From 792ff0d7ec78d04fc74926032ed11f04849fd2b9 Mon Sep 17 00:00:00 2001 From: Kroese Date: Mon, 14 Sep 2026 05:19:46 +0200 Subject: [PATCH] feat: Install VMWare driver during unattended setup (#2221) --- Dockerfile | 7 +- assets/win10x64-enterprise.cmd | 60 +- assets/win10x64-enterprise.xml | 102 +-- assets/win10x64-iot.cmd | 60 +- assets/win10x64-iot.xml | 102 +-- assets/win10x64-ltsc.cmd | 60 +- assets/win10x64-ltsc.xml | 102 +-- assets/win10x64.cmd | 59 +- assets/win10x64.xml | 102 +-- assets/win11x64-enterprise.cmd | 73 +- assets/win11x64-enterprise.xml | 102 +-- assets/win11x64-iot.cmd | 73 +- assets/win11x64-iot.xml | 102 +-- assets/win11x64-ltsc.cmd | 73 +- assets/win11x64-ltsc.xml | 102 +-- assets/win11x64.cmd | 73 +- assets/win11x64.xml | 102 +-- assets/win2008r2.cmd | 26 +- assets/win2008r2.xml | 11 +- assets/win2012r2.cmd | 29 +- assets/win2012r2.xml | 6 +- assets/win2016.cmd | 29 +- assets/win2016.xml | 6 +- assets/win2019-hv.cmd | 33 +- assets/win2019-hv.xml | 11 +- assets/win2019.cmd | 35 +- assets/win2019.xml | 6 +- assets/win2022.cmd | 35 +- assets/win2022.xml | 6 +- assets/win2025.cmd | 61 +- assets/win2025.xml | 6 +- assets/win7x64-enterprise.cmd | 27 +- assets/win7x64-enterprise.xml | 11 +- assets/win7x64-ultimate.cmd | 27 +- assets/win7x64-ultimate.xml | 11 +- assets/win7x64.cmd | 27 +- assets/win7x64.xml | 11 +- assets/win7x86-enterprise.cmd | 30 +- assets/win7x86-enterprise.xml | 11 +- assets/win7x86-ultimate.cmd | 27 +- assets/win7x86-ultimate.xml | 11 +- assets/win7x86.cmd | 27 +- assets/win7x86.xml | 11 +- assets/win81x64-enterprise.cmd | 29 +- assets/win81x64-enterprise.xml | 6 +- assets/win81x64.cmd | 29 +- assets/win81x64.xml | 8 +- assets/winvistax64-enterprise.cmd | 27 +- assets/winvistax64-enterprise.xml | 11 +- assets/winvistax64-ultimate.cmd | 27 +- assets/winvistax64-ultimate.xml | 11 +- assets/winvistax64.cmd | 27 +- assets/winvistax64.xml | 11 +- assets/winvistax86-enterprise.cmd | 27 +- assets/winvistax86-enterprise.xml | 11 +- assets/winvistax86-ultimate.cmd | 27 +- assets/winvistax86-ultimate.xml | 11 +- assets/winvistax86.cmd | 27 +- assets/winvistax86.xml | 11 +- docs/environment.md | 2 +- src/answer.sh | 94 +-- src/batch.sh | 166 ++--- src/display.sh | 1106 +++++++++++++++++++++++++++++ src/install.sh | 17 +- src/legacy.sh | 25 +- src/sif.sh | 10 +- 66 files changed, 2523 insertions(+), 1082 deletions(-) create mode 100644 src/display.sh diff --git a/Dockerfile b/Dockerfile index 8107a204..7526863d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -38,6 +38,11 @@ RUN <nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -51,7 +101,13 @@ rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -78,7 +134,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win10x64-enterprise.xml b/assets/win10x64-enterprise.xml index 498f9055..ce7d0053 100644 --- a/assets/win10x64-enterprise.xml +++ b/assets/win10x64-enterprise.xml @@ -150,104 +150,8 @@ 1 - reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f - - - 2 - reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT" - - - 3 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f - - - 4 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f - - - 5 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 6 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 7 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f - - - 8 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 9 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f - - - 10 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f - - - 11 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f - - - 12 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f - - - 13 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f - - - 14 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f - - - 15 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f - - - 16 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f - - - 17 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f - - - 18 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f - - - 19 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f - - - 20 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f - - - 21 - reg.exe unload "HKU\mount" - - - 22 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f - - - 23 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f - - - 24 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f - - - 25 - reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f - Set Network Location to Home + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script @@ -323,7 +227,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win10x64-iot.cmd b/assets/win10x64-iot.cmd index 100e93f5..8f8e437d 100644 --- a/assets/win10x64-iot.cmd +++ b/assets/win10x64-iot.cmd @@ -8,13 +8,63 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f +reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT" +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f +reg.exe unload "HKU\mount" +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f + +rem Set Network Location to Home +reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -51,7 +101,13 @@ rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -78,7 +134,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win10x64-iot.xml b/assets/win10x64-iot.xml index 583eefcc..6f42ca22 100644 --- a/assets/win10x64-iot.xml +++ b/assets/win10x64-iot.xml @@ -156,104 +156,8 @@ 1 - reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f - - - 2 - reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT" - - - 3 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f - - - 4 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f - - - 5 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 6 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 7 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f - - - 8 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 9 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f - - - 10 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f - - - 11 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f - - - 12 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f - - - 13 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f - - - 14 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f - - - 15 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f - - - 16 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f - - - 17 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f - - - 18 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f - - - 19 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f - - - 20 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f - - - 21 - reg.exe unload "HKU\mount" - - - 22 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f - - - 23 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f - - - 24 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f - - - 25 - reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f - Set Network Location to Home + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script @@ -329,7 +233,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win10x64-ltsc.cmd b/assets/win10x64-ltsc.cmd index 100e93f5..8f8e437d 100644 --- a/assets/win10x64-ltsc.cmd +++ b/assets/win10x64-ltsc.cmd @@ -8,13 +8,63 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f +reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT" +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f +reg.exe unload "HKU\mount" +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f + +rem Set Network Location to Home +reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -51,7 +101,13 @@ rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -78,7 +134,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win10x64-ltsc.xml b/assets/win10x64-ltsc.xml index 9d9bc159..5950d2c6 100644 --- a/assets/win10x64-ltsc.xml +++ b/assets/win10x64-ltsc.xml @@ -153,104 +153,8 @@ 1 - reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f - - - 2 - reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT" - - - 3 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f - - - 4 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f - - - 5 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 6 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 7 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f - - - 8 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 9 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f - - - 10 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f - - - 11 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f - - - 12 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f - - - 13 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f - - - 14 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f - - - 15 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f - - - 16 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f - - - 17 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f - - - 18 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f - - - 19 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f - - - 20 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f - - - 21 - reg.exe unload "HKU\mount" - - - 22 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f - - - 23 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f - - - 24 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f - - - 25 - reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f - Set Network Location to Home + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script @@ -326,7 +230,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win10x64.cmd b/assets/win10x64.cmd index 100e93f5..26d225e5 100644 --- a/assets/win10x64.cmd +++ b/assets/win10x64.cmd @@ -8,13 +8,62 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f +reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT" +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f +reg.exe unload "HKU\mount" +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f + +rem Set Network Location to Home +reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -51,7 +100,13 @@ rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -78,7 +133,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win10x64.xml b/assets/win10x64.xml index 56726e64..960225b2 100644 --- a/assets/win10x64.xml +++ b/assets/win10x64.xml @@ -150,104 +150,8 @@ 1 - reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f - - - 2 - reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT" - - - 3 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f - - - 4 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f - - - 5 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 6 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 7 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f - - - 8 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 9 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f - - - 10 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f - - - 11 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f - - - 12 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f - - - 13 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f - - - 14 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f - - - 15 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f - - - 16 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f - - - 17 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f - - - 18 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f - - - 19 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f - - - 20 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f - - - 21 - reg.exe unload "HKU\mount" - - - 22 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f - - - 23 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f - - - 24 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f - - - 25 - reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f - Set Network Location to Home + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script @@ -323,7 +227,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win11x64-enterprise.cmd b/assets/win11x64-enterprise.cmd index 482023ba..ee37069a 100644 --- a/assets/win11x64-enterprise.cmd +++ b/assets/win11x64-enterprise.cmd @@ -6,15 +6,75 @@ set "SETUP_STARTED=%SCRIPT_DIR%setup.started" set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup +if /i "%~1"=="pe" goto pe if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:pe + +reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassTPMCheck /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassSecureBootCheck /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassRAMCheck /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SYSTEM\Setup\MoSetup" /v AllowUpgradesWithUnsupportedTPMOrCPU /t REG_DWORD /d 1 /f + +exit /b 0 + +:specialize + +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f +reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT" +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f +reg.exe unload "HKU\mount" +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f + +rem Set Network Location to Home +reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -29,6 +89,9 @@ rem Prevent the local user password from expiring. powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1 rem END LOCAL_ACCOUNT +rem Disable per-CPU clock tick scheduling. +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "EnablePerCpuClockTickScheduling" /t REG_DWORD /d 2 /f + rem Disable hibernation. POWERCFG -H OFF @@ -54,7 +117,13 @@ rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -81,7 +150,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Hide Copilot button. diff --git a/assets/win11x64-enterprise.xml b/assets/win11x64-enterprise.xml index c283e80c..b42ec4ab 100644 --- a/assets/win11x64-enterprise.xml +++ b/assets/win11x64-enterprise.xml @@ -168,104 +168,8 @@ 1 - reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f - - - 2 - reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT" - - - 3 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f - - - 4 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f - - - 5 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 6 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 7 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f - - - 8 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 9 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f - - - 10 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f - - - 11 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f - - - 12 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f - - - 13 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f - - - 14 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f - - - 15 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f - - - 16 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f - - - 17 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f - - - 18 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f - - - 19 