Digital Hygiene in the Age of Adware V: Windows 11 Without a Microsoft Account and Without Bloat via Rufus

26. 10. 2026| PhDr. Petr Dubský

You buy a computer, switch it on, and the first thing Windows 11 wants from you is a Microsoft account. Not a password for the computer, not a user name, but an online account through which Microsoft connects your PC to OneDrive, Microsoft 365, Copilot and an advertising profile. Then comes a series of screens where the system “recommends” that you share diagnostic data, your location and your activity history.

A year ago you could get around all of this with a single command. Not any more. Microsoft has gradually closed every known back door, and a local account is becoming harder and harder for ordinary users to reach.

There is, however, a route that still works and is also the cleanest: prepare your installation USB drive so that Windows installs according to your rules from the start. That is what the free open-source tool Rufus is for.

What Microsoft has closed

For a long time there was a simple trick. On the country selection screen you pressed Shift+F10, typed OOBE\BYPASSNRO, disconnected from the internet, and Windows let you create a local account. Later came the command start ms-cxh:localonly, which opened the local account form directly.

Microsoft has blocked both methods step by step:

When	What Microsoft closed
early 2025	the `OOBE\BYPASSNRO` script in Windows Insider test builds
October 2025	the BypassNRO registry value, `start ms-cxh:localonly`, entering a fake e-mail and other OOBE tricks (Windows Latest)

Microsoft’s official explanation reads: “We are removing known mechanisms for creating a local account in the Windows Setup experience (OOBE)” (Windows Central). The company says these methods led to devices that were not “fully configured”. Translated into plain language: not connected to a Microsoft account.

Now and then a new loophole appears, such as the “Learn more” link on the sign-in screen, which in some versions of Windows 11 Home leads to a local account. But you cannot rely on tricks like that. They work only in certain builds, and Microsoft closes them as soon as it hears about them.

What cannot be closed is unattended installation. Windows can read a so-called answer file that tells the installer in advance which account to create and what not to ask. Companies use this feature for mass deployment, so Microsoft cannot remove it. And that is exactly what Rufus builds on.

Rufus: what it can do in 2026

Rufus is a small program (about 1.5 MB, no installation needed) that creates bootable USB drives. The current version is 4.15, released on 19 June 2026 (FossHub). When you load a Windows 11 installation ISO into it, it shows a dialog with options to customise the installation. Rufus then writes them into an answer file on the USB drive.

Option	What it does
Remove requirement for 4GB+ RAM, Secure Boot and TPM 2.0	allows installation on older hardware too
Remove requirement for an online Microsoft account	setup does not ask for a Microsoft account
Create a local account with username	the local account is created automatically
Set regional options to the same values as this user’s	copies language, keyboard and time zone from the PC on which you create the drive
Disable data collection (skip privacy questions)	answers “no” to every question about telemetry, location and advertising
Disable BitLocker automatic device encryption	prevents the disk from being encrypted silently
Disable Teams, Outlook, Copilot and other forced apps (since version 4.14)	setup skips Microsoft’s pushy offers
Silent installation (since version 4.14)	installs Windows on the first disk found without asking anything

The exact wording of the options varies slightly between versions. Version 4.15 also fixed a bug that caused the first option to always be ticked automatically, and improved OneDrive removal (Neowin).

The option to remove Teams, Outlook and Copilot is a major addition. It arrived at a time when Microsoft is pushing Copilot into every corner of the system. The author of Rufus described it in the changelog as protection against Microsoft’s “forced nuisances”.

Step-by-step guide

You will need a USB drive of at least 8 GB. Rufus will erase it completely, so copy anything important off it first. Before installing, also back up the data on the computer you are going to install on.

1. Download Rufus and the ISO

Download Rufus from the official website rufus.ie. The portable version is enough.
Download the Windows 11 installation ISO from Microsoft’s website. Alternatively, Rufus can download it directly: the arrow next to the SELECT button switches it to DOWNLOAD.

2. Create the USB drive

Launch Rufus and choose your USB drive in the Device field.
Click SELECT and choose the downloaded ISO.
Leave the partition scheme on GPT and the target system on UEFI. That is right for computers from the last ten years.
Click START. The customisation dialog appears.
Tick removal of the Microsoft account requirement, creation of a local account (fill in a name), regional options, disabling data collection and disabling Teams, Outlook and Copilot.
Decide on the BitLocker option according to the risks section below.
Tick removal of the TPM and Secure Boot requirement only if your computer is not officially supported by Windows 11.
Leave silent installation off unless you know exactly what you are doing. It installs Windows on the first disk it finds without asking. If your computer has more than one disk, it may overwrite the wrong one (How-To Geek).
Confirm with OK and accept the warning about erasing the drive. Writing takes a few minutes.

