# Nano11 Builder: Pushing Windows Minimization to the Absolute Extreme

**Author:** kelexine  
**Date:** 2025-12-13  
**Category:** Windows  
**Tags:** Windows 11, PowerShell, CI/CD, Automation, Debloating, GitHub Actions, Nano11, Minimal Windows  
**URL:** https://kelexine.is-a.dev/blog/nano11-builder-development

---

# Nano11 Builder: Pushing Windows Minimization to the Absolute Extreme

If Tiny11 is Windows on a diet, and Tiny11 Core is Windows with anorexia, then Nano11 is Windows having an existential crisis about whether it even needs to exist. Welcome to the most aggressive Windows 11 debloating project ever conceived - where we answered the question: "How much can we remove before Windows stops being Windows?"

## The Genesis: Why Nano11?

After successfully creating the Tiny11 and Tiny11 Core automated builders, I found myself staring at the Core build and thinking: "We can go deeper." The Core build was already removing WinSxS components and the Windows Recovery Environment, but there was so much more left untouched:

- **Printer drivers** sitting there, knowing full well this image would never see a printer
- **Fonts for languages** I'd never use (sorry, Chinese simplified and traditional)
- **Services** running for hardware that would never exist in a VM
- **Apps like Notepad and Paint** that I could replace with alternatives
- **.NET Native Images** pre-compiled for performance I didn't need

The question wasn't "should we remove these?" The question was "why haven't we already?"

## The Philosophy: Scorched Earth Optimization

The Nano11 project operates on a simple principle: **if it's not absolutely essential for Windows to boot and run basic applications, it goes**. This isn't a philosophy for daily drivers. This is for:

1. **VM Testing** - When you need Windows to verify something exists, not to actually use it
2. **Disposable Environments** - Spin up, test, throw away
3. **Extreme Resource Constraints** - When every megabyte counts
4. **The Curious** - Those who want to see how lean Windows can get

> ⚠️ **Fair Warning**: This is NOT a Windows you should use for anything important. It's like a car without seats, AC, or a radio. It technically drives, but you're going to have a bad time on a road trip.

## The Development Journey: Building the Nano11 Maker

### Phase 1: Analyzing the BASE Script

The journey began with `nano11builder-BASE.ps1` - an interactive script from the OG [NTDEVLABS](https://github.com/ntdevlabs/nano11), that already pushed beyond Tiny11 Core. Analyzing this script revealed several aggressive optimizations:

```powershell
# The BASE script already did things like:
- Remove Notepad, Paint, Photos, Camera (!) 
- Slim the DriverStore
- Reduce fonts to essentials
- Remove .NET Native Images
- Clean CJK input methods
- Remove services like Spooler and Fax
```

The interactive version was powerful but suffered from the same limitations as its predecessors: manual execution, user prompts, and no CI/CD capability.

### Phase 2: Creating the Headless Version

Converting `nano11builder-BASE.ps1` to `nano11builder-headless.ps1` was no small feat. The final script clocked in at **over 1,100 lines** of PowerShell, structured into modular functions for maintainability:

```powershell
#---------[ Core Functions ]---------#
function Test-Prerequisites { ... }
function Initialize-Directories { ... }
function Convert-ESDToWIM { ... }
function Mount-WindowsImageFile { ... }

#---------[ Nano11-Specific Removal Functions ]---------#
function Remove-BloatwareApps { ... }      # 40+ apps
function Remove-SystemPackages { ... }      # Extended list
function Remove-NativeImages { ... }        # .NET cleanup
function Slim-DriverStore { ... }           # Driver removal
function Reduce-Fonts { ... }               # Font reduction
function Clean-InputMethods { ... }         # CJK removal
function Remove-Services { ... }            # Service destruction

#---------[ Finalization Functions ]---------#
function Process-BootImage { ... }          # Boot.wim shrinking
function Convert-ToESD { ... }              # Maximum compression
function Clean-IsoRoot { ... }              # ISO cleanup
function Create-NanoISO { ... }             # Final ISO creation
```

### Phase 3: The Autounattend Revolution

One unique aspect of Nano11 is its use of `autounattend-nano.xml` - a significantly more complex unattended installation file compared to the simple one used by Tiny11. This file includes:

- **Embedded PowerShell scripts** that run during Windows installation phases
- **Automatic Administrator account creation** with auto-logon
- **OOBE bypasses** for a streamlined setup experience
- **First-logon scripts** for post-installation cleanup

The nano11 builder automatically renames `autounattend-nano.xml` to `autounattend.xml` when packaging the final ISO, ensuring seamless unattended installation.