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f - - - 20 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f - - - 21 - reg.exe unload "HKU\mount" - - - 22 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f - - - 23 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f - - - 24 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f - - - 25 - reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f - Set Network Location to Home + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script @@ -341,7 +245,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win11x64-iot.cmd b/assets/win11x64-iot.cmd index 482023ba..ee37069a 100644 --- a/assets/win11x64-iot.cmd +++ b/assets/win11x64-iot.cmd @@ -6,15 +6,75 @@ set "SETUP_STARTED=%SCRIPT_DIR%setup.started" set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup +if /i "%~1"=="pe" goto pe if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:pe + +reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassTPMCheck /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassSecureBootCheck /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassRAMCheck /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SYSTEM\Setup\MoSetup" /v AllowUpgradesWithUnsupportedTPMOrCPU /t REG_DWORD /d 1 /f + +exit /b 0 + +:specialize + +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f +reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT" +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f +reg.exe unload "HKU\mount" +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f + +rem Set Network Location to Home +reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -29,6 +89,9 @@ rem Prevent the local user password from expiring. powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1 rem END LOCAL_ACCOUNT +rem Disable per-CPU clock tick scheduling. +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "EnablePerCpuClockTickScheduling" /t REG_DWORD /d 2 /f + rem Disable hibernation. POWERCFG -H OFF @@ -54,7 +117,13 @@ rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -81,7 +150,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Hide Copilot button. diff --git a/assets/win11x64-iot.xml b/assets/win11x64-iot.xml index 180486ae..2e7e4a13 100644 --- a/assets/win11x64-iot.xml +++ b/assets/win11x64-iot.xml @@ -168,104 +168,8 @@ 1 - reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f - - - 2 - reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT" - - - 3 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f - - - 4 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f - - - 5 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 6 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 7 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f - - - 8 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 9 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f - - - 10 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f - - - 11 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f - - - 12 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f - - - 13 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f - - - 14 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f - - - 15 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f - - - 16 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f - - - 17 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f - - - 18 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f - - - 19 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f - - - 20 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f - - - 21 - reg.exe unload "HKU\mount" - - - 22 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f - - - 23 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f - - - 24 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f - - - 25 - reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f - Set Network Location to Home + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script @@ -341,7 +245,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win11x64-ltsc.cmd b/assets/win11x64-ltsc.cmd index 482023ba..ee37069a 100644 --- a/assets/win11x64-ltsc.cmd +++ b/assets/win11x64-ltsc.cmd @@ -6,15 +6,75 @@ set "SETUP_STARTED=%SCRIPT_DIR%setup.started" set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup +if /i "%~1"=="pe" goto pe if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:pe + +reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassTPMCheck /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassSecureBootCheck /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassRAMCheck /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SYSTEM\Setup\MoSetup" /v AllowUpgradesWithUnsupportedTPMOrCPU /t REG_DWORD /d 1 /f + +exit /b 0 + +:specialize + +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f +reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT" +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f +reg.exe unload "HKU\mount" +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f + +rem Set Network Location to Home +reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -29,6 +89,9 @@ rem Prevent the local user password from expiring. powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1 rem END LOCAL_ACCOUNT +rem Disable per-CPU clock tick scheduling. +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "EnablePerCpuClockTickScheduling" /t REG_DWORD /d 2 /f + rem Disable hibernation. POWERCFG -H OFF @@ -54,7 +117,13 @@ rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -81,7 +150,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Hide Copilot button. diff --git a/assets/win11x64-ltsc.xml b/assets/win11x64-ltsc.xml index 89ebd4a7..63057dbc 100644 --- a/assets/win11x64-ltsc.xml +++ b/assets/win11x64-ltsc.xml @@ -168,104 +168,8 @@ 1 - reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f - - - 2 - reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT" - - - 3 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f - - - 4 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f - - - 5 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 6 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 7 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f - - - 8 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 9 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f - - - 10 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f - - - 11 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f - - - 12 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f - - - 13 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f - - - 14 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f - - - 15 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f - - - 16 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f - - - 17 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f - - - 18 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f - - - 19 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f - - - 20 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f - - - 21 - reg.exe unload "HKU\mount" - - - 22 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f - - - 23 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f - - - 24 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f - - - 25 - reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f - Set Network Location to Home + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script @@ -341,7 +245,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win11x64.cmd b/assets/win11x64.cmd index 