Discussion: NTLite Methodology

Hellbovine

Hellbovine

Well-Known Member
Does NTLite change its registry tweaks or component removals based on the detected operating system?

EXAMPLE
Pretend NTLite has a setting for "Disable Doodad" and let's say the registry path changes based on which operating system is being used because Microsoft decided to change things later.

; Windows Vista, 7, 8, 8.1
[HKEY_LOCAL_MACHINE\Doodad]
"DisableDoodad"=dword:00000001

; Windows 10, 11
[HKEY_LOCAL_MACHINE\Doodad\Settings]
"DisableDoodad"=dword:00000001

Note: Notice how there's an extra path at the end for W10 and W11 with "Settings" added on.

In this circumstance, which of the following does NTLite do, assuming I'm on W10:
1) Applies only the 2nd registry key for just W10 and W11 systems as a user would expect.
2) Applies both keys to all operating systems, resulting in extraneous keys.
3) Perhaps a combination of things, or another approach entirely.
 
Last edited:
NTLite does basic checking, like TPM doesn't exist before W11.

The question you're really asking, is how does MS handle backwards compatibility -- which is a core Windows pinciple. Therefore your imagined scenario doesn't play out this way.

When a registry control is deprecated, newer Windows will silently ignore those values. At best if MS bothers updating their docs, someone will write "no longer applies in Win X and later".

When they replace the old controls with a new one, it will be in a different registry branch with non-overlapping keys. There will be a clear distinction btw the legacy and new ways.
Code: 
; Windows Vista, 7, 8, 8.1
[HKEY_LOCAL_MACHINE\Doodad]
"DisableDoodad"=dword:00000001

; Windows 10, 11
[HKEY_LOCAL_MACHINE\NotDoodad\Son]
"DisableSon"=dword:00000001

Now does that mean NTLite is perfect? No, nuhi sometimes forgets to test all cases. Just file a bug.
 
To really clarify the answer I'm seeking though, in your example does NTLite try to detect that I'm on W10, and then applies your "DisableSon" key by itself, does it apply both keys, or some 3rd option?
 
Last edited:
There are few cases where this occurs and the ones I know NTLite doesn't have an option for that.

The ones I know:

Disable Low Disk Space Checks
Windows Registry Editor Version 5.00

; Windows 7, 8, 8.1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiskSpaceChecks"=dword:00000001

; Windows 10
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiskSpaceChecks"=dword:00000001

Disable NTFS Last Access Time Stamp Updates

Code: 
fsutil behavior set disablelastaccess 1

or

Windows Registry Editor Version 5.00

; Windows 7, 8, 8.1 and Windows 10 before version 1803
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\FileSystem]
"NtfsDisableLastAccessUpdate"=dword:00000001

; Windows 10 version 1803 and higher
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\FileSystem]
"NtfsDisableLastAccessUpdate"=dword:80000001

The latter is problematic since they are in the same key and have the same name changing only the values depending on the Windows version.

But these options are not in NTLite and I don't know another one with this standard.

What I know from my experience is that many options in Settings are out of date and don't work anymore, like for example "Fullscreen optimizations" that Windows ignores the reg tweak since there is no longer a global setting for this and several in Privacy are no longer applicable in the latest builds of Windows 10.

Because of this I have a certain OCD attack when I see people turning off everything in Privacy lol
 
Last edited:
AeonX said:
I have a certain OCD attack when I see people turning off everything in Privacy lol
Click to expand...
the whole windows privacy makes my brain fart leaving me flying solo. nothing is more private than an airgapped machine and you claw back resources disabling the lan adapter and services needed for networking..
 
Last edited:
Clanger said:
nothing is more private than an airgapped machine
Click to expand...
Yes, or using only open source software which is not feasible in my point of view, and even some open source projects collect diagnostic data to improve their software. The big difference is whether the data is anonymous or not and open source tends to respect its users more.
 
Hellbovine said:
To really clarify the answer I'm seeking though, in your example does NTLite try to detect that I'm on W10, and then applies your "DisableSon" key (by itself), or does it apply both keys (resulting in one ignored key), or some 3rd option?
Click to expand...
Yes, of course, includes components as well - especially when for example the Storage Service was changed from Win7 to Win10 to be a completely different thing.

If you, or anyone else finds a missed Settings/Component WinVer switch, let me know, it's simple to adapt.

AeonX, cannot find those 2 settings NTLite, I see, you were just giving general examples.
Will add these 2, at least the NTFS one is good to have.
Thanks.
 
Disable free disk space check. Works on 10 and 11.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiskSpaceChecks"=dword:00000001
 
nuhi said:
you were just giving general examples.
Click to expand...
Yes, I just wanted to show some examples and how few cases this happens.

They are good tweaks to have in NTLite :) the NTFS one can give a small performance boost, and if I remember correctly the NTFS one is already this value by default in Windows 7 but not in Windows 10.

Павел said:
Disable free disk space check. Works on 10 and 11.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiskSpaceChecks"=dword:00000001
Click to expand...
Are you sure? I have no way to test this as I always keep my drives with good free space so I posted the source where I saw this information.
 
AeonX said:
Yes, I just wanted to show some examples and how few cases this happens.

