Microsoft shipped Windows 11 version 25H2 last month with one change that infuriated privacy-conscious users: the OOBE now hides the local account option even on Windows 11 Pro. The BYPASSNRO workaround still functions, but the registry key alone no longer reveals the offline account button—you must additionally unplug the Ethernet cable or disable Wi-Fi before starting setup. I spent the last week building a fully local, telemetry-lite Windows 11 machine from scratch. Here's exactly what worked, what broke, and which Microsoft hooks survived.

By late 2026, Windows 11 has absorbed concepts from Windows 365 and Copilot+. The operating system assumes a persistent Microsoft account, OneDrive folder backup, and BitLocker encryption from the moment the desktop appears. A clean, local-only install is still achievable, but the friction is intentional. Every major feature update since 22H2 has rolled out one more obstacle: mandatory network during Home edition setup, hidden offline account buttons, and now an MSA-prompt that cannot be dismissed in certain regions without a workaround.

The State of Windows 11 in 2026

Windows 11 version 25H2 (build 26100, October 2025) serves as the current production release, with the 26H1 Insider preview already in flight. New Copilot+ PCs ship with Pluton security processors that encrypt the OS drive with BitLocker by default, tying the recovery key to a Microsoft account unless you manually opt out during OOBE. Enterprise and Education SKUs retain full local account support, but Home and Pro have become hostile territory for offline enthusiasts.

Microsoft's telemetry architecture has also evolved. The "Required diagnostic data" baseline now captures app usage patterns, Edge browsing categories (not URLs), and input method statistics. Optional data sends nearly everything short of keystroke logging. Turning telemetry to "Security" (level 0) requires Group Policy or registry edits, and several Windows components—Widgets, Dev Home, and the new System Companion—refuse to run below level 1.

Pre-Installation Preparation

Before you even write the ISO to a USB stick, decide on two things: edition and network state. Windows 11 Pro remains the most flexible consumer SKU for local setup because it still responds to audit mode and unattended answer files. Windows 11 Home works only if you physically disconnect the network and use the OOBE\BYPASSNRO command before the region selection screen.

Download the latest ISO from Microsoft's official catalog (the Media Creation Tool now defaults to 25H2). Use Rufus 4.6 or newer to create the bootable USB. Rufus will offer to remove the requirement for an online Microsoft account, disable BitLocker automatic encryption, and skip privacy questions. Check those boxes—they write an autounattend.xml that automates the bypass steps.

If you prefer a manual approach, craft an answer file with Windows System Image Manager. The critical settings:

<component name="Microsoft-Windows-Shell-Setup">
  <OOBE>
    <HideEULAPage>true</HideEULAPage>
    <SkipMachineOOBE>true</SkipMachineOOBE>
    <SkipUserOOBE>true</SkipUserOOBE>
    <ProtectYourPC>3</ProtectYourPC>
  </OOBE>
  <UserAccounts>
    <LocalAccounts>
      <LocalAccount wcm:action="add">
        <Name>LocalAdmin</Name>
        <DisplayName>Local Admin</DisplayName>
        <Password>
          <Value>tempPassword123</Value>
        </Password>
      </LocalAccount>
    </LocalAccounts>
  </UserAccounts>
</component>

Place this file at the root of the USB drive. The installer will respect it, create the local account, and skip the network requirement—no BYPASSNRO trick needed.

For those who skip answer files, the manual route demands precise timing. Boot from the USB, proceed to the region screen, then press Shift+F10 to open Command Prompt. Type OOBE\BYPASSNRO and press Enter. The system will reboot. Immediately disconnect the network. If Ethernet is plugged in or Wi-Fi is enabled, the local account prompt will not appear.

After reboot, the OOBE restarts. You now see the classic "I don't have internet" link on the network selection page. Click it, confirm "Continue with limited setup," and then create a local username and password. Microsoft has relabeled this link to "Domain join instead" on Pro editions in some regions, but it behaves identically.

One new twist in 25H2: the privacy settings page now lists fourteen toggles, up from seven in 23H2. New additions include "Share app diagnostic data with publishers," "Allow desktop app analytics," and "Improve inking and typing recognition." I suggest turning off everything except "Location" if you actually need it. These settings only scratch the surface; deeper controls live in the Settings app and Group Policy.