### Phase 4: GitHub Actions Workflow

Creating `build-nano11.yml` followed the established patterns from Tiny11 and Tiny11 Core, but with Nano-specific customizations:

```yaml
name: Build and Release Nano11

on:
  workflow_dispatch:
    inputs:
      windows_version:
        description: 'Windows version (e.g., 24H2, 25H2)'
      windows_iso_url:
        description: 'Windows 11 ISO download URL'
      image_index:
        description: 'Windows image index (1=Home, 6=Pro)'
      ...

jobs:
  build-nano11:
    runs-on: windows-latest
    timeout-minutes: 500  # Longer than Core due to aggressive optimization
```

The workflow includes extensive warning banners because, let's face it, if someone accidentally deploys this to production, their IT department would have questions.

## What Gets Nuked: The Comprehensive Removal List

### Extended App Removal (40+ Apps)

Beyond what Tiny11 Core removes, Nano11 takes out:

| App | Why It Goes |
|-----|-------------|
| **Notepad** | Use VS Code or Notepad++ |
| **Paint** | Not critical for testing |
| **Photos** | File Explorer shows thumbnails |
| **Camera** | VMs don't have cameras |
| **Quick Assist** | Remote support not needed |
| **Secure Assessment Browser** | Educational feature |
| **People Experience Host** | Social integration |
| **Pinning Confirmation Dialog** | UI component |

### Extended System Packages

```powershell
# Packages removed beyond Core:
"Microsoft-Windows-MSPaint-FoD-Package~"
"Microsoft-Windows-SnippingTool-FoD-Package~"
"Microsoft-Windows-PowerShell-ISE-FOD-Package~"
"OpenSSH-Client-Package~"
"Microsoft-Windows-Hello-Face-Package~"
"Microsoft-Windows-Hello-BioEnrollment-Package~"
"Microsoft-Windows-BitLocker-DriveEncryption-FVE-Package~"
"Microsoft-Windows-TPM-WMI-Provider-Package~"
"Microsoft-Windows-Narrator-App-Package~"
"Microsoft-Windows-Magnifier-App-Package~"
"Microsoft-Windows-Search-Engine-Client-Package~"
```

### Driver Store Slimming

This is where Nano11 gets truly aggressive:

```powershell
$patternsToRemove = @(
    'prn*',        # Printer drivers - goodbye, printing
    'scan*',       # Scanner drivers
    'mfd*',        # Multi-function devices
    'wscsmd.inf*', # Smartcard readers
    'tapdrv*',     # Tape drives (it's 2025, who uses tape?)
    'rdpbus.inf*', # RDP virtual bus
    'tdibth.inf*'  # Bluetooth PAN
)
```

### Font Reduction

Windows comes with hundreds of fonts. Nano11 keeps:

- **Segoe UI family** (Windows UI font)
- **Arial** (standard sans-serif)
- **Calibri** (Office default)
- **Times New Roman** (standard serif)
- **Consolas/Lucida Console** (monospace)
- **Marlett** (Windows glyphs)
- **Terminal fonts** (console display)

Everything else? Gone. Chinese, Japanese, Korean fonts? Gone. Decorative fonts? Gone. That font you've never heard of? Especially gone.

### .NET Native Images Cleanup

```powershell
# Remove pre-compiled .NET assemblies
Remove-Item -Path "$scratchDir\Windows\assembly\NativeImages_*" -Recurse -Force
```

These are pre-compiled versions of .NET assemblies for performance. Nano11 removes them because:
1. They take space
2. They can be regenerated if needed
3. We're not running production workloads

### Input Method Destruction

```powershell
$inputMethodPaths = @(
    "$scratchDir\Windows\System32\InputMethod\CHS",  # Chinese Simplified
    "$scratchDir\Windows\System32\InputMethod\CHT",  # Chinese Traditional
    "$scratchDir\Windows\System32\InputMethod\JPN",  # Japanese
    "$scratchDir\Windows\System32\InputMethod\KOR"   # Korean
)
```

If you need CJK input, Nano11 is not for you. And that's okay.

