Windows 10 Ameliorated

Windows 10 minus the spyware plus added stability and security.
A pragmatic set of modifications to Windows.

ISO File 5.13 GiB [ Build Info ]
Community vetted builds for your convenience

Build-time 2-3 hours [ Read First ]
For those who want full control and customization

What Is This Project?

Windows 10 AME aims at delivering a stable, non-intrusive yet fully functional build of Windows 10 to anyone, who requires the Windows operating system natively. Spyware systems, which are abundant in Windows 10 by default, have not been disabled using group policy, registry entries or various other workarounds – they have been entirely removed and deleted from the system, on an executable-level. This includes Windows Update, and any related services intended to re-patch the system via what is essentially a universal backdoor. Core applications, such as the included Edge web-browser, Windows Media Player, Cortana, as well as any appx applications, have also been successfully eliminated. The total size of removed files is about 2 GB.

Great effort has been invested in maintaining the subsequent system’s stability, bug-free operation and user experience, as many of these removed services conflict with core Windows 10 features.

Legal Notice
By downloading any of these images, you agree to Microsoft’s Terms of Service with respect to (5.) Authorized Software and Activation. All Images have been rudimentarily activated using a Generic Key for Windows 10 Pro N RTM. By using any of these images you agree that you have obtained a genuine product key or are able to activate by an other authorized method.
For more information, please click here.

This build is based on Windows 10 20H2

• Major deletion of hundreds of executable scattered throughout the system, which gather telemetry data, including the complete removal of Windows Update (universal backdoor)
• Extensive group policy and registry modifications to further remove telemetry operations, and modify certain system behaviors to be more sensible
• For good measure a massive fail-safe culmination of the various IPs and domains has been added to the hosts file, to further ensure no Windows telemetry leaves the system
• Removed all apps (apx) including Cortana, Windows Store, Edge, Mail, Xbox etc.
• Installed sensible open-source application replacements via the chocolatey package manager: Classic-Shell, Firefox, Thunderbird, OnlyOffice, VLC
• dotNET 3.5 is installed
• all VC redists are installed
• Hardentools from SecurityWithoutBorders has been installed
• The default user has been removed from the Administrator group

Major effort has been invested in ensuring that, although Windows is heavily modified, the experience feels as vanilla as possible minus the missing features, and not like some hacked together fan release. The following UI changes could be highlighted:

• Sensible Classic-Shell theme selection and configuration to more match Windows 10
• Modification of the task bar icons
• Removal of the Notification Action Center from the UI (as it has been deleted from the system)
• Removal of all unnecessary and privacy infringing sections from the Windows 10 Settings App UI
• Windows explorer has been modified with oldnewexplorer to remove the confusing ribbon
• Default applications are pre-configured (see above)
• You get our malte wallpaper, deal with it

Please read and follow all instructions carefully. While we are open to answering questions in the group chat, please consider the following before continuing:

• You should have basic technical competency with some experience in similar endeavors
• You shouldn’t be afraid of using the command line
• You should be moderately versed in Linux
• Bring lot’s of patience

Windows 10 AME Documentation

Version 2004 Dated 2020-10-31

The goal of the AME project is to provide a stable and non-intrusive build of Windows 10, without sacrificing usability and Win32 compatibility for the majority of mainstream applications. This includes the avoidance and riddance of privacy infringing automated data collection services, central to Microsoft’s strategy for the Windows 10 operating system.

This page provides a complete step-by-step description of how AME images are mastered based on Windows 10 build 2004 with minor proceeding updates, defining a complete documentation of this project.

While large portions of this process have been automated using various scripts and Linux command line utilities, a large majority requires manual effort, with many of the steps often producing differing and sometimes non-predictable results from instance to instance, increasing the difficulty of this procedure. As such, sections where abnormal behavior may occur have been appropriately highlighted.

It is also recommended that anyone attempting to reproduce the steps in this guide be moderately versed with Linux and consequently also not afraid of using the command line.

Installation of Windows 10 2004

Firstly, you will need to grab a clean ISO of Windows 10 build 2004. This can be done from Microsoft’s website directly, via the use of third party tools, such as rg-adguard the Microsoft Windows and Office ISO Download Tool.

