ULTIMUM OS – Windows 11 LTSC 2024 v24H2 Build 26100.2605

ISO Design Philosophy
There’s a common misconception that fewer running services automatically result in a better-performing Windows system.
That’s not entirely accurate.
Whether you have 1 or 100 services running, as long as they aren’t actively needed,
they won’t consume CPU cycles or significant RAM, since inactive services are moved to swap.For me, it’s all about finding the right balance.
Our user base includes hundreds of thousands of individuals, many of whom install Windows on multiple PCs.
Each PC is unique—not only in terms of hardware but also in the specific needs of its user.
What’s unnecessary for one person might be essential for another.That’s why I avoid disabling services like Bluetooth or the Print Spooler in most of my builds.
The performance gains from disabling these services are almost zero, and the disk space saved is negligible,
but the potential issues they could cause for users who rely on them are significant.In many cases, we may not even realize when a service is being used—not by us, but by other applications.
Take the Print Spooler, for example.
If you don’t have a printer, you might think it’s unnecessary.
However, many PDF creation tools and graphic design programs rely on virtual printer drivers,
which require the Print Spooler to function. Without it, creating PDFs becomes impossible.

That said, there are some services that, in my experience, are rarely needed by most users. Examples include:
Connected User Experiences and Telemetry / Geolocation Service / Remote Registry / AllJoyn Router Service and others.
Instead of removing these services entirely,
I set them to “Disabled” or “Manual Startup.”
When disabled, a service isn’t loaded at all.
When set to manual, it only activates if explicitly required by the system or the user.

This approach allows us to achieve optimal performance while maintaining broad compatibility.
And let’s not forget—this is Windows LTSC, so much of the unnecessary bloat is already removed by default.

I hope this explanation clarifies the design decisions behind this ISO build and helps you better understand my approach.

Storage Sense, Reserved space, and Preffetcher= OFF

Disabled services

Assigned Access Manager
Connected User Experiences and Telemetry
Diagnostic Execution Service – Diagnostic Policy Service – Diagnostic Service Host – Diagnostic System Host.
Geolocation Service
Downloaded Maps Manager
Netlogon
Remote Desktop Configuration – Remote Desktop Services – Remote Desktop Services UserMode Port Redirector
Smart Card – Smart Card Device Enumeration Service – Smart Card Removal Policy
Work Folders
Xbox Accessory Management Service – Xbox Live Auth Manager – Xbox Live Game Save – Xbox Live Networking Service –
Window Insider Service
Fax
Remote Registry
AllJoyn Router ServiceSet to manual services

Windows Camera Frame Server
Print Spooler
Internet Connection Sharing
Program Compatibility Assistant
Service Device Management
Wireless Application Protocol
Shared PC Account Manager
Windows Error Reporting Service
Geolocation Service
Secondary Logon

Why the built-in administrator account?
The built-in Administrator account exists for several important reasons:
Emergency Access:
It provides a failsafe for troubleshooting and repairing a system when other user accounts,
including those with administrative privileges, become corrupted or inaccessible
Bypass Restrictions:
This account operates without User Account Control (UAC) prompts,
meaning it can perform any action without requiring additional confirmation.
Legacy Compatibility:
Some older programs or system tools might not function correctly
unless run from the actual built-in Administrator account.
Malware Removal:
In cases of severe malware infections, this account can be crucial for removing malicious software
that might have compromised other user accounts.Performance gains?

No UAC
Every time you perform an administrative task on a standard account,
UAC requires you to confirm the action. This adds a tiny bit of overhead. The built-in Administrator account bypasses this entirely.
That also comes with an inherit risk and you must ALWAYS be more vigilant with what you download

With great power comes great responsibility!!Elevated Privileges:

This account inherently runs with the highest privileges,
potentially reducing the need for certain privilege checks and operations
that the system performs in the background.Driver and Software Compatibility:

In some rare cases, certain drivers or older software might have compatibility issues with UAC or standard user accounts.
Running them under the built-in Administrator account might resolve these issues, leading to smoother performance.The above of course varies from system to system, based mainly on the CPU architecture.
Some CPUs, Mainly AMD, will benefit due to the Cache architecture and size compared to Intel CPUs
and so there is no clear indication of how much performance gain there is, but for sure is not making it worse.Now the boring part

There have been documented cases, particularly with AMD CPUs and Windows,
where kernel address space layout randomization (KASLR)
and related security mitigations have led to performance impacts, especially concerning cache performance.When some mitigations that use KASLR like Spectre or Meltdown are active we have

KASLR can lead to increased cache misses,

The process of relocating the kernel in memory adds a small amount of overhead, which can also contribute to performance loss.The normal Admin accounts operate under KASLR but the built-in Local Administrator doesn’t.
That makes certain CPUs and architectures run a bit faster and Snapier but only under certain conditions
If the application uses the CPU and RAM intensively
the CPU architecture and how it uses Cache and Cache tables.Long story short, Some systems may see some noticeable increase in performance some others not so much,
but so far I haven’t seen anything going slower.However, if you are afraid of getting exploited by Spectre or Meltdown (highly unlikely) etc
You can add a Normal admin or even better a normal user account and “experiment” using that.

Also, that is why we let Defender on, so it will protect the system better.
Use that or any antivirus of your liking.

The choice is yours.