A CLI tool for Windows users who want a Windows ISO with open-source debloat tools already in it. Download the ISO, pick tools from a risk-rated catalog, and either get a plain ISO with a tools folder, or a rebuilt ISO that puts the tools on the desktop after install and can run them automatically.
The point is: you do this once, at ISO build time, instead of debloating every fresh install.
- Downloads Windows 10/11 ISOs from the official Microsoft download API (same endpoints the download page uses, so you get the real thing) and pre-modified images like Tiny11 from archive.org. Windows 7/8.1 are archive.org only, since Microsoft no longer serves them.
- Downloads with aria2 (16 parallel connections, resumable) when available, with a fallback built-in downloader.
- Verifies SHA-1 when the source provides one (archive.org always does).
- Bakes debloat tools into the ISO without touching install.wim:
$OEM$\$1\Users\Public\Desktop\DebloatTools\ <- tools folder on the desktop
$OEM$\$\Setup\Scripts\run-debloat.cmd <- auto-run at first logon
autounattend.xml <- first-logon commands
- Rebuilds the ISO with pycdlib, copying the original El Torito boot records (BIOS etfsboot and EFI) from the source image, so the result still boots. The rebuilt image is verified before you get it.
- A "system" mode runs the tools during setup as SYSTEM, so no UAC prompts.
Every tool in the catalog is marked. Ratings are not a guarantee, they are a starting point:
| Rating | Meaning |
|---|---|
| safe | conservative, reversible, actively maintained |
| medium | aggressive or a playbook; read the docs first |
| at own risk | archived, unmaintained, aggressive, or an unreviewed GitHub find |
The catalog lives in debloatediso/data/catalog.json and is refreshed with a
live GitHub search (dbi --refresh-catalog). Anything found by search is
automatically rated "at own risk" until a human reviews it. All entries are
shown always; the wizard sorts safe-first. Nothing is hidden.
- Windows 10 or 11 (the tool builds ISOs; it makes no sense elsewhere)
- Python 3.10 or newer
- The official source may refuse datacenter/VPN IPs. If that happens, use
--fido(see below) or a normal home connection.
pip install -e .
or from PyPI once published:
pip install debloatediso
Run with dbi, or python -m debloatediso if the script directory is not on
your PATH.
Interactive wizard (recommended first run):
dbi
It walks you through: Windows version, source, edition, language, ISO candidate, debloat tools, integration mode, and a final plan confirmation.
The integration modes are:
| Mode | What happens after install |
|---|---|
| none | just the ISO, plus a DebloatTools folder next to it |
| desktop | DebloatTools folder on the desktop, you run the launchers |
| firstlogon | same, but the launchers run automatically at the first logon |
| system | tools run during setup as SYSTEM; no user, no UAC |
system is only for scripts that work headless. If a tool expects clicks, use
firstlogon.
Non-interactive examples:
dbi --windows 11 --source official --edition Home/Pro/Edu --lang en-us --arch x64
--debloat winutil,win11debloat --integration desktop --output D:\isos --yes
dbi --windows 10 --source archive --debloat w10debloater --integration firstlogon --yes
dbi --list-debloaters
dbi --refresh-catalog
dbi --windows 11 --source official --fido --edition Pro --integration none --yes
aria2 is fetched automatically on first use (pinned version from the official
GitHub release). If it cannot be fetched, pass --no-aria2 to use the built-in
downloader. Downloads resume; completed files are not redownloaded.
The official API checks more than your password. It blocks requests from some IPs (VPN, datacenter, flagged ranges). The error message will tell you. Two ways around it:
--fido: runs the FIDO PowerShell script (pbatard, GPL-3.0) instead, which is battle-tested against these endpoints. The script is downloaded from its official repository at runtime, not shipped here.- Try again from a different network. The block is usually transient.
- Boot images are copied from the original ISO, both the BIOS etfsboot entry and the EFI entry. UEFI machines boot the EFI entry; legacy BIOS machines boot the other.
- Files larger than 4 GB are handled with multi-extent ISO9660 records (interchange level 3), the same layout Windows Setup expects.
- After repacking, the tool reopens the ISO and checks that the El Torito
catalog and
bootmgrare present. It does not boot-test the result for you; flash it with Rufus and test once before relying on it. - The UDF tree is rebuilt alongside ISO9660/Joliet, matching the bridge layout of stock Windows ISOs.
Curated tools (14) with ratings:
| ID | Tool | Risk |
|---|---|---|
| winutil | Chris Titus Tech Windows Utility | safe |
| win11debloat | Win11Debloat | safe |
| sparkle | Sparkle | safe |
| blackbird | Blackbird telemetry blocker | safe |
| atlas | AtlasOS Playbook (gaming focused) | medium |
| sophia | Sophia Script for Windows | medium |
| unattendedwinstall | UnattendedWinstall answer files | medium |
| winscript | winscript | medium |
| wdt | Win-Debloat-Tools (archived) | medium |
| w10debloater | Sycnex Windows10Debloater (archived) | at own risk |
| debloat-w10 | W4RH4WK Debloat-Windows-10 (archived) | at own risk |
| revios | ReviOS Playbook | at own risk |
| tiny11builder | Tiny11 Builder | at own risk |
| ghostspectre | Ghost Spectre prebuilt (not open source) | at own risk |
Plus anything the GitHub search refresh finds, always rated "at own risk".
