Setting up a local resolver, such as a Pi-Hole or Unbound on a firewall can serve unencrypted responses to your devices. Those resolvers in turn can use DoT/DoH with their upstream resolvers to encrypt the requests that go through untrusted networks on the Internet.

This is the best of both worlds, the simplicity of unencrypted DNS while encrypting traffic where it matters.

> I have SMB multichannel enabled, but this real-world speed limitation could also be related to my use of my lower-power Arm NAS (running on Ampere Altra, with 32 fairly-slow CPU cores).

Based on my own testing with a 25 Gb NIC setup on macOS I strongly suspect the issue is not on the NAS side, and the hardware I was working with is by no means underpowered.

The Mac I was working with is one of those rack mount M2 Mac Pros with a 25 Gb PCI-e card. On the NAS side it was a several hundred terabyte all NVMe flash multi-node cluster, each node with Xeon CPUs and 2x 25 Gb bonded NICs. Doing some rough throughput testing from macOS over multi-channel SMB yields throughput rates that are barely faster than the built-in 10 Gb copper NICs on the Mac.

Using iperf I can confirm that I can get near enough to 25 Gb/s raw network throughput on the Mac. And other non-macOS systems see significantly faster throughput to the same NAS. I am not sure exactly what the issue is that causes 25 Gb NICs to underperform so significantly for file sharing tasks, but I am reasonably certain that the issue is in macOS.

I have two perspectives on this, as a user and as a Windows admin. And I apologize in advance that this turned into a bit of a rant.

As a user all these things are at best annoyances to work around and at worst borderline malicious. You can easily remove the ads in the Start menu, uninstall the built-in apps you don't need and turn off the things you don't want. Sure upgrading to Pro offers more options to turn off some (but not all) of the bloat in Windows. However a significant portion of the tweaks needed to turn things off either needs Pro to get access to local group policy or diving into the registry to adjust dozens of values, and this is not something I consider accessible by average users. And there are some things like the constant reminders to sign-in with a Microsoft account that cannot be disabled in any way. I am aware that there are de-bloat scripts which preform these actions automatically for the less technical users, but asking users to run random scripts as the first thing to do on a new system to fix issues sets a bad precedent and is not something that I think should be widely encouraged since that behavior can be easily exploited since the users that need those kinds of tools may not fully appreciate the consequences of their actions.

With regards to malicious behavior take OneDrive. By default OneDrive will start on login then prompt the user with a system notification to sign-in to OneDrive to backup their files and the only options it gives the user is to either say "Yes" or "Remind me later". The only options to stop this are either to uninstall OneDrive or apply a setting via GPO to stop OneDrive from generating network traffic until a user signs-in. And in the security center if you don't sign-in to OneDrive it will always display a warning that your files are not protected because you are not using OneDrive, and as far as I know there is no way to disable that on editions other than Enterprise even if you uninstall OneDrive. For the average user the easiest way to make these annoyances go away is to sign-in to OneDrive. I cannot tell you how many people have come to me complaining that they signed in to OneDrive and now all their files have disappeared because OneDrive moved everything to a different folder then removed all the local copies of files that had been synced to the cloud and because their computer was not connected to the Internet they could not access the files that now lived only in the cloud.

I think OneDrive is a prime example of the issues I have overall with Windows these days, it effectively gives the user as little agency as possible in using their system by constantly nagging them to enable things they may not want or even understand with the only options presented being to just do what it tells you.

As an admin I have a much poorer opinion of the work required to completely de-bloat a "clean" Windows install. In addition to all of the above let's consider the Start menu. In a Windows environment it is not practical to manually remove the offending shortcuts in the Start menu since those are set in each user profile and I am not going to follow every user around to manually clean up their Start menus every time they login to a new computer. Pro editions of Windows 11 actually do have the ability to customize what shortcuts appear in the Start menu by default for new user accounts and this does allow for removing the ads. However that particular Start menu layout policy can only be set by an MDM, it seems Microsoft has made the decision to not provide a group policy option for applying a Start menu layout in Windows 11 like they did with Windows 10. This means if you are exclusively managing Windows with an on-prem Active Directory you can't remove the ads from the Start menu using a managed policy.

You can upgrade to Enterprise which does have a simple option to turn off all the consumer features, however I know of exactly zero businesses that will pay the significant extra for Enterprise just to disable these annoyances that everyone is already used to.

Microsoft has turned Windows into a tool that does everything in its power funnel users to Microsoft cloud services. The user experience is being actively degraded with all the nagging and forced usage of their services such that the path of least resistance to get rid of all that is to give up and just sign-in with a cloud account. Now to be clear, I don't have a problem with Microsoft offering these services and I can see how they can be useful things for some people, the problem I have is the way they are going about it.

It is great that we have so many people working to make sure we can de-bloat Windows and turn it back into a usable platform for those of us who don't want any of these forced features. But at the end of the day this is software that we are paying for that does not respect its users.