482023ba..ee37069a 100644 --- a/assets/win11x64.cmd +++ b/assets/win11x64.cmd @@ -6,15 +6,75 @@ set "SETUP_STARTED=%SCRIPT_DIR%setup.started" set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup +if /i "%~1"=="pe" goto pe if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:pe + +reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassTPMCheck /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassSecureBootCheck /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassRAMCheck /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SYSTEM\Setup\MoSetup" /v AllowUpgradesWithUnsupportedTPMOrCPU /t REG_DWORD /d 1 /f + +exit /b 0 + +:specialize + +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f +reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT" +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f +reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f +reg.exe unload "HKU\mount" +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f + +rem Set Network Location to Home +reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -29,6 +89,9 @@ rem Prevent the local user password from expiring. powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1 rem END LOCAL_ACCOUNT +rem Disable per-CPU clock tick scheduling. +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "EnablePerCpuClockTickScheduling" /t REG_DWORD /d 2 /f + rem Disable hibernation. POWERCFG -H OFF @@ -54,7 +117,13 @@ rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -81,7 +150,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Hide Copilot button. diff --git a/assets/win11x64.xml b/assets/win11x64.xml index 368f8a40..196ae5ab 100644 --- a/assets/win11x64.xml +++ b/assets/win11x64.xml @@ -168,104 +168,8 @@ 1 - reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f - - - 2 - reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT" - - - 3 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f - - - 4 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f - - - 5 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 6 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 7 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f - - - 8 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f - - - 9 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f - - - 10 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f - - - 11 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f - - - 12 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f - - - 13 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f - - - 14 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f - - - 15 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f - - - 16 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f - - - 17 - reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f - - - 18 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f - - - 19 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f - - - 20 - reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f - - - 21 - reg.exe unload "HKU\mount" - - - 22 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f - - - 23 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f - - - 24 - reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f - - - 25 - reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f - Set Network Location to Home + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script @@ -341,7 +245,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win2008r2.cmd b/assets/win2008r2.cmd index e6870599..a7deee93 100644 --- a/assets/win2008r2.cmd +++ b/assets/win2008r2.cmd @@ -8,13 +8,35 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Disable Shutdown Event Tracker. reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" /v "ShutdownReasonOn" /t REG_DWORD /d 0 /f @@ -66,7 +88,7 @@ rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -87,7 +109,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win2008r2.xml b/assets/win2008r2.xml index 47ddd1b4..3b68013e 100644 --- a/assets/win2008r2.xml +++ b/assets/win2008r2.xml @@ -157,6 +157,15 @@ + + + + 1 + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script + + + @@ -203,7 +212,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win2012r2.cmd b/assets/win2012r2.cmd index 37ed15ce..60ce8ba6 100644 --- a/assets/win2012r2.cmd +++ b/assets/win2012r2.cmd @@ -8,13 +8,38 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Set Network Location to Home +reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Disable Shutdown Event Tracker. reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" /v "ShutdownReasonOn" /t REG_DWORD /d 0 /f @@ -54,7 +79,7 @@ rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -81,7 +106,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win2012r2.xml b/assets/win2012r2.xml index 61fbcf00..b45d0fcf 100644 --- a/assets/win2012r2.xml +++ b/assets/win2012r2.xml @@ -155,8 +155,8 @@ 1 - reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f - Set Network Location to Home + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script @@ -236,7 +236,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win2016.cmd b/assets/win2016.cmd index ba1b5723..59255c8f 100644 --- a/assets/win2016.cmd +++ b/assets/win2016.cmd @@ -8,13 +8,38 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Set Network Location to Home +reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Disable Shutdown Event Tracker. reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" /v "ShutdownReasonOn" /t REG_DWORD /d 0 /f @@ -54,7 +79,7 @@ rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -81,7 +106,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win2016.xml b/assets/win2016.xml index 60700ed6..85141792 100644 --- a/assets/win2016.xml +++ b/assets/win2016.xml @@ -155,8 +155,8 @@ 1 - reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f - Set Network Location to Home + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script @@ -236,7 +236,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win2019-hv.cmd b/assets/win2019-hv.cmd index ba1b5723..c598aa37 100644 --- a/assets/win2019-hv.cmd +++ b/assets/win2019-hv.cmd @@ -8,13 +8,41 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Set Network Location to Home +reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f + +rem Disable Hyper-V role +dism.exe /online /Disable-Feature /FeatureName:Microsoft-Hyper-V /NoRestart + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Disable Shutdown Event Tracker. reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" /v "ShutdownReasonOn" /t REG_DWORD /d 0 /f @@ -53,9 +81,6 @@ reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v " rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f -rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f - rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -81,7 +106,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win2019-hv.xml b/assets/win2019-hv.xml index d88e6bcc..32cbdf1d 100644 --- a/assets/win2019-hv.xml +++ b/assets/win2019-hv.xml @@ -156,13 +156,8 @@ 1 - reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f - Set Network Location to Home - - - 2 - dism.exe /online /Disable-Feature /FeatureName:Microsoft-Hyper-V /NoRestart - Disable Hyper-V role + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script @@ -242,7 +237,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win2019.cmd b/assets/win2019.cmd index ba1b5723..8577c2dd 100644 --- a/assets/win2019.cmd +++ b/assets/win2019.cmd @@ -8,13 +8,38 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Set