- Official ISOs come from Microsoft's own download API. They are covered by the Microsoft software license terms; you still need a valid license.
- Images on archive.org (Tiny11 and friends) are not produced by Microsoft and the license situation is murky. They are included because you asked for them, rated "at own risk", with source metadata and SHA-1 shown.
- Debloat tools modify Windows in ways Microsoft never intended. Some changes break Windows Update or security features. That is the trade-off of this tool; you are the one who clicks yes.
Launcher that installs dependencies on first run and then starts the tool.
Everything after the script name is passed through, so any dbi option works:
run.bat
run.bat --list-debloaters
run.bat --windows 11 --source official --debloat winutil --integration desktop --yes
Self-contained bash script to fetch a Windows ISO and debloat patch launchers from a headless Linux box (e.g. an Ubuntu server over SSH), and optionally flash a bootable USB or attempt a direct disk install that replaces Linux.
Run it with a one-liner, no checkout needed:
curl -fsSL https://raw.githubusercontent.com/erwinwermach/debloatediso/main/experimental/windows-iso.sh | bash -s -- fetch 11 official "Home/Pro/Edu" win11debloat
Modes:
| Mode | What it does |
|---|---|
| fetch | download the ISO (official Microsoft or archive.org) + patch launchers |
| scan | scan for existing ISOs, pick one to install and boot |
| usb | install Ventoy on a USB stick, copy the ISO onto it; reboot to install |
| disk | best-effort direct install to a disk, replacing Linux (UEFI, root only) |
Examples:
bash windows-iso.sh fetch 10 archive "" winutil
bash windows-iso.sh scan
bash windows-iso.sh usb 11 archive "" winutil /dev/sdb
bash windows-iso.sh disk 11 official Pro win11debloat /dev/nvme0n1
Install-and-boot: after fetch (and from scan) the script asks whether to
install and boot the ISO now, then asks for a target (usb or disk) and device,
installs, and offers to reboot. Prompts need a real terminal, so for
interactivity download the script to a file first:
curl -fsSL https://raw.githubusercontent.com/erwinwermach/debloatediso/main/experimental/windows-iso.sh -o windows-iso.sh
bash windows-iso.sh scan
For fully non-interactive installs (e.g. from a CI script or an SSH command with no TTY), set the variables instead:
INSTALL_TARGET=usb INSTALL_DEVICE=/dev/sdb AUTO_REBOOT=1 bash windows-iso.sh fetch 11 archive Pro win11debloat
scan looks in the tool's own iso dir, the current directory, $HOME/Downloads,
/root, /root/winiso/iso, /tmp, /media and /mnt for .iso files. If it
was downloaded by root earlier and you are running the scan as a normal user,
run it through sudo (or use sudo -n, no password prompt) so /root is
readable, or just pass the path directly:
bash windows-iso.sh scan "/root/winiso/iso/tiny11 23H2 x64.iso"
Requirements: curl, python3 (for JSON parsing). USB and disk modes need
root and install their own packages (Ventoy, wimtools, parted, ntfs-3g,
efibootmgr, libarchive-tools).
Reliability: usb mode (Ventoy) is the dependable way to install - you boot
the stick and let Windows Setup do the actual disk work. disk mode applies
install.wim directly with wimlib-imagex and registers a UEFI boot entry; BCD
store creation is not guaranteed, so if the machine does not boot, use usb
mode instead. The official source may refuse datacenter/VPN IPs; the script
will tell you and you can fall back to source=archive.
pip install -e ".[dev]"
python -m pytest tests
The tests build a fake bootable Windows-style ISO with pycdlib and run the full extract, inject, repack and boot-verification pipeline against it, including a >4 GB file roundtrip. No network is required for tests.
Layout:
debloatediso/
cli.py entry point, wizard, argument parsing
catalog.py curated catalog + GitHub search refresh
downloader.py aria2 wrapper + fallback downloader
sources/
microsoft.py official Microsoft download API (+ FIDO fallback)
archiveorg.py archive.org search and metadata
iso/
extract.py ISO extraction (mount, 7-Zip, pycdlib fallback)
inject.py $OEM$ tree + autounattend.xml generation
repack.py bootable ISO rebuild with pycdlib
- Microsoft's official API only serves the latest release per version. For older builds, use archive.org images.
- Repacking is a full copy of the ISO contents; it takes a few minutes for a 5 GB image. Full WIM-level modification (removing components from install.wim itself) is not implemented. Use Tiny11 Builder or NTLite for that level of surgery.
- The Microsoft source cannot be tested from datacenter IPs; if it fails for you on a home connection, report it with the exact error message.