Creating a Local Account and Securing It

The local account you create holds Administrator privileges by default, which is a security risk. After reaching the desktop, open Computer Management → Local Users and Groups → Users, create a second standard user account, and demote the original account to standard by removing it from the Administrators group. Enable the built-in Administrator account only for emergencies, and set a strong password.

BitLocker status warrants immediate attention. On any modern PC with TPM 2.0, Windows 11 Pro and Enterprise enable BitLocker automatically during setup if you sign in with a Microsoft account. Local installs may escape automatic encryption, but check Disk Management: if the C: drive shows "BitLocker encrypted" without your action, you decoupled yourself from the recovery key. Suspend BitLocker, then disable it entirely via Control Panel. Re-encrypt later with a local password if you desire, but store the recovery key offline.

Disabling Unnecessary Services and Scheduled Tasks

Windows 11 25H2 ships with 200+ services, many tied to Microsoft's cloud. The following can be safely disabled on a local-only machine:

  • Connected User Experiences and Telemetry (DiagTrack): Set to Disabled.
  • Microsoft Edge Update Service (edgeupdate, edgeupdatem): Disable both; use an offline installer for Chrome or Firefox later.
  • Windows Search: If you prefer a lightweight indexer like Everything, switch to Manual.
  • Xbox Live Auth Manager, Xbox Live Game Save, Xbox Live Networking Service: Set to Disabled unless you game with Xbox titles.
  • WalletService: Handles Microsoft Pay; useless locally.
  • SysMain (Superfetch): Disabling can improve responsiveness on SSDs.

Use services.msc or PowerShell. For scheduled tasks, open Task Scheduler Library → Microsoft → Windows and review folders like Application Experience, Customer Experience Improvement Program, DiskDiagnostic, and Windows Update. Disable tasks with "Consolidator," "Telemetry," "Sqm," and "Data Integrity Scan" in their names. Do not disable security or update-related tasks; target only those explicitly named for data collection.

Privacy Settings Deep Dive

Beyond the OOBE toggles, navigate to Settings → Privacy & security. In the General tab, turn off all four options: advertising ID, language list access, app launch tracking, and suggested content. Then visit every subcategory—Diagnostics & feedback, Activity history, Search permissions, Inking & typing, Voice activation, etc.—and disable everything not essential.

Diagnostics & feedback deserves a special callout. Set "Diagnostic data" to Required diagnostic data (the lowest visible in Settings). To achieve level 0 (Security), open Group Policy Editor (gpedit.msc) and navigate to Computer Configuration → Administrative Templates → Windows Components → Data Collection and Preview Builds. Enable "Configure telemetry opt-in setting user interface" and "Configure Authenticated Proxy usage for the Connected User Experience and Telemetry Service." Then set "Allow Telemetry" to 0. This disables all telemetry except for malware and security data required by Microsoft Defender.

Removing Pre-installed Bloat and Cloud Hooks

Even a fresh local install pulls placeholder apps from the Microsoft Store. TikTok, Instagram, Spotify, Disney+, and various "stubs" appear on the Start menu. Right-click uninstalls them, but they reappear after feature updates. A PowerShell one-liner removes all provisioned packages for the current user:

Get-AppxPackage -AllUsers | Where-Object {$_.Name -notmatch "WindowsStore|StorePurchase|Calculator|Camera|Photos|Notepad|Paint|Terminal|MicrosoftWindows.Client"} | Remove-AppxPackage -ErrorAction SilentlyContinue

Adjust the exclusion list to retain apps you want. For a more thorough cleanup, use Get-AppxProvisionedPackage -Online and pipe to Remove-AppxProvisionedPackage.

OneDrive is the most persistent cloud hook. If you signed out during OOBE, OneDrive won't sync, but its client remains. Uninstall it via Control Panel → Programs and Features. Next, open Registry Editor and delete HKEY_CURRENT_USER\Software\Microsoft\OneDrive and the OneDrive folder from the user profile. Windows 11 nags about "finish setting up OneDrive" in the notification center until you dismiss the offer permanently via Settings → System → Notifications → Additional settings → uncheck "Get tips, tricks, and suggestions as you use Windows."