### Service Removal

This is permanent. These services are deleted from the registry:

```powershell
$servicesToRemove = @(
    'Spooler',           # Print Spooler - no printing
    'PrintNotify',       # Print notifications
    'Fax',               # Fax (it's 2025!)
    'RemoteRegistry',    # Remote registry editing
    'diagsvc',           # Diagnostic service
    'WerSvc',            # Windows Error Reporting
    'PcaSvc',            # Program Compatibility Assistant
    'MapsBroker',        # Maps data download
    'WalletService',     # Payment service
    'BthAvctpSvc',       # Bluetooth audio
    'BluetoothUserService',
    'wuauserv',          # Windows Update
    'UsoSvc',            # Update Session Orchestrator
    'WaaSMedicSvc'       # WaaS Medic Service
)
```

## Boot.wim Optimization: The Deep Cut

While Tiny11 Core touches boot.wim, Nano11 performs **full surgery**:

```powershell
function Process-BootImage {
    # Export ONLY index 2 (setup image), discard index 1 (WinPE)
    & dism /Export-Image /SourceImageFile:$bootWimPath /SourceIndex:2 /DestinationImageFile:$newBootWimPath
    
    # Mount the new boot image
    & dism /mount-image "/imagefile:$newBootWimPath" /index:1 "/mountdir:$scratchDir"
    
    # Apply requirement bypasses to boot environment
    Set-RegistryValue 'HKLM\zSYSTEM\Setup\LabConfig' 'BypassTPMCheck' 'REG_DWORD' '1'
    Set-RegistryValue 'HKLM\zSYSTEM\Setup\LabConfig' 'BypassCPUCheck' 'REG_DWORD' '1'
    # ... more bypasses
    
    # Recompress with maximum compression
    & dism /Export-Image /SourceImageFile:$newBootWimPath /SourceIndex:1 /DestinationImageFile:$finalBootWimPath /Compress:max
}
```

The result? A boot.wim that's significantly smaller than stock.

## ISO Root Cleanup

The final step is cleaning the ISO root directory itself:

```powershell
$keepList = @(
    "boot", 
    "efi", 
    "sources", 
    "bootmgr", 
    "bootmgr.efi", 
    "setup.exe", 
    "autounattend.xml"
)

Get-ChildItem -Path $nano11Dir | Where-Object { $_.Name -notin $keepList } | ForEach-Object {
    Remove-Item -Path $_.FullName -Recurse -Force
}
```

All those marketing files, icons, and autorun configurations? Deleted.

## The Numbers: Nano11 vs. Stock Windows 11

| Metric | Stock Windows 11 | Tiny11 Core | Nano11 |
|--------|------------------|-------------|--------|
| ISO Size | ~6GB | ~2.5GB | ~1.5GB |
| Installed Size | ~25GB | ~8GB | ~5GB |
| Boot Time | ~30s | ~15s | ~10s |
| RAM at Idle | ~3GB | ~1.5GB | ~1GB |
| Apps Removed | 0 | ~40 | ~45+ |
| Drivers | Full | Full | Minimal |
| Fonts | ~300 | ~300 | ~20 |
| Services | ~150 | ~100 | ~70 |

## Technical Challenges Overcome

### Challenge 1: WinSxS Dependency Hell

The Windows Side-by-Side (WinSxS) folder is a nightmare of dependencies. Removing too much breaks Windows. The solution involved careful analysis of which components were truly essential:

```powershell
$dirsToCopy = @(
    # Servicing stack - MUST keep
    "amd64_microsoft-windows-servicingstack_*",
    "amd64_microsoft-windows-servicingstack-onecore_*",
    
    # Common controls - UI breaks without these
    "amd64_microsoft.windows.common-controls_*",
    
    # GDI+ - graphics break without this
    "amd64_microsoft.windows.gdiplus_*",
    
    # Core infrastructure
    "Catalogs", "FileMaps", "Fusion", "InstallTemp", "Manifests"
)
```

### Challenge 2: Service Removal Timing

Services must be removed at exactly the right point in the build process. Too early, and DISM operations fail. Too late, and the image is already committed. The solution:

```powershell
# Load SYSTEM hive after image cleanup, before dismount
reg load HKLM\zSYSTEM "$scratchDir\Windows\System32\config\SYSTEM"

foreach ($service in $servicesToRemove) {
    & 'reg' 'delete' "HKLM\zSYSTEM\ControlSet001\Services\$service" /f
}

reg unload HKLM\zSYSTEM
```

### Challenge 3: Font Registry Corruption

Removing fonts without updating the registry causes Windows to crash on boot. The solution was to remove only font FILES, not registry entries, letting Windows gracefully handle missing fonts.