During installation, particularly the next few steps, it is necessary to disconnect your target machine from the Internet. Burn the image to a USB flash drive or attach it in your VM manager to boot the installation medium. A partition size of at least 32GB is required.

When asked to provide a product key, use your Windows 10 Pro key, or continue by clicking “I don’t have a product key”. If your hardware has already been activated with a legitimate key, or if you have acquired your own, please enter your key.

If you purchased your key from a third party and have not activated that key using a vanilla Windows 10 Installation, you may want to do so, as the key will be tied to your motherboard and unable to be used again. Third party sellers sometimes check for this so they can make more money by reselling the key if you did not use it within a short time from purchasing it.

Post Install Procedure — After the initial installation perform the following steps:

The installation and initial setup proceeds mostly normally, with the arguably placebo-trier toggles for privacy being disabled for good measure.

It is again vital to mention that no internet connection be established during the entire installation!

Video: Windows 10 Post Install

During the initial post-install setup, select your default language, skip any network setup (it will ask twice, click no on the second prompt), and add a user as a local account. This user will be the user which does not have administrator privileges. The username can be anything you want, but on AME releases the username is simply “user”.

Cleaning Up Basic UI Elements

Simplifying the UI and removing extraneous visual features is one of the critical aspects of the amelioration process (as well as ensuring that certain subsequently damaged and/or non-responsive features are pulled from the interface). The following tasks need to be undertaken before the amelioration and ameliorate scripts are executed. Given the various extraneous and difficult to describe UI elements to be navigated for these procedures, videos have also been added to help document these basic tasks.

Note that although these tasks may appear simple, they need to be undertaken before the amelioration or ameliorate scripts are executed.

Cleaning-up the Start Menu and Taskbar

Windows 10 ships with very confusing and misguided functionality and features implemented by default in the taskbar. These can and should be removed manually, aiding in simplifying the UI. Note that most of these features will be unavailable once the amelioration script is executed. The Start Menu tiles (application links) are being removed now, for this very reason. Attempting to remove them later may actually not work.

Video: Cleaning up the Start Menu and Taskbar

Remove all tiles from the Start Menu and all links except for Windows Explorer from the taskbar. Set the taskbar to never combine and set the system tray to show all icons.

Extracting and Installing Updates

Before further changing the operating system, we recommend installing Microsoft’s security updates. Both the Servicing Stack Update (SSU) and Cumulative Updates are required to properly install updates. The Cumulative Update includes all updates released since the initial release of 2004. This means that only the latest Cumulative Update is required to obtain updates included in prior Cumulative Updates. The correct SSU for the Cumulative Update package can be found in the “How to get this update” section of each Cumulative Update page. For a full list of update options, as well as updates proceeding this guide, follow the Microsoft link here. The latest AME release uses SSU KB4577266 in conjunction with Cumulative Update KB4579311.

Proceed at your own risk when installing updates outside of the scope of this guide, as amelioration features with respect to privacy may be jeopardized.

To install an update, use Microsoft’s Deployment Image Servicing and Management (DISM) tool.

Firstly, extract the desired .cab file from the .msu files:

The SSU will need to be installed prior to the Cumulative Update, but the DISM command structure is identical. Just point to the correct .cab file.

Copy the Windows10.0-KB4577266-x64.cab and Windows10.0-KB4579311_PSFX.cab files to the root of the C: drive, or a location of your choosing, and run the following commands from an elevated command prompt:

Reboot before installing the Cumulative Update

Continue by installing the Cumulative Update

Once the Cumulative Update has finished installing, it will prompt for a reboot. Reboot a second time after Windows boots up. The last step concerning updates is to clear the Windows Update cache:

Sometimes the progress bar hangs in the command prompt; it will update if you type on the keyboard. Use the arrow keys since that will not put text on the screen. Cleaning up the cache currently takes longer than installing updates.

Download Amelioration Scripts

The amelioration process requires you to run a of batch script in Windows to prepare and finalise the Windows environment before and after amelioration, and a bash script in Linux to remove the Windows components responsible for telemetry.

The Windows scripts can be run from any location whilst the bash script must be placed at the root of your windows installation ( C:\ ).

