No they aren't, but neither are they all-seeing and knowing.
The best course of action to mitigate this would be to install Win 11 LTSC and then add in the stuff that's missing. I did some research:
- In 2026, it is easier to add back in the missing DirectX End-User Runtimes and the Visual C++ All-in-One redistributables than it used to be.
Apps like 3ds Max and ZBrush primarily need the C++ 2015-2022 Redistributables (both x86 and x64) and DirectX 9/10/11 legacy DLLs. You can download a single "All-in-One" installer from community sources (like TechPowerUp or GitHub), that reinstalls them.
As for proprietary drivers, your Wacom and 3Dconnexion drivers will work fine on LTSC because the underlying architecture is identical to Pro.
Once you install your missing libraries, they will stay there, because LTSC only receives security patches and not feature updates.
- Even with LTSC, it would be a very good idea to get a hardware firewall (pfSense/OPNsense are good - $200 to $300). Because even a "zero" level of telemetry is not silence. It will activate to verify your hardware/firmware hasn't been tampered with (tpm 2.0, secure boot, etc.) Also, it pings ms to check policy status and certificate revocation lists and arcana like that. Your machine has a fingerprint bound to something called your TPM endorsement key, which a hardware firewall can block. If it tries to leave via their high traffic node (13.107.4.52), the hardware firewall kills it. It can do this because by definition a hardware firewall is completely outside the "circle of trust" of the os.
The only way Microsoft gets around a hardware firewall is via Encrypted DNS (DoH) and SNI (Server Name Indication). If Windows hides the destination of its traffic inside an encrypted HTTPS tunnel to a generic Microsoft server (like outlook.com), the firewall might struggle to tell "telemetry" apart from "legitimate mail." What to do? Here's what I found: ***
BTW, in seeking a copy of Windows 11 IoT LTSC, avoid the "N" version (the European version). It is missing a great deal (media feature pack, codecs, DirectX runtimes, etc.)
From Google Gemini search:
- Block DoH
Windows 11 tries to use DoH to bypass your local DNS filters. If it can't resolve the "bad" domains through your firewall, it will try to ask Google (8.8.8.8) or Cloudflare (1.1.1.1) directly over port 443.
The Fix: On your hardware firewall (pfSense/OPNsense), use a DoH Blocklist (like those from Hagezi). This is an alias of known IP addresses for encrypted DNS providers.
The Rule: Any traffic from your Windows machine trying to reach these specific IPs on Port 443 is blocked. This forces Windows to "fall back" to your local, unencrypted DNS, where you can see exactly what it’s asking for and block it.
- Defeat SNI via "Force-Routing"
SNI (Server Name Indication) is part of the TLS handshake that tells the server which website you're visiting. Microsoft uses "Domain Fronting" to make telemetry look like legitimate traffic.
The Fix: Instead of trying to "read" the SNI, you Block by Destination IP Range (ASN).
As we discussed, if you block AS8068 (Microsoft's main block), it doesn't matter what the SNI says. Whether the packet says "I'm an email" or "I'm telemetry," the firewall sees it's headed for a Microsoft data center and drops it.
For your 3D work: You only whitelist the specific, tiny IP ranges or domains required for your licenses (e.g., *.autodesk.com).
- The "IoT LTSC" Advantage
This is why the IoT version is so important for you.
In Windows 11 Pro: The OS is constantly fighting to turn DoH back on.
In IoT LTSC: You can use Group Policy (gpedit.msc) to set "Configure DNS over HTTPS (DoH) name resolution" to Disabled. Because it's LTSC, the OS will actually obey this setting. Once disabled, Windows stops trying to "hide" its DNS requests, making your hardware firewall's job 100% easier.
- The "Local Account" Registry Kill
Since you mentioned the local account bypass was removed, in LTSC you simply:
Install the OS while disconnected from the internet.
Set up your local account.
Apply your "Disable DoH" and "Disable Telemetry" group policies.
Only then connect to your hardware firewall.
(P.S. I use a hardware firewall. I got one on the advice of a friend, as a way to maintain security since I choose to use an unsupported operating system - Zorin 16.)