### Challenge 4: Boot.wim Modifications

Modifying boot.wim requires careful sequencing:
1. Export desired index
2. Mount for editing
3. Load registry hives
4. Apply changes
5. Unload hives
6. Wait for file handles to release
7. Dismount
8. Re-export with compression

Miss any step and the boot image becomes corrupted.

## The Workflow: 500 Minutes of Automation

The GitHub Actions workflow runs for up to 500 minutes (over 8 hours!) because:

1. **ISO Download**: 5-15 minutes for a 6GB file
2. **ESD Conversion**: 10-20 minutes (if source is ESD)
3. **File Copy**: 5-10 minutes
4. **WIM Mount**: 2-5 minutes
5. **App Removal**: 10-15 minutes
6. **Package Removal**: 15-20 minutes
7. **Driver Slimming**: 5-10 minutes
8. **WinSxS Optimization**: 20-30 minutes
9. **Registry Operations**: 5-10 minutes
10. **Service Removal**: 2-5 minutes
11. **Image Cleanup/Export**: 15-20 minutes
12. **Boot.wim Processing**: 15-20 minutes
13. **ESD Conversion**: 20-30 minutes
14. **ISO Creation**: 5-10 minutes
15. **Upload to SourceForge**: 10-30 minutes

Total: 60-90 minutes, but we allow extra time for edge cases.

## January 2026 Update: The Next Level of Minimal

With the release of Windows 11 25H2, we had to adapt Nano11 to handle new forms of bloat. The latest update pushes the boundaries even further.

### 1. Nuking Windows Update Binaries
Since Nano11 is non-serviceable by design, keeping the Windows Update infrastructure was wasteful. We now delete:
- `usoclient.exe`
- `UsoApi.dll` / `UsoApiAll.dll`
- `umbus.sys`
- The entire `SoftwareDistribution` folder

**Savings:** An additional **~300 MB** reclaimed.

### 2. AI & Recall Purge
Windows 25H2's AI features are heavy. Nano11 removes:
- **Recall**: The snapshot feature that records your screen. Gone.
- **Copilot**: The AI assistant. Gone.
- **AI Fabric**: The underlying service layer. Gone.

### 3. Extreme Service Removal
We've expanded the service blacklist to include 14+ services, including:
- **WaaSMedicSvc**: Windows Update Medic Service
- **UsoSvc**: Update Session Orchestrator
- **MapsBroker**: Downloaded Maps Manager
- **WalletService**: Payment features

The result is a Windows 11 installation that idles at **~800MB RAM** and boots in **~5 seconds**.

## What Breaks in Nano11

Let's be honest about what doesn't work:

| Feature | Status | Why |
|---------|--------|-----|
| **Printing** | ❌ Broken | Spooler service removed |
| **Notepad** | ❌ Gone | Explicitly removed |
| **Paint** | ❌ Gone | Explicitly removed |
| **Photos App** | ❌ Gone | Use File Explorer |
| **Camera App** | ❌ Gone | No cameras in VMs |
| **Windows Hello** | ❌ Broken | Biometric packages removed |
| **BitLocker** | ❌ Broken | FVE package removed |
| **CJK Input** | ❌ Broken | Input methods removed |
| **Faxing** | ❌ Broken | Service removed (who cares?) |
| **Windows Update** | ❌ Disabled | By design |
| **System Restore** | ❌ Disabled | By design |

## The Perfect Use Cases

Despite (or because of) these limitations, Nano11 excels at:

### 1. Rapid VM Testing
Need to check if your app runs on Windows 11? Nano11 boots in seconds.

### 2. Application Compatibility Testing
Test that your software works without any of the "expected" Windows components.

### 3. Baseline Measurements
What does Windows actually need to run your application? Nano11 helps you find out.

### 4. Disposable Environments
CI/CD pipelines that need temporary Windows instances.

### 5. Curiosity Satisfaction
"I wonder how small Windows can get" - Nano11 answers that question.

## Security Implications

🚨 **This section is important.** Nano11 is NOT secure:

- **No Windows Defender** - No real-time protection
- **No Windows Update** - No security patches
- **Bypassed TPM** - No hardware security
- **Bypassed Secure Boot** - No boot verification
- **Reduced attack surface** - Fewer services, but...
- **No recovery** - WinRE removed