They are good tweaks to have in NTLite :) the NTFS one can give a small performance boost, and if I remember correctly the NTFS one is already this value by default in Windows 7 but not in Windows 10.


Are you sure? I have no way to test this as I always keep my drives with good free space so I posted the source where I saw this information.
Click to expand...
I am one hundred percent sure. I have been using this key for a long time since XP. I have enough space on my disks, but I still make sure to check them because I don't like surprises. I specially copied the files until they were full and the memory control was not activated. You suggested some good performance enhancing keys and I was paying attention to them. Regarding NTFS, I looked on 10 and 11 I have it disabled by default.
 
Павел said:
I am one hundred percent sure. I have been using this key for a long time since XP. I have enough space on my disks, but I still make sure to check them because I don't like surprises. I specially copied the files until they were full and the memory control was not activated. You suggested some good performance enhancing keys and I was paying attention to them. Regarding NTFS, I looked on 10 and 11 I have it disabled by default.
Click to expand...
Thanks for confirming. I could even do a test here with my other HDs but I'm not sure if Windows would complain about space on drives other than where Windows is installed and I don't want to do a lot of writing to the SSD where Windows is without really being necessary. It would take time to do this, perhaps partitioning the SSD.

I also prefer to disable this check because I hate when Windows is alerting me about something I already know and that is momentary. Also I disable or remove the task \Microsoft\Windows\DiskCleanup\SilentCleanup because I also hate when Windows tries to do things in a forced way without my consent, this task consumes a lot of resources so I don't want it running while I'm using the PC.

About the NTFS tweak I had it enabled by default in Windows 10, I think it depends on the size of the partition where Windows is installed. On large partitions Windows detects this and disables it but on small partitions it is enabled. So I prefer to forcefully disable it in case I forget to check.

In the System Managed mode, the NTFS driver can enable or disable the “Last Access” updates during the boot (in particular, when the system volume is mounted). The “Last Access” updates are enabled for NTFS volumes when the size of the system volume (which is usually mounted as the “C:” drive) is 128 GB or less. If the system volume is larger, then the “Last Access” updates are disabled.
Click to expand...
https://www.tenforums.com/tutorials...t-access-time-stamp-updates-windows-10-a.html

Although here DisableLastAccess = 1 (User Managed, Enabled) says it is Enabled this is disabled.
Code: 
C:\Windows\system32>fsutil behavior query disablelastaccess
DisableLastAccess = 1  (User Managed, Enabled)


C:\Windows\system32>fsutil behavior set disablelastaccess
Usage: fsutil behavior set disableLastAccess <0-3>


 Values: 0x0 - User Managed, Last Access Updates Enabled
         0x1 - User Managed, Last Access Updates Disabled
         0x2 - System Managed, Last Access Updates Enabled
         0x3 - System Managed, Last Access Updates Disabled


 - When "System Managed" is enabled it allows the system to enable/disable
   last access time updates based on system policy.
 - If group policy is in effect or this registry key is uninitialized then
   the "System Managed" state can not be set and is not displayed.

I tested it and the only command that actually disabled this was fsutil behavior set disablelastaccess 1 or the aforementioned reg tweak.
 
nuhi I noticed that in an original Windows 10 ISO when mounting with NTLite the following key is present:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\FileSystem]
"NtfsDisableLastAccessUpdate"=dword:00000001

Although in a VM without applying any modification of the original the following key is:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\FileSystem]
"NtfsDisableLastAccessUpdate"=dword:80000002

So it may be necessary to apply the reg tweak on the first boot. I haven't tested this yet.
 
AeonX said:
I noticed that in an original Windows 10 ISO when mounting with NTLite the following key is present...
Click to expand...
In my W10 21H2 install it defaults to the 80000002 value. Using a registry capture tool I tried all 4 command prompt values and each time it actually changes both the, "NtfsDisableLastAccessUpdate" and "RefsDisableLastAccessUpdate" registry keys, rather than just one key. All testing I did resulted in the number "8" at the start of the NTFS keys.
 
Last edited:
Hellbovine said:
"RefsDisableLastAccessUpdate"
Click to expand...
This must refer to ReFS which is another optional file system to use in place of NTFS. I've never used it but it might be recommended to use the 2 values in the registry for consistency with the fsutil tool.

garlin said:
My guess is like other settings, 0x8 indicates it's been manually changed like Defender's mysterious 0x4 reg flags.
Click to expand...
One thing I thought is that maybe changing the default in the offline image which is 0x00000001 to 0x80000001 Windows understands that it should keep this value, this is something I intend to test. That way I wouldn't need to apply this on the first boot.
 
Last edited:
Updated reg tweak for Windows 10 21H1 (and likely other versions) with comments. I need to test on other versions of Windows.

Thank you Hellbovine :)

Code: 
Windows Registry Editor Version 5.00

; fsutil behavior set disablelastaccess 1

; Only valid in Windows 10 version 1803 and higher
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\FileSystem]
"NtfsDisableLastAccessUpdate"=dword:80000001
"RefsDisableLastAccessUpdate"=dword:00000001
 
You must log in or register to reply here.
Back
Top