Network Location to Home +reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Disable Shutdown Event Tracker. reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" /v "ShutdownReasonOn" /t REG_DWORD /d 0 /f @@ -54,7 +79,13 @@ rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -81,7 +112,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win2019.xml b/assets/win2019.xml index 6baaad5e..61c2ea74 100644 --- a/assets/win2019.xml +++ b/assets/win2019.xml @@ -159,8 +159,8 @@ 1 - reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f - Set Network Location to Home + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script @@ -240,7 +240,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win2022.cmd b/assets/win2022.cmd index ba1b5723..8577c2dd 100644 --- a/assets/win2022.cmd +++ b/assets/win2022.cmd @@ -8,13 +8,38 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Set Network Location to Home +reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Disable Shutdown Event Tracker. reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" /v "ShutdownReasonOn" /t REG_DWORD /d 0 /f @@ -54,7 +79,13 @@ rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -81,7 +112,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win2022.xml b/assets/win2022.xml index 7432f0b4..c329c0d5 100644 --- a/assets/win2022.xml +++ b/assets/win2022.xml @@ -159,8 +159,8 @@ 1 - reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f - Set Network Location to Home + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script @@ -240,7 +240,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win2025.cmd b/assets/win2025.cmd index 083d43f2..27757407 100644 --- a/assets/win2025.cmd +++ b/assets/win2025.cmd @@ -8,13 +8,38 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Set Network Location to Home +reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Disable Shutdown Event Tracker. reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" /v "ShutdownReasonOn" /t REG_DWORD /d 0 /f @@ -32,29 +57,46 @@ rem Prevent the local user password from expiring. powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1 rem END LOCAL_ACCOUNT -rem Disable hibernation and monitor blanking. +rem Disable per-CPU clock tick scheduling. +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "EnablePerCpuClockTickScheduling" /t REG_DWORD /d 2 /f + +rem Disable hibernation. POWERCFG -H OFF + +rem Disable monitor blanking. POWERCFG -X -monitor-timeout-ac 0 -rem Disable the first-run experience in Edge. +rem Disable first-run experience in Edge. reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f rem Disable hibernation in the registry. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f + +rem Disable hibernation. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f rem Disable sleep. POWERCFG -X -standby-timeout-ac 0 -rem Allow RemoteApp to launch unlisted programs. +rem Enable RemoteApp to launch unlisted programs. reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f + +rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f +reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f -rem Enable Network Discovery and File Sharing. +rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes + +rem Enable File Sharing. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes rem Remove the empty Windows.old folder. @@ -76,15 +118,14 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup -rem Set initial Explorer and taskbar preferences for the logged-in user. -reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f +rem Show file extensions in Explorer. reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f -reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f + +rem Remove Widgets from the Taskbar. reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f -reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f rem BEGIN SHARED_FOLDER rem Add the shared folder to the desktop and map it to drive Z:. diff --git a/assets/win2025.xml b/assets/win2025.xml index 58d19fc8..33060a67 100644 --- a/assets/win2025.xml +++ b/assets/win2025.xml @@ -159,8 +159,8 @@ 1 - reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f - Set Network Location to Home + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script @@ -240,7 +240,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win7x64-enterprise.cmd b/assets/win7x64-enterprise.cmd index 2ea592f6..c5f71672 100644 --- a/assets/win7x64-enterprise.cmd +++ b/assets/win7x64-enterprise.cmd @@ -8,13 +8,35 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -56,6 +78,9 @@ POWERCFG -X -standby-timeout-ac 0 rem Enable RemoteAPP to launch unlisted programs. reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f +rem Turn off automatic Windows Update downloads. +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f + rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -75,7 +100,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win7x64-enterprise.xml b/assets/win7x64-enterprise.xml index 25ee39d3..0e30acd3 100644 --- a/assets/win7x64-enterprise.xml +++ b/assets/win7x64-enterprise.xml @@ -152,6 +152,15 @@ + + + + 1 + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script + + + @@ -198,7 +207,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win7x64-ultimate.cmd b/assets/win7x64-ultimate.cmd index 2ea592f6..c5f71672 100644 --- a/assets/win7x64-ultimate.cmd +++ b/assets/win7x64-ultimate.cmd @@ -8,13 +8,35 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -56,6 +78,9 @@ POWERCFG -X -standby-timeout-ac 0 rem Enable RemoteAPP to launch unlisted programs. reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f +rem Turn off automatic Windows Update downloads. +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f + rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -75,7 +100,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win7x64-ultimate.xml b/assets/win7x64-ultimate.xml index c04f9b07..3184de86 100644 --- a/assets/win7x64-ultimate.xml +++ b/assets/win7x64-ultimate.xml @@ -152,6 +152,15 @@ + + + + 1 + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script + + + @@ -198,7 +207,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win7x64.cmd b/assets/win7x64.cmd index 2ea592f6..c5f71672 100644 --- a/assets/win7x64.cmd +++ b/assets/win7x64.cmd @@ -8,13 +8,35 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -56,6 +78,9 @@ POWERCFG -X -standby-timeout-ac 0 rem Enable RemoteAPP to launch unlisted programs. reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f +rem Turn off automatic Windows Update downloads. +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f + rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -75,7 +100,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win7x64.xml b/assets/win7x64.xml index f8ecee16..b9f55397 100644 --- a/assets/win7x64.xml +++ b/assets/win7x64.xml @@ -152,6 +152,15 @@ + + + + 1 + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script + + + @@ -198,7 +207,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win7x86-enterprise.cmd b/assets/win7x86-enterprise.cmd index 85006129..7515f144 100644 --- a/assets/win7x86-enterprise.cmd +++ b/assets/win7x86-enterprise.cmd @@ -8,13 +8,35 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -38,6 +60,9 @@ reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard rem Disable Network Discovery popup. