[PufPufPuf]

Exactly what is this trying to achieve? Running a third party tool to modify the OS, disabling security features, using "downloaded" group policies (what policies?), and sending all your DNS traffic to a third party (when on PC it's possible to just modify the etc/hosts file) -- these aren't exactly the best security practices. The only reasonable suggestion is the IoT Windows version.

[7bit]

Agreed with the "what does this achieve". In Corporate environments you would use SCCM or simply the Windows ADK plus WDS.

Installing a custom Firewall and Antivirus ist straight counteproductive, as ist disabling security features... obvisouly.

Downloading and installing group policies however is often required and a typical enterprise scenario.

Whenever I hear people praise these kind of things I know they don't really have any professional knowledge. It's fine to configure your own system, but suggesting these things SHOULD be done pisses me off to no end.

[atVelocet]

Seems i lack a lot of professional knowledge so please enlighten me on how you would do it.

Why use ADK or SCCM for a personal install?

The custom firewall is just a frontend for the builtin firewall.

GP reg keys are used by many third party tools to alter the system. So why use extra software if you can get this directly from the vendor?

And also a rant about anti virus: What do think is the first thing malware does? How does your system get infected if you are using an updated browser, open mails in it and use it for viewing attachments like PDF? Maybe there is even malware out there that does take advantage of high jacking the anti virus and its system priviliges? But who knows… it always depends on the user and the use case.

[atVelocet]

Make the system need way less ressouces and get way more raw compute power.

There‘s a reason i wrote a hint about the security. If you keep this in mind and know what you are doing (like take such a setup as a base for VMs) this totally fine.

I am also not aware of any Spectre/Meltdown exploits ever to be found in the wild. If you are not running on a shared system i don’t see a need for those mitigations.

Regarding the third party tool: NTlite uses `dism` under the hood with which you can achieve the same results. You are already sending your DNS to a third party (like your ISP).

You also should never ever alter the hosts file and abuse it for ad blocking and such.

Microsoft supplies the latest group policies for their software. Or how else do you handle those on a local system?

I never said my post was about security but on how to alter your local system in a „more correct“ way with a clear hint about security. If you don’t know what you are doing then you should think twice when touching your system.