Things you can do to clean up a fresh install of Windows 11 24H2 and Edge
arstechnica.com
arstechnica.com
If you have the stomach for this, you have the stomach for Ubuntu and a Looking Glass VM for whatever software won't run under wine (which is a lot).
Also those who are willing to go to great lengths tuning Windows should consider using Linux - not only it has more opportunities for "tuning", but as a bonus you'll be able to fix the errors in the source code.
blackbird -d = Enable/Disable Windows Defender.
blackbird -u = Enable/Disable auto-installation of Windows updates / Sets to manual download and install only.
blackbird -m = Enable/Disable auto-installation of Malicious Removal Tool updates.So as long as the base for Server is the same it should at least be theoretically possible to remove unwanted components without breaking things too badly. (of course non-Server editions could hardcode something that breaks when some component is not present but I assume this is not how Windows editions work?)
Not sure how Windows Update behaves if some expected component is removed; not having it working would be pretty bad.
I think the safest option is to not allow windows any network access. But that can be a pain in a dev vm, something like visual studio needs to talk with a trillion domains for installing. An MS does not provide static ip-lists for anything azure.
The whole Windows ecosystem experience is such a backwardness, each time I can shut down a win vm I feel relief.