Rebuilding a Studio PC on Windows 11 IoT LTSC

Why we do this at all

We run about ten PCs across the studios and the workshop. Every one of them eventually needs a fresh start — a failing disk, a new user, a machine that has silently rotted after two years of installs. Reinstalling Windows by hand is a slow, error-prone afternoon that nobody remembers the details of the next time it happens.

This document is the antidote: a written, repeatable way to wipe a studio PC and bring it back on a clean, stripped-down Windows, with that machine's own drivers restored, our standard software installed, and the same admin account on every box. The goal is that any of us can do it — following this page and a USB stick — and get an identical result whether it is the shared render machine or the laser-cutter PC.

We install Windows 11 IoT Enterprise LTSC 2024 rather than ordinary Windows 11 on purpose. LTSC is the "Long-Term Servicing Channel" build Microsoft ships for machines that should just work for years: no Store, no Copilot, no Cortana, none of the consumer bloat that gets reinstalled every feature update. It is the same Windows underneath, with the noise removed — which is exactly what a working studio machine wants. The IoT variant adds one more thing we care about: ten years of security updates instead of five.

The edition trick that makes it work

There is one piece of licensing sleight-of-hand at the centre of this whole process, and it is worth understanding before anything else, because it is what lets us keep the setup simple.

The Windows ISO on our server is Enterprise LTSC 2024 — not IoT. The two are, for our purposes, the same debloated Windows; they differ mainly in how they are licensed and how long they are supported. The keys we buy, however, are IoT Enterprise LTSC 2024 keys (they are cheap and legitimate through the IoT channel — around €16 each from ProductCodes.de). So there is an apparent mismatch: our media installs one edition, our licence is for another.

The resolution is documented by Microsoft itself: installing a purchased IoT Enterprise LTSC key with slmgr /ipk does two jobs in a single step — it flips the edition from Enterprise LTSC to IoT Enterprise LTSC and activates it, without a reinstall and without touching any files. In other words, the "IoT" part is not something we install. It is something the key switches on after the fact.

"We don't install IoT. We install plain Enterprise LTSC, and the licence key turns it into activated IoT on first logon."

That single fact is why the install itself can be dumb and uniform. The stick always lays down the same Enterprise LTSC image; the machine only becomes a licensed IoT box the moment someone types (or drops in) the key. One consequence worth remembering: each key is single-use — one key activates exactly one PC — so buy one per machine, and the machine needs to be online for the activation step to reach Microsoft.

The kit: three stages, one folder

Everything lives in one place on the server: 5_BIBLIOTHEK\13_Software\windows\JHH-Deploy\. That folder is also what we copy onto the USB stick. The whole process is three stages, and each stage is one script or one file doing one job.

Read left to right, that is the entire mental model. Stage 1 runs on the machine before we wipe it and captures the one thing a fresh install can't recreate on its own: that specific machine's drivers. Stage 2 is the stick — boot from it and it lays down a clean Windows with no questions (or one, if we choose the safer variant). Stage 3 runs by itself the first time the fresh machine logs in, and does all the tedious setup we would otherwise click through by hand.

The reason drivers get their own stage is that they are the part a clean install genuinely can't guarantee. Windows ships generic drivers, but the exact network, chipset, GPU and peripheral drivers a given studio machine needs are already sitting on that machine right now. It is far more reliable to export them before the wipe than to hunt them down afterwards on a box whose network card might not even work yet.

Building the stick (once)

This is a one-time job per stick. Once a stick is built you reuse it for every machine; only the per-PC driver folders and the licence key change.

1. In Rufus (on the server under 13_Software\windows\), select the ISO en-us_windows_11_enterprise_ltsc_2024_x64_dvd_965cfb00.iso, choose GPT / UEFI, and start.
2. When Rufus offers its "Windows User Experience" customisation dialog, untick everything. If you let Rufus write its own answer file, it will fight ours.
3. Copy onto the root of the finished stick: your chosen answer file (renamed to autounattend.xml — see below), and the whole JHH-Deploy\ folder.

There are two answer files in the kit, and picking between them is the only real decision. They install identically; they differ only in whether the wipe is gated by a prompt.

Whichever you pick, copy it to the stick root renamed to autounattend.xml (Windows Setup only looks for that exact name). For the CONFIRM variant, also copy pe.cmd and diskpart.txt to the root. Nothing else needs editing: the admin account and password are already baked in, and the licence key is entered later, per machine.

Resetting a machine, step by step

This is the part you follow on the day. It assumes the stick is built and you have a licence key for the machine.

Stage 1 — Back up the machine (before you wipe it)

On the machine you are about to wipe, run Run-Backup.bat from the stick or server. It asks for admin rights (say yes) and exports every third-party driver plus a full hardware, software and licence inventory into Drivers\<PCNAME>_<make>-<model>_<date>\. Read the yellow warnings before continuing — in particular, if it warns about BitLocker, stop and make sure data is backed up and the recovery key saved, because a wipe is irreversible. Our real work lives on Dropbox and the server, so a driver-and-inventory backup is normally enough; for a machine with important local-only data, make a full Casper clone first (that is still a manual step).

Stage 2 — Wipe and install

Plug in the stick and boot the machine from it (the boot menu is usually F12, F8 or Del). With the AUTO file it simply runs; with the CONFIRM file, check the disk list it prints and press Y. Roughly ten to fifteen minutes later the machine reboots itself and lands on the desktop, logged in as the built-in Administrator. What happens between those two moments is Figure 2.