BitLocker Considerations and Final Security Hardening

BitLocker remains a contentious topic. On a local-only machine, automatic encryption without a Microsoft account leaves you with a recovery key stored nowhere. If your TPM resets—after a firmware update, BIOS battery failure, or Secure Boot policy change—the system enters recovery mode and demands a key you never saved. Always verify BitLocker status via manage-bde -status. If the C: drive shows "Protection On" and "Key Protectors: TPM," suspend protection, decrypt the drive, and re-evaluate whether you need device encryption.

For those who want encryption without a Microsoft account, use the classic BitLocker Control Panel option. Choose "Enter a password" or "Use a startup key on a USB flash drive" and store the recovery key as a file on a separate, safe medium. Avoid printing it; paper gets lost. Consider storing it in an offline password manager.

Other hardening steps:
- Disable Windows Script Host via registry if you don't use .vbs or .js files.
- Turn off Remote Desktop and Remote Assistance.
- In Windows Security, under App & browser control, enable Reputation-based protection and block potentially unwanted apps.
- Review Firewall & network protection and disable inbound connections for public profiles.

Post-Installation Tweaks for a Calm Experience

A "calm" Windows means no pop-ups, no promotions, and no unsolicited Edge launches. Start by configuring Edge—even if you never plan to use it—because Windows uses Edge WebView2 for internal components. Open Edge, navigate to edge://settings/content, and block notifications, pop-ups, and ads globally. In edge://settings/privacy, turn off tracking prevention exceptions and "Save and fill payment info."

Next, apply a few registry tweaks to suppress common annoyances:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSyncProviderNotifications"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent]
"DisableSoftLanding"=dword:00000001
"DisableWindowsConsumerFeatures"=dword:00000001

These kill cloud-sourced suggestions in File Explorer and disable Microsoft's consumer feature promotions (games, Office 365 ads).

Finally, consider a third-party tool to maintain this state. O&O ShutUp10++ (updated for Windows 11 25H2) provides a curated list of privacy toggles. WPD (Windows Privacy Dashboard) can lock settings so feature updates don't revert them. But use these sparingly—they can break functionality if applied blindly.

What Remains Connected

Even after all this work, Windows 11 2026 is not fully offline. The OS phones home for certificate revocation lists, time synchronization, and Windows Update. Microsoft Defender receives definition updates regardless of telemetry level. The Microsoft Store auto-updates built-in apps unless you disable its service—but then Calculator, Notepad, and Photos stop receiving security patches. Strike a balance: leave Store auto-update on but disable its ability to run background tasks via Settings → Privacy & security → Background apps.

Cortana is dead, but Copilot now lives in the taskbar. On local accounts, Copilot still demands a Microsoft account, so it sits inert. You can hide it from Taskbar settings without registry edits. Widgets, however, pulls weather, traffic, and news from MSN even on a local profile. Open Widgets, click the profile icon, and turn off every interest. Then disable the Widgets entirely via gpedit.msc (Computer Configuration → Administrative Templates → Windows Components → Widgets → "Allow widgets" to Disabled).

The Microsoft Edge browser presents the final link. Even as a local user, sync features are dormant, but Edge preloads with Bing and MSN. In edge://settings/search, change the search engine to DuckDuckGo or Startpage. Remove MSN from the new tab page via an extension like "Blank New Tab Page." For the ultimate isolation, install Firefox or LibreWolf and set it as the default browser; Windows will complain once, then relent.

The Verdict

Building a Microsoft-minimized Windows 11 desktop in 2026 takes about an hour of deliberate post-install work, down from two hours in 2023 thanks to community tooling, but up in difficulty because Microsoft keeps moving the local account option behind conditional checks. The key insight: always prevent the network from being available during OOBE, even if you use an answer file. The moment Windows detects connectivity, provisioning frameworks light up and create background tasks that are painful to undo.

This setup won't activate Copilot+ features, won't sync settings across devices, and won't integrate with Phone Link. That's precisely the point. You end up with a fast, predictable operating system that treats you as the administrator, not the product. Until Microsoft makes a Microsoft account a mandatory sign-in for all editions—and rumors suggest that day is coming in Windows 12—the local path remains open. How long it stays walkable depends on how loudly power users push back.