can't reset the permissions.

I removed rempl, Waas medic,osrss, services in registry system/currentcontrolset/services (present on LTSC), that turns on the Windows update.


That will then allow you to set startup type, I think I also set system deny permission to write to that key.

In: C:\Windows\System32\Tasks\Microsoft\Windows\updateorchestrator, take ownership open notepad or text editor, copy the names down, save it to the drive and delete everything in the folder.
Go into the registry and search for \Microsoft\Windows\UpdateOrchestrator\
remove everything in there but don't delete the key.

Then search for the components on that list like this one:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\Microsoft\Windows\UpdateOrchestrator

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A20E027D-A9EE-4CFF-B07B-98990E3C4602}
\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_ReadyToReboot


Remove everything in there and note the names down.

Now put back the drive, find the keys again in registry, go into permissions, set deny to "Trusted Installer" and read only for system.
Set read only permissions for "SYSTEM" account "C:\Windows\System32\Tasks\Microsoft\Windows\updateorchestrator"

I didn't have to do any of that in an LTSB version.

Now when starting USOSVC it shouldn't be able to rewrite it's entries and default everything.

See screenshot of one I got perfect and behaves which is my template copy.
When I want another copy I just copy that and buy a key to save a lot of work and aggravation.

Thats not the only thing, there are other stuff I removed like some telemetry components that don't seem to respect group policies, certain notifications and annoyances.

[blacksheeplogic]

Enabling metered connection I have found resolves any further requested updates/reboots. It's held up over time, nothing else I tried worked after allowing a update though.

Regarding Automatic Updates even if you completely disable this feature, it's not 100% disabled and MS find a way of activating again. It happened more than once with the LTSC version on the company. But anyway we get rid off most of the junk that stutters our computers and net connections. There are other ways of blocking autoupdate feature like creating a localhost loop for example. ShutUp10++
https://www.oo-software.com/en/shutup10

There is NO WAY I am willing to put up with that behaviour.

I have found their ways of how they get it turned back on. I managed to sort a Pro edition by disabling and stripping a lot of things out of it in 2019 with a lot of anger and frustration to a point where I started to see stars in my eyes:
https://www.eevblog.com/forum/general-computing/windows-10-update-aggro/

[blacksheeplogic]

Presumably all W11 system components are attestable, meaning they need to match a certain hash to execute.  Replacing that hash in turn requires the cooperation of an installer, which is also an attestable component.  And so on - this creates a chain of trust, all the way back to the secure boot.  Having this in turn permits for example a game vendor of an online game to prevent cheating by tampering with executables or inserting cheats.  It can prevent everything form circumventing licensing to prevent malware from executing automatically.  MS might do like Apple and refuse to permit bypassing the chain of trust for kernel components like drivers and certain executables - which is about the only downside to the scheme.  (In tech speak, Apple kernel components have to be notarized with a developer certificate.)  For something like a game or other software you'll likely be able to bypass it, but if you do you may not be able to use it for online play for example as you might have a cheat installed.

There is some goodness. But for the average home user or small business I don't see the benefit and it means a convoluted and being subject to extortion/terms. You can't be just a independent developer these days without giving away a cut and agreeing to one sided terms.  I do develop on Windows still but I'm being paid to do it. My own development is all ARM/Linux.

[james_s]

There is NO WAY I am willing to put up with that behaviour.

I have found their ways of how they get it turned back on. I managed to sort a Pro edition by disabling and stripping a lot of things out of it in 2019 with a lot of anger and frustration to a point where I started to see stars in my eyes:
https://www.eevblog.com/forum/general-computing/windows-10-update-aggro/

The fact that you even have to contemplate jumping through such hoops is completely ridiculous. There is really no reasonable excuse for not having a "Yes I really know what I'm doing now leave me alone and don't ever *#&@ing update!" setting.

[PKTKS]

That REGISTRY  shit gives me nauseas...

Paul

[MrMobodies]

That REGISTRY  shit gives me nauseas...

Paul

Well all I do is take the drive out, plug it into another one, do a disk image using Marcrium Reflect and copy it to another drive to make sure that there is nothing wrong with the disk image. I would unplug the network card or wifi just incase it causes Windows reactivation.

Unhide hidden and operating systems files which I have set by fetault.
Then I copy c:\windows\system32\config to say an external storage drive say d:\<name of machine>\reg\<date>
and also the profiles too c:\users\<username> d:\<name of machine>\profiles\<date> but have to unselect the junction points if doing it manually but there are switches in robocopy for that if you want backup using a script.

That is just incase I bugger something up or I don't get the result I want out of mass experimenting.

[Wuerstchenhund]

As to the other PCs I installed Windows 11 on, these are all officially unsupported systems

Out of curiosity, how did this work? Did the Windows installer just proceed without protest? Or did the hardware actually meet the Windows 11 pre-requisites, even if not documented as such?

I simply did a fresh install, no hacks no tricks. There were no checks if the hardware is "supported", it just installed like Windows 10 and earlier versions did.

Admittedly, all computers do have a TPM in some form, some have a TPM 1.2, others a TPM 2.0. But that's pretty much it.

Some of the systems I installed from the pre-release beta, and so far all the updates installed fine (including the 21H2 Sun Valley update from a few days ago). And I don't expect any problems with upgrades to new releases as these will start from Windows 11 already, not Windows 10.