**DO NOT** use Nano11 for:
- Anything connected to sensitive networks
- Processing personal data
- Financial operations
- Anything you care about

## Looking Forward

The Nano11 project represents the current extreme of Windows minimization. Future directions might include:

- **ARM64 variant** - Nano11 for Windows on ARM
- **Server variant** - Windows Server Nano11 (ironic name clash)
- **Custom removal profiles** - Pick your poison
- **Integration with container technologies** - Even more disposable

## Conclusion: The Art of Removal

Building Nano11 taught me that creating something minimal is often harder than creating something feature-rich. Every removal decision required understanding deep Windows internals, although [NTDEVLABS](https://github.com/ntdevlabs) already did the heavy lifting, testing for breakage, and accepting trade-offs.

The final product is a Windows 11 that would make Microsoft's engineers weep - not out of sadness, but confusion. "You removed WHAT?!" they might ask. And the answer is: "Everything we could."

Is Nano11 practical for daily use? Absolutely not. Is it a technical achievement that explores the boundaries of Windows minimization? I'd like to think so. Is it fun to see a ~5GB Windows installation that boots in seconds? Definitely.

The Nano11 Builder joins its siblings in the Tiny11 Automated family, providing yet another tool for those of us who believe that the best Windows component is often the one that's been removed.

> Remember: Just because you CAN remove something from Windows doesn't mean you SHOULD. But if you're going to do it anyway, at least do it with automation.

---

*Ready to experience the minimalist extreme? Check out the [Tiny11 Automated Builder repository](https://github.com/kelexine/tiny11-automated) and trigger a Nano11 build. Your VMs will thank you. Your production systems definitely won't.*

## Download Pre-built ISOs

If you want to experience Nano11 without running the build yourself:

**SourceForge Downloads**: [Click Here](https://sourceforge.net/projects/tiny-11-releases/)

Look for `Nano11-{Edition}-{Version}` folders for the ultimate minimal Windows 11 experience.

**Developer**: Franklin Kelechi [@kelexine](https://github.com/kelexine/)
**Project Repository**: [Tiny11 Automated Builder](https://github.com/kelexine/tiny11-automated)
**Original Tiny11 Author**: [ntdevlabs](https://github.com/ntdevlabs/nano11)

---

<div class="glass-effect p-6 rounded-xl border border-white/10 my-8">

**🔥 Visit the Project Homepage**: [Nano11 Project Page](/nano11) — Explore the most extreme Windows 11 build with an interactive overview of features, removal statistics, and quick access to all resources.

**💡 Want something less extreme?** Check out the [Tiny11 Project Page](/tiny11) — A more balanced build that keeps Windows Update, Defender, and essential apps.

</div>

---

## Appendix: Quick Command Reference

```powershell
# Build Nano11 locally (requires Windows + mounted ISO)
.\scripts\nano11builder-headless.ps1 -ISO E -INDEX 1

# Build with custom scratch disk
.\scripts\nano11builder-headless.ps1 -ISO E -INDEX 6 -SCRATCH D

# Debug mode (skip cleanup)
.\scripts\nano11builder-headless.ps1 -ISO E -INDEX 1 -SkipCleanup
```

## Appendix: Version Comparison Chart

| Feature | Standard | Core | Nano |
|---------|:--------:|:----:|:----:|
| Bloatware Removed | ✅ | ✅ | ✅ |
| Telemetry Disabled | ✅ | ✅ | ✅ |
| Requirements Bypassed | ✅ | ✅ | ✅ |
| Edge/OneDrive Removed | ✅ | ✅ | ✅ |
| WinSxS Preserved | ✅ | ❌ | ❌ |
| WinRE Preserved | ✅ | ❌ | ❌ |
| Defender Active | ✅ | ❌ | ❌ |
| Updates Possible | ✅ | ❌ | ❌ |
| Notepad/Paint | ✅ | ✅ | ❌ |
| Printing Works | ✅ | ✅ | ❌ |
| All Fonts | ✅ | ✅ | ❌ |
| CJK Input | ✅ | ✅ | ❌ |
| Recommended Use | Daily* | VM/Testing | Extreme Testing |
| ISO Size | ~3-5GB | ~2-3GB | ~1.5GB |
| Installed Size | ~15GB | ~8GB | ~5GB |

*With caution - it's still modified Windows

---

*This content is available at [kelexine.is-a.dev/blog/nano11-builder-development](https://kelexine.is-a.dev/blog/nano11-builder-development)*