Windows 10 Amelioration Script Package

Download
BAT File 17 KiB
SHA256: D7F975052B5BF873ABF66BAD41856F9D748F34C4009AE6D4F4B90496EF185607 scripts-2004.2020.11.3.zip
Version 2004.2020.11.3

Run (Pre) Amelioration Script

At this stage we are ready to begin the amelioration process, which is structured into various phases due to the nature of Windows 10’s self-updating and healing capabilities. The amelioration script, the Windows-side component of the AME process, is responsible for disabling services, applying individual registry hacks, modifying various configuration files, and installing software. Consequently, this script has both options to be executed before and after the proceeding deletion process.

The script has been heavily commented to reasonably document each operation. Download the script:

Run the amelioration_2004.bat as Administrator

Once opened, run option 1 Pre-Amelioration from the main menu. This may take several minutes to complete, this will prompt for a reboot after completion.

The script will likely generate errors; this is fine, it is just unable to remove some of the built-in apps with PowerShell.

Run Ameliorate Script (Linux Required)

To assure that our changes are permanent, we need to remove Windows Update and its self-healing ability. This cannot be done within the running system because of Windows file permissions and repair operations. Another operating system, preferably a Linux distribution, is required for this step.

The Ameliorate script makes heavy use of filesystem fuzzing search operations to effectively find and remove all files classified under specific naming conventions by Microsoft and pipes these paths to delete commands. As noted above, modifying the Windows filesystem from Linux allows us the luxury of ignoring filesystem permissions and ensures that Windows cannot re-patch these files before we reboot. This process enables the complete deletion of all relevant binaries from the system. In addition to the removal process the script also generates a recovery script to restore all of the removed Windows files from backup.

The script is written in bash, and commented to reasonably document various deleted components.

Boot into Linux and mount your Windows drive.

Ensure ameliorate_2004.sh is in the root directory of your Windows drive, and execute it with root permissions:

The script will generate ten errors, two for OfficeHub and eight for MicrosoftEdge. This is due to permissions. This seems to be fine and neither of the programs can run. For unknown reasons, there are multiple copies of Windows files all over the folder structure of Windows 10. The ones that actually run Microsoft Edge are successfully removed.

Once the script has finished, boot back into Windows to continue.

Run (Post) Amelioration Script

Due to the deletion process, at this stage, Windows 10 lacks even basic software, such as a web browser or media player. This process installs the Chocolatey package manager and a selection of basic sensible software.

Once again, run the amelioration_2004.bat as Administrator and enable internet access.

Run option 2 Post-Amelioration from the main menu. This may take several minutes to complete and will prompt for a reboot after completion.

Run option 3: User Permissions , which will open the netplwiz GUI for configuring Windows user permissions:

After logging back in, change the password of the default user.

In an elevated command prompt, type the following:

Set Application Defaults

The application defaults for Windows 10 2004 can be set by using either the Windows Settings App, or by a more tedious, but more reliable manual process. The manual process was created due to the 1809 release of Windows 10 containing a feature regression which caused the Windows Settings App method for setting application defaults to be broken. The 2004 release of Windows 10 appears to have fixed this issue, but the manual guide is included as it is known to always set defaults successfully.

Setting the default browser, Music player and Video player are relatively simple one-off changes which need to be done using the Windows Settings App. Open the Windows Settings App, click Apps, then under “Web browser” select Firefox, do the same for “Music player” and “Video player” only this time selecting VLC.

For the rest of the defaults start by making empty files with the desired file type. You can use the bash script included ( create_empty_files.sh ) to generate the files. For example, for gif files; right click the generated file gif.gif , click Properties, click the Change button next to “Opens with:”, then navigate to the executable that you would like to handle that file type.

File types

.doc — ONLYOFFICE Desktop Editors
.docx — ONLYOFFICE Desktop Editors
.gif — JPEGView
.flac — VLC
.mkv — VLC
.pdf — ONLYOFFICE Desktop Editors/Firefox
.pps — ONLYOFFICE Desktop Editors
.ppsx — ONLYOFFICE Desktop Editors
.ppt — ONLYOFFICE Desktop Editors
.pptx — ONLYOFFICE Desktop Editors
.xls — ONLYOFFICE Desktop Editors
.xlsx — ONLYOFFICE Desktop Editors