3. Install Windows

Boot from the USB drive. Usually you just press F12, F11, F8 or Esc repeatedly after switching the computer on, depending on the motherboard manufacturer.
Go through the standard installation: choose the edition and the disk, and let Windows install.
After the restart, the first-run wizard asks neither for a Microsoft account nor about privacy. You end up straight on the desktop under a local account.
Rufus creates the local account with an empty password and usually prompts you to change it at the first sign-in. Set a password in any case, even if the computer is yours alone (Settings → Accounts → Sign-in options).

After installation: finish the job

Rufus removes the biggest nuisances during installation, but some settings can only be changed in the finished system. Go through these points:

Settings → Privacy & security → General: turn off the advertising ID, personalised content and app launch tracking.
Settings → Privacy & security → Diagnostics & feedback: turn off sending optional diagnostic data and tailored experiences. Mandatory basic telemetry cannot be turned off; only the Enterprise edition can do that.
Settings → Personalisation → Start: turn off recommendations for tips, shortcuts and new apps.
Settings → Personalisation → Lock screen: turn off “fun facts and tips”.
Settings → System → Notifications → Additional settings: clear the suggestions to finish setting up your device. We covered this full-screen pressure in the second part of the series.

You can uninstall the remaining preinstalled apps via Settings → Apps, or in bulk in PowerShell with winget:

winget list
winget uninstall --name "App name"

For more detailed telemetry control, the free tool O&O ShutUp10++ is useful: it explains every setting and lets you revert it. Use only the recommended options. More aggressive changes can break updates.

What comes back

Expect large feature updates (for example moving to version 25H2 or later) to revert some settings and sometimes bring new apps. After each such update it is worth going through the list above again. Microsoft is playing a long game here: whatever it cannot push through at installation, it will try again a year later via Windows Update.

Risks and limitations

BitLocker: don’t just turn it off and forget

Since version 24H2, Windows 11 encrypts the disk automatically, even in the Home edition. The recovery key is saved to the Microsoft account. Without a Microsoft account you risk the situation we described in the article about the “Pre-crypted” state: the disk is encrypted but you have no key, or conversely it is not protected at all even though you think it is.

You have two sensible options:

Turn automatic encryption off in Rufus and, on the Pro edition, enable BitLocker manually after installation. Save the recovery key to a USB drive or print it.
Leave encryption on and display and save the recovery key immediately after installation (PowerShell as administrator):

manage-bde -status C:
manage-bde -protectors -get C:

Do not take the “I’ll turn it off and never think about it again” route. On a laptop that may get stolen, an unencrypted disk is an open book.

Unsupported hardware

Removing the TPM 2.0 and Secure Boot requirement brings older computers back into play. However, Microsoft does not guarantee updates for unsupported PCs, and major feature updates may fail on them. For an older machine, Linux is often a better choice than forcing Windows 11 onto it.

New Secure Boot certificates

Microsoft is replacing the old Secure Boot certificates from 2011 with new ones from 2023. If your USB drive refuses to boot on a brand-new computer, use a Windows 11 25H2 ISO and the Rufus option for Windows CA 2023 compatible media, added in version 4.10 (FossHub).

Activation and the account

A local account does not affect Windows activation. The digital licence is tied to the hardware, not to the account. You can later connect a Microsoft account to individual apps only (Store, OneDrive) without replacing your local sign-in.

Meanwhile, on Linux

It is worth pausing on how absurd the whole procedure is. To install a system you paid for on your own computer, without an account with its maker and without ads, you need a third-party tool, an answer file meant for corporate deployment, and a list of settings you will have to go through again after every major update.

Installing Linux Mint or Fedora does not ask for any online account. There is no advertising ID, no Copilot in the Start menu and no update that quietly brings back apps you uninstalled. Disk encryption (LUKS) is a single checkbox in the installer, and only you know the password. And by the way, the USB drive for installing Linux can be created with the very same Rufus. I explained why moving to Linux is a sensible step in the first part of this series.

Conclusion

Microsoft has closed every convenient path to a local account and will close more as soon as someone finds them. The Rufus and answer-file route still works, though, because it relies on the same feature companies depend on. The result is a clean Windows 11 with a local account, no telemetry questions and no Teams, Outlook or Copilot.

It is the best Windows installation an ordinary user can have today. And at the same time it is telling evidence of how far Microsoft has gone: a clean system without ads is no longer the default, but the result of a workaround.