---
name: windows-iso-download
description: Download official Windows ISOs from Microsoft on a Linux server — navigating Microsoft's JS-generated download links, static CDN patterns, and third-party link aggregators like massgrave.dev.
version: 1.0.0
platforms: [linux]
metadata:
  hermes:
    tags: [windows, iso, download, microsoft, vm, bootable-media]
---

# Windows ISO Download (Linux)

Microsoft's official download page (`microsoft.com/software-download/windows11`) generates ISO links dynamically via JavaScript with time-limited tokens (24h expiry). Direct `curl`/`wget` extraction from the page source is not possible — the links are not embedded in the HTML. This skill covers the practical workarounds.

## Method 1: Microsoft Static CDN (Direct Download, Older Builds)

Microsoft publishes GA (General Availability) ISO builds to a static CDN that does NOT require authentication tokens:

```
https://software-static.download.prss.microsoft.com/dbazure/{UUID}/{build_string}_CLIENT_CONSUMER_x64FRE_{lang}.iso
```

These are the initial GA release builds, not the latest monthly refreshes. After installation, Windows Update brings the system fully current.

**Known working link (Windows 11 25H2, English x64, Sep 2025 GA):**
```
https://software-static.download.prss.microsoft.com/dbazure/888969d5-f34g-4e03-ac9d-1f9786c66749/26200.6584.250915-1905.25h2_ge_release_svc_refresh_CLIENT_CONSUMER_x64FRE_en-us.iso
```

**Download command:**
```bash
wget -O Win11.iso \
  --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" \
  --referer="https://www.microsoft.com/en-us/software-download/windows11" \
  "https://software-static.download.prss.microsoft.com/dbazure/888969d5-f34g-4e03-ac9d-1f9786c66749/26200.6584.250915-1905.25h2_ge_release_svc_refresh_CLIENT_CONSUMER_x64FRE_en-us.iso"
```

**Key points:**
- User-Agent MUST claim to be Windows to avoid 403
- Referer MUST be the Microsoft download page
- The `{lang}` code: `en-us` = English (US), `en-gb` = English (UK), `ar-sa` = Arabic, etc.
- Consumer ISO includes Home, Pro, Education editions

### Available Languages

The static CDN hosts ISOs for all 38 languages. Replace the language code in the URL:
- English (US): `en-us`
- English (UK): `en-gb`
- Spanish: `es-es`
- French: `fr-fr`
- German: `de-de`
- Japanese: `ja-jp`
- Chinese Simplified: `zh-cn`
- Chinese Traditional: `zh-tw`
- (Full list on massgrave.dev)

## Method 2: massgrave.dev (Latest Builds, Indirect)

[MAS (Microsoft Activation Scripts)](https://massgrave.dev/windows_11_links) maintains a list of verified ISO download links:

1. **Latest builds** (e.g., May 2026 monthly refresh) — linked via `zerofs.link` URL shortener. These require solving a Cloudflare Turnstile CAPTCHA before the real download URL is revealed. **Cannot be automated from a headless server.**
2. **GA builds** — linked to the same `software-static.download.prss.microsoft.com` CDN as Method 1, in a clearly labeled table by language.

**To find the latest static links:**
```bash
curl -sL -A "Mozilla/5.0" "https://massgrave.dev/windows_11_links" | \
  grep -oP 'software-static\.download\.prss\.microsoft\.com[^"\s<>]*en-us[^"\s<>]*\.iso'
```

## Method 3: Microsoft Q&A (Fresh Tokens, Manual)

Microsoft support staff on [learn.microsoft.com/answers](https://learn.microsoft.com/en-us/answers/) can generate fresh 24h download links on request. Search for recent questions tagged `windows-11` asking for ISO links. The links look like:
```
https://software.download.prss.microsoft.com/dbazure/Win11_25H2_English_x64.iso?t={token}&P1=...&P2=...
```
These are time-limited and expire after 24 hours.

## Pitfalls

- **`software.download` ≠ `software-static.download`:** The non-static domain (`software.download.prss.microsoft.com`) requires time-limited tokens (the `?t=` parameter) and returns HTTP 403 without one. Always prefer `software-static` when available.
- **Wrong User-Agent returns 403:** Microsoft's CDN checks the User-Agent header. Linux-based UAs get "unexpected URL format" errors. Always use a Windows UA string.
- **The download page's "Disk Image (ISO)" section only appears for non-Windows browsers:** If you're testing from a Windows machine, you'll see the Media Creation Tool instead. Use a Linux or macOS User-Agent to get the ISO dropdown.
- **zerofs.link requires a browser:** It uses Cloudflare Turnstile (CAPTCHA). Don't try to curl it — use Method 1 or 3 for programmatic access.
- **Latest ≠ latest:** The "latest" monthly refresh is only available via time-limited tokens (Method 3) or CAPTCHA-gated links (Method 2). The static CDN (Method 1) carries only GA releases. For most purposes (VM setup, bare-metal install), the GA build is fine — Windows Update handles the rest.