Two boxes are highlighted because they are the two that carry the risk and the work. The confirmation gate (step 2) is the only chance to catch a wrong-disk mistake. And Setup-JHH.ps1 (step 7) is the workhorse — everything that used to be a manual afternoon is compressed into that one script.

Stage 3 — First logon (automatic)

You do not start anything here; Setup-JHH.ps1 launches itself. It works through the following, reporting OK or FAIL for each and never stopping on a single failure:

1. Pick the machine. It lists the driver folders under Drivers\ and asks which PC this is, then confirms the computer name (suggested from the folder — follow our Stu2-PC-Shared naming, max 15 characters).
2. Reinstall drivers with pnputil from that machine's backed-up driver folder.
3. Activate. If ProductKey.txt is on the stick it runs the key; otherwise it prints how to enter one by hand. Either way, installing the key flips the edition to IoT and activates. The key is never printed in full — it is masked in every log.
4. Install our apps via winget: Brave, 7-Zip, VLC, Dropbox, 1Password, Parsec, QuickLook, Everything, Notion.
5. Apply tweaks — show file extensions, left-aligned taskbar, no Bing or Copilot in search, Remote Desktop on, never sleep on mains power, timezone, a "JHH fresh install" restore point, and a security scrub of the cached password.
6. Rename the account from the built-in Administrator to JHH-Administrator, and write a report plus a paste-ready Notion logbook entry to C:\JHH-Deploy\.
7. Offer to restart. Say yes.

Stage 4 — Finish

After the reboot: confirm the machine reads IoT Enterprise LTSC and activated (slmgr /xpr, or Settings → Activation). Set Brave as the default browser by hand — Windows 11 blocks scripts from doing this silently, so it is a two-click job in Settings → Default apps. Log in as JHH-Administrator / neverforget. Finally, paste the logbook snippet into the machine's page in the Notion Computers database and update its 1Password entry — every PC lives in both.

Safety rails and the awkward cases

A process that wipes disks has to be honest about how it can go wrong. These are the failure modes we have already accounted for, and the handful that still need a human.

The wrong disk. Both answer files target Disk 0. On almost every machine that is the internal system SSD, but on some firmware a plugged-in data drive can enumerate as Disk 0. If a machine has a second drive you want to keep, either unplug it before you image, or use the CONFIRM variant, which prints the disk list so you can check the size before pressing Y. This is the one mistake the kit cannot undo for you.

Encrypted disks. The backup script warns loudly if BitLocker is on. Wiping an encrypted volume without its recovery key is unrecoverable — treat that warning as a hard stop.

Activation. Each key is one machine, and the activation step needs internet. If a key ever refuses, the usual cause is an evaluation build rather than the full LTSC — ours is the full volume-licence ISO, so this should not arise, but the script checks and says so.

winget missing. LTSC ships without the Microsoft Store, so winget is not present out of the box. Setup-JHH.ps1 repairs it automatically before installing anything; if a repair round fails, the script is safe to simply re-run.

A stuck "connect to a network" screen. Rare on LTSC with our provisioned admin, but if it appears, press Shift+F10, type oobe\bypassnro, and it reboots into an offline path.

The cleartext password. Our standard admin password sits in plain text inside the two answer files, because that is simply how Windows answer files carry credentials. That is fine for an office-internal stick — but it is the reason not to hand the stick to anyone outside the studio, and the reason Setup-JHH.ps1 deletes the cached copy from the installed machine at the end.

Why this matters

The point of writing all this down is not the scripts — it is that rebuilding a studio machine stops being a thing only one person half-remembers how to do. It becomes a checklist anyone can follow, that produces the same clean, activated, driver-complete, identically-configured machine every time, whether it is done today or in two years.

That is worth more than the afternoon it saves. A machine that was reset from this kit is a known quantity: we know exactly what is on it, what account runs it, where its drivers came from, and where its licence went — all of it captured in the inventory and the Notion logbook as a side effect of the process. The debloated IoT LTSC base means it stays that known quantity for years instead of drifting. When the next disk fails or the next person joins, we are not starting from a blank afternoon and a vague memory. We are starting from here.

Glossary

Terms and names used above, in plain language.

LTSC

Long-Term Servicing Channel. A Windows build with no Store, Copilot or consumer apps, supported for years without feature-update churn. What we install on studio PCs.

IoT Enterprise LTSC

The same LTSC Windows, licensed through Microsoft's IoT channel — cheaper keys and ten years of updates. Our purchased edition.

Enterprise LTSC

The edition our ISO actually installs. A licence key converts it to IoT; the two are otherwise the same Windows.

autounattend.xml

The "answer file" Windows Setup reads from the USB root to install with no questions — locale, disk layout, admin account, and the first-logon hook.

WinPE

Windows Preinstallation Environment. The minimal Windows that runs off the stick to wipe the disk and lay down the image, before the real install boots.

GVLK

Generic Volume License Key. A public Microsoft key that only selects an edition (it does not activate). We use it so the install never stops to ask for a key.

slmgr /ipk

The command that installs a product key. For an IoT LTSC key it also flips the edition — the trick at the centre of this process.

pnputil

The built-in Windows tool that installs the driver packages we exported before the wipe.

winget

Windows' command-line app installer. Absent on LTSC by default; Setup-JHH.ps1 installs it, then uses it for our app list.

Compact OS

An install option that keeps the Windows files compressed, saving disk space — useful on smaller SSDs.

OA3 key

An OEM Windows key baked into a PC's firmware at the factory. The inventory records it; it is irrelevant once we move to our own IoT key.

Casper

The imaging tool we use for a full bootable clone of a disk — the heavier, manual backup for machines with local-only data.