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f +rem Disable AutoPlay for all drives. +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /t REG_DWORD /d 255 /f + rem Disable first-run experience in Edge. reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f @@ -56,6 +81,9 @@ POWERCFG -X -standby-timeout-ac 0 rem Enable RemoteAPP to launch unlisted programs. reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f +rem Turn off automatic Windows Update downloads. +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f + rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -75,7 +103,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win7x86-enterprise.xml b/assets/win7x86-enterprise.xml index a3629813..6284f5e3 100644 --- a/assets/win7x86-enterprise.xml +++ b/assets/win7x86-enterprise.xml @@ -152,6 +152,15 @@ + + + + 1 + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script + + + @@ -198,7 +207,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win7x86-ultimate.cmd b/assets/win7x86-ultimate.cmd index 2ea592f6..c5f71672 100644 --- a/assets/win7x86-ultimate.cmd +++ b/assets/win7x86-ultimate.cmd @@ -8,13 +8,35 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -56,6 +78,9 @@ POWERCFG -X -standby-timeout-ac 0 rem Enable RemoteAPP to launch unlisted programs. reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f +rem Turn off automatic Windows Update downloads. +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f + rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -75,7 +100,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win7x86-ultimate.xml b/assets/win7x86-ultimate.xml index 34845855..9c0bda2c 100644 --- a/assets/win7x86-ultimate.xml +++ b/assets/win7x86-ultimate.xml @@ -152,6 +152,15 @@ + + + + 1 + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script + + + @@ -198,7 +207,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win7x86.cmd b/assets/win7x86.cmd index 2ea592f6..c5f71672 100644 --- a/assets/win7x86.cmd +++ b/assets/win7x86.cmd @@ -8,13 +8,35 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -56,6 +78,9 @@ POWERCFG -X -standby-timeout-ac 0 rem Enable RemoteAPP to launch unlisted programs. reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f +rem Turn off automatic Windows Update downloads. +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f + rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -75,7 +100,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win7x86.xml b/assets/win7x86.xml index 838e9d8b..98795886 100644 --- a/assets/win7x86.xml +++ b/assets/win7x86.xml @@ -152,6 +152,15 @@ + + + + 1 + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script + + + @@ -198,7 +207,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win81x64-enterprise.cmd b/assets/win81x64-enterprise.cmd index 47835962..cc9cd331 100644 --- a/assets/win81x64-enterprise.cmd +++ b/assets/win81x64-enterprise.cmd @@ -8,13 +8,38 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Set Network Location to Home +reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -51,7 +76,7 @@ rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -90,7 +115,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win81x64-enterprise.xml b/assets/win81x64-enterprise.xml index 45db60d6..a84d891f 100644 --- a/assets/win81x64-enterprise.xml +++ b/assets/win81x64-enterprise.xml @@ -146,8 +146,8 @@ 1 - reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f - Set Network Location to Home + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script @@ -221,7 +221,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/win81x64.cmd b/assets/win81x64.cmd index 47835962..cc9cd331 100644 --- a/assets/win81x64.cmd +++ b/assets/win81x64.cmd @@ -8,13 +8,38 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Set Network Location to Home +reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -51,7 +76,7 @@ rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f rem Turn off automatic Windows Update downloads. -reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -90,7 +115,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/win81x64.xml b/assets/win81x64.xml index 4fc36291..eddf4344 100644 --- a/assets/win81x64.xml +++ b/assets/win81x64.xml @@ -151,10 +151,10 @@ - + 1 - reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f - Set Network Location to Home + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script @@ -228,7 +228,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/winvistax64-enterprise.cmd b/assets/winvistax64-enterprise.cmd index c2d9c52b..d041ff41 100644 --- a/assets/winvistax64-enterprise.cmd +++ b/assets/winvistax64-enterprise.cmd @@ -8,13 +8,35 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -68,6 +90,9 @@ reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v " rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f +rem Turn off automatic Windows Update downloads. +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f + rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -87,7 +112,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/winvistax64-enterprise.xml b/assets/winvistax64-enterprise.xml index 3e9c4bff..ff438a57 100644 --- a/assets/winvistax64-enterprise.xml +++ b/assets/winvistax64-enterprise.xml @@ -90,6 +90,15 @@ false + + + + 1 + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script + + + @@ -147,7 +156,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/winvistax64-ultimate.cmd b/assets/winvistax64-ultimate.cmd index c2d9c52b..d041ff41 100644 --- a/assets/winvistax64-ultimate.cmd +++ b/assets/winvistax64-ultimate.cmd @@ -8,13 +8,35 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -68,6 +90,9 @@ reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v " rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f +rem Turn off automatic Windows Update downloads. +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f + rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -87,7 +112,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/winvistax64-ultimate.xml b/assets/winvistax64-ultimate.xml index 10bf62fa..32b38f4e 100644 --- a/assets/winvistax64-ultimate.xml +++ b/assets/winvistax64-ultimate.xml @@ -90,6 +90,15 @@ false + + + + 1 + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script + + + @@ -147,7 +156,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/winvistax64.cmd b/assets/winvistax64.cmd index c2d9c52b..d041ff41 100644 --- a/assets/winvistax64.cmd +++ b/assets/winvistax64.cmd @@ -8,13 +8,35 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -68,6 +90,9 @@ reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v " rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f +rem Turn off automatic Windows Update downloads. +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f + rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -87,7 +112,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/winvistax64.xml b/assets/winvistax64.xml index c120618c..eec8a32e 100644 --- a/assets/winvistax64.xml +++ b/assets/winvistax64.xml @@ -90,6 +90,15 @@ false + + + + 1 + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script + + + @@ -147,7 +156,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/winvistax86-enterprise.cmd b/assets/winvistax86-enterprise.cmd index c2d9c52b..d041ff41 100644 --- a/assets/winvistax86-enterprise.cmd +++ b/assets/winvistax86-enterprise.cmd @@ -8,13 +8,35 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -68,6 +90,9 @@ reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v " rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f +rem Turn off automatic Windows Update downloads. +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f + rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -87,7 +112,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/winvistax86-enterprise.xml b/assets/winvistax86-enterprise.xml index f9fb949a..6825eebc 100644 --- a/assets/winvistax86-enterprise.xml +++ b/assets/winvistax86-enterprise.xml @@ -90,6 +90,15 @@ false + + + + 1 + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script + + + @@ -147,7 +156,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/winvistax86-ultimate.cmd b/assets/winvistax86-ultimate.cmd index c2d9c52b..d041ff41 100644 --- a/assets/winvistax86-ultimate.cmd +++ b/assets/winvistax86-ultimate.cmd @@ -8,13 +8,35 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -68,6 +90,9 @@ reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v " rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f +rem Turn off automatic Windows Update downloads. +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f + rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -87,7 +112,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/winvistax86-ultimate.xml b/assets/winvistax86-ultimate.xml index 4e6eff9e..b928f8a3 100644 --- a/assets/winvistax86-ultimate.xml +++ b/assets/winvistax86-ultimate.xml @@ -90,6 +90,15 @@ false + + + + 1 + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script + + + @@ -147,7 +156,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/assets/winvistax86.cmd b/assets/winvistax86.cmd index c2d9c52b..d041ff41 100644 --- a/assets/winvistax86.cmd +++ b/assets/winvistax86.cmd @@ -8,13 +8,35 @@ set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete" if "%~1"=="" goto setup if /i "%~1"=="setup" goto setup if /i "%~1"=="logon" goto logon +if /i "%~1"=="specialize" goto specialize exit /b 2 +:specialize + +rem Install the VMWare display driver before Windows Setup's final reboot. +certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1 +start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1 + +exit /b 0 + :setup if exist "%SETUP_COMPLETE%" exit /b 0 type nul > "%SETUP_STARTED%" +rem Ignore unclean shutdowns when deciding whether to enter recovery. +bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures + +rem Keep the blue screen visible after a system crash. +bcdedit.exe /set {current} nocrashautoreboot on + +rem Boot the default entry immediately without waiting at the boot menu. +bcdedit.exe /timeout 0 + +rem Disable automatic reboot after BSOD +reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f + rem Allow guest access to network shares. reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f @@ -68,6 +90,9 @@ reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v " rem Disable RemoteApp allowlist. reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f +rem Turn off automatic Windows Update downloads. +reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f + rem Enable Network Discovery. netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes @@ -87,7 +112,7 @@ type nul > "%SETUP_COMPLETE%" exit /b 0 :logon -rem Run the machine setup here when SetupComplete.cmd was skipped. +rem Run the machine setup here when the SetupComplete hook was skipped. if not exist "%SETUP_COMPLETE%" call "%~f0" setup rem Show file extensions in Explorer. diff --git a/assets/winvistax86.xml b/assets/winvistax86.xml index efdae8c6..36d85f6f 100644 --- a/assets/winvistax86.xml +++ b/assets/winvistax86.xml @@ -90,6 +90,15 @@ false + + + + 1 + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize + Run the specialize pass of the unattended setup script + + + @@ -147,7 +156,7 @@ 1 - cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon + wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon Configure Windows after logon diff --git a/docs/environment.md b/docs/environment.md index 13253db1..90646b8d 100644 --- a/docs/environment.md +++ b/docs/environment.md @@ -83,7 +83,7 @@ An empty default means the variable is unset and its value is determined automat | `VGA` | `virtio` | QEMU video adapter model. | | `WIDTH` | `1280` | Display width configured in Windows. | | `HEIGHT` | `720` | Display height configured in Windows. | -| `GPU` | `N` | Enables Helios GPU acceleration. | +| `GPU` | `N` | Enables GPU acceleration. | | `VRAM_SIZE` | `4G` | Virtual GPU memory budget. | | `RENDERNODE` | `/dev/dri/renderD128` | Render node used for GPU acceleration. | diff --git a/src/answer.sh b/src/answer.sh index 10707a35..582c5fe5 100644 --- a/src/answer.sh +++ b/src/answer.sh @@ -71,11 +71,6 @@ updateXML() { return 1 fi - if ! updateLogonCommandXML "$asset"; then - error "Failed to update first-logon command in answer file!" - return 1 - fi - if ! updateEditionXML "$asset"; then error "Failed to update edition settings in answer file!" return 1 @@ -526,49 +521,6 @@ updateAutologinXML() { return 0 } -usesWscriptLogonLauncher() { - - case "${DETECTED,,}" in - "winvista"* | "win7"* | "win2008r2"* ) return 0 ;; - esac - - return 1 -} - -updateLogonCommandXML() { - - local asset="$1" - - local command="$XML_COMPONENT_SHELL_OOBE/u:FirstLogonCommands/u:SynchronousCommand/u:CommandLine" - local expected='cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon' - local hidden - - if usesWscriptLogonLauncher; then - hidden='wscript.exe //B //NoLogo C:\Windows\Setup\Scripts\RunHidden.vbs' - else - hidden="powershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -Command \"\$cmd = 'call ' + [char]34 + \$env:WINDIR + '\Setup\Scripts\SetupComplete.cmd' + [char]34 + ' logon'; & \$env:ComSpec /d /c \$cmd; exit \$LASTEXITCODE\"" - fi - - local count value - count=$(getXMLNodeCount "$asset" "$command") || return 1 - - if [ "$count" != "1" ]; then - error "Failed to find a unique first-logon command in answer file: $asset" - return 1 - fi - - value=$(xmlstarlet sel -N "$XML_NS_UNATTEND_ARG" -T -t -v "string($command)" "$asset") || return 1 - - if [ "$value" != "$expected" ]; then - error "Unexpected first-logon command in answer file: $asset" - return 1 - fi - - xmlstarlet ed -L -N "$XML_NS_UNATTEND_ARG" -u "$command" -v "$hidden" "$asset" || return 1 - - return 0 -} - updateProductKey() { local script="$1" @@ -1968,43 +1920,69 @@ prepareSetupScript() { [ -n "$staged" ] || return 0 - stageHiddenLogonLauncher "$stage" || return 1 + stageUnattendLauncher "$stage" || return 1 updateSetupScript "$staged" "$asset" || return 1 finalizeSetupScript "$staged" || return 1 + stageSetupCompleteWrapper "$stage" || return 1 return 0 } -stageHiddenLogonLauncher() { +stageSetupCompleteWrapper() { local stage="$1" + local target="$stage/\$OEM\$/\$\$/Setup/Scripts/SetupComplete.cmd" - usesWscriptLogonLauncher || return 0 + if ! cat > "$target" <<'EOF' +@echo off +call "%~dp0Unattend.cmd" setup +exit /b %errorlevel% +EOF + then + error "Failed to create SetupComplete wrapper!" + return 1 + fi - local target="$stage/\$OEM\$/\$\$/Setup/Scripts/RunHidden.vbs" + if ! unix2dos -q "$target"; then + error "Failed to convert SetupComplete wrapper to DOS format!" + return 1 + fi + + return 0 +} + +stageUnattendLauncher() { + + local stage="$1" + local target="$stage/\$OEM\$/\$\$/Setup/Scripts/Unattend.vbs" if ! mkdir -p "$(dirname "$target")"; then - error "Failed to create hidden logon launcher directory!" + error "Failed to create unattended launcher directory!" return 1 fi if ! cat > "$target" <<'EOF' Option Explicit -Dim shell, command, result +Dim shell, command, result, pass +If WScript.Arguments.Count <> 1 Then + WScript.Quit 1 +End If + +pass = WScript.Arguments(0) Set shell = CreateObject("WScript.Shell") -command = shell.ExpandEnvironmentStrings("%ComSpec% /d /c call " & Chr(34) & "%WINDIR%\Setup\Scripts\SetupComplete.cmd" & Chr(34) & " logon") +command = shell.ExpandEnvironmentStrings("%ComSpec% /d /c call " & Chr(34) & "%WINDIR%\Setup\Scripts\Unattend.cmd" & Chr(34) & " " & pass) result = shell.Run(command, 0, True) WScript.Quit result EOF then - error "Failed to create hidden logon launcher!" + error "Failed to create unattended launcher!" return 1 fi if ! unix2dos -q "$target"; then - error "Failed to convert hidden logon launcher to DOS format!" + error "Failed to convert unattended launcher to DOS format!" return 1 fi @@ -2124,7 +2102,7 @@ stageSetupScript() { source=$(findSetupScript "$asset") || return 1 [ -n "$source" ] || return 0 - target="$stage/\$OEM\$/\$\$/Setup/Scripts/SetupComplete.cmd" + target="$stage/\$OEM\$/\$\$/Setup/Scripts/Unattend.cmd" if ! mkdir -p "$(dirname "$target")"; then error "Failed to create setup script directory!" diff --git a/src/batch.sh b/src/batch.sh index 0c21fc9b..4e592a50 100644 --- a/src/batch.sh +++ b/src/batch.sh @@ -138,7 +138,6 @@ Win9xInstall() { local display="$win9x/vmdisp9x" local audio95="$win9x/alcx95" local audiowdm="$win9x/alcxwdm" - local vmware_display="$win9x/vmsvga" extractDrivers "$drivers" || return 1 @@ -172,7 +171,7 @@ Win9xInstall() { return 1 fi - if ! patchWin9xSetupFiles "$id" "$target" "$desc" "$patcher" "$qemouse" "$display" "$vmware_display"; then + if ! patchWin9xSetupFiles "$id" "$target" "$desc" "$patcher" "$qemouse" "$display"; then rm -rf "$drivers" || : return 1 fi @@ -559,7 +558,6 @@ patchWin9xSetupFiles() { local patcher="$4" local qemouse="$5" local display="$6" - local vmware_display="$7" chmod 755 "$patcher" || { error "Failed to make Patcher9x executable!" @@ -584,12 +582,13 @@ patchWin9xSetupFiles() { fi stageWin9xDisplayDriver "$target" "$display" "$desc" || return 1 - stageWin9xVMwareDriver "$target" "$vmware_display" "$desc" || return 1 if ! mv -f -- \ "$target/VMDISP9X/vmdisp9x.inf" \ "$target/VMDISP9X/qemumini.drv" \ "$target/VMDISP9X/qemumini.vxd" \ + "$target/VMDISP9X/vmwsmini.drv" \ + "$target/VMDISP9X/vmwsmini.vxd" \ "$target/VMDISP9X/vmhal9x.dll" \ "$target/VMDISP9X/vmhal486.dll" \ "$target/VMDISP9X/vmdisp9x.dll" \ @@ -1139,6 +1138,8 @@ stageWin9xDisplayDriver() { vmdisp9x.inf \ qemumini.drv \ qemumini.vxd \ + vmwsmini.drv \ + vmwsmini.vxd \ vmhal9x.dll \ vmhal486.dll \ vmdisp9x.dll; do @@ -1157,6 +1158,8 @@ stageWin9xDisplayDriver() { "$source/vmdisp9x.inf" \ "$source/qemumini.drv" \ "$source/qemumini.vxd" \ + "$source/vmwsmini.drv" \ + "$source/vmwsmini.vxd" \ "$source/vmhal9x.dll" \ "$source/vmhal486.dll" \ "$source/vmdisp9x.dll" \ @@ -1166,6 +1169,50 @@ stageWin9xDisplayDriver() { return 1 fi + # VMDisp9x identifies QEMU by the absence of SVGA_FIFO_CAP_FENCE. Our + # enhanced SVGA device supports fences, so force the driver's existing QEMU + # compatibility path instead. This keeps fence support while enabling its V86 + # VGA-memory mapping workaround for KVM/WHPX shutdown. Match the surrounding + # machine code exactly and fail closed if an upstream driver build changes it. + if ! python3 - "$dest/vmwsmini.vxd" <<'PY' +from pathlib import Path +import sys + +path = Path(sys.argv[1]) +data = bytearray(path.read_bytes()) + +old = bytes.fromhex( + "6A 01 " + "E8 CE 0B 00 00 " + "83 C4 04 " + "85 C0 " + "75 48 " + "68 20 00 00 00 " + "68 CE 01 00 00" +) +new = old[:12] + b"\x90\x90" + old[14:] + +old_count = bytes(data).count(old) +new_count = bytes(data).count(new) +if old_count != 1 or new_count != 0: + raise SystemExit( + "VMDisp9x QEMU compatibility signature mismatch: " + f"original={old_count}, patched={new_count}" + ) + +offset = bytes(data).index(old) +data[offset + 12:offset + 14] = b"\x90\x90" +path.write_bytes(data) + +verify = path.read_bytes() +if verify.count(old) != 0 or verify.count(new) != 1: + raise SystemExit("VMDisp9x QEMU compatibility patch verification failed") +PY + then + error "Failed to enable the VMDisp9x QEMU compatibility path!" + return 1 + fi + # VMDisp9x's DDC flag makes Win9x enumerate a Plug and Play monitor after # the display driver starts. The unattended setup already selects the monitor # and display mode, and VMDisp9x carries a fixed mode list, so disable DDC in @@ -1181,100 +1228,6 @@ stageWin9xDisplayDriver() { return 1 fi - # Keep VMDisp9x available for QEMU STD VGA, but let the official VMware - # driver own VMware SVGA-II. Comment only the matching model in our staged - # INF so the original driver archive remains untouched. - if ! python3 - "$dest/vmdisp9x.inf" <<'PY' -from pathlib import Path -import sys - -path = Path(sys.argv[1]) -lines = path.read_bytes().splitlines(keepends=True) -needle = br'PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD' -matches = [] - -for index, line in enumerate(lines): - stripped = line.lstrip(b' \t') - if stripped.startswith(b';'): - continue - if needle in stripped.upper(): - matches.append(index) - -if len(matches) != 1: - raise SystemExit(f'expected exactly one active VMware SVGA-II model, found {len(matches)}') - -index = matches[0] -indent = len(lines[index]) - len(lines[index].lstrip(b' \t')) -lines[index] = lines[index][:indent] + b'; ' + lines[index][indent:] -path.write_bytes(b''.join(lines)) -PY - then - error "Failed to reserve VMware SVGA-II for the official VMware driver!" - return 1 - fi - - if grep -iF 'PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD' "$dest/vmdisp9x.inf" | - grep -Ev '^[[:space:]]*;' >/dev/null; then - error "Failed to remove the active VMware SVGA-II VMDisp9x model!" - return 1 - fi - - if ! grep -iF 'PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD' "$dest/vmdisp9x.inf" | - grep -Eq '^[[:space:]]*;'; then - error "Failed to verify the VMware SVGA-II VMDisp9x model change!" - return 1 - fi - - return 0 -} - -stageWin9xVMwareDriver() { - - local target="$1" - local source="$2" - local desc="$3" - - local file - - for file in \ - vmx_svga.inf \ - VMX_SVGA.DRV \ - VMX_SVGA.vxd; do - - if [ ! -s "$source/$file" ]; then - error "Failed to locate required VMware SVGA driver file: $file" - return 1 - fi - - done - - if ! cp -f -- \ - "$source/vmx_svga.inf" \ - "$source/VMX_SVGA.DRV" \ - "$source/VMX_SVGA.vxd" \ - "$target/"; then - - error "Failed to add the VMware SVGA driver to $desc setup files!" - return 1 - fi - - for file in \ - vmx_svga.inf \ - VMX_SVGA.DRV \ - VMX_SVGA.vxd; do - - if ! cmp -s -- "$source/$file" "$target/$file"; then - error "Failed to verify the staged VMware SVGA driver file: $file" - return 1 - fi - - done - - if ! grep -Fqi 'PCI\VEN_15AD&DEV_0405' "$target/vmx_svga.inf"; then - error "Failed to verify the VMware SVGA-II hardware ID!" - return 1 - fi - return 0 } @@ -3210,15 +3163,22 @@ createWin9xSystemImage() { fi local boot_gui=0 - [[ "${id,,}" == "win9x"* ]] && boot_gui=1 + [[ "${id,,}" == "win9x" ]] && boot_gui=1 + + local auto_scan=2 + [[ "${id,,}" == "win95" ]] && auto_scan=0 { printf '%s\n' \ - '[Options]' \ + "[Options]" \ "BootGUI=$boot_gui" \ - 'BootDelay=0' \ - 'AutoScan=2' \ - 'Logo=0' \ + "BootMenu=0" \ + "BootMenuDefault=1" \ + "BootWarn=0" \ + "BootSafe=0" \ + "BootDelay=0" \ + "AutoScan=$auto_scan" \ + "Logo=0" \ '' } | unix2dos > "$msdos" || return 1 diff --git a/src/display.sh b/src/display.sh new file mode 100644 index 00000000..5c297f1c --- /dev/null +++ b/src/display.sh @@ -0,0 +1,1106 @@ +#!/usr/bin/env bash +set -Eeuo pipefail + +# Docker environment variables + +: "${VGA:="virtio"}" # VGA adapter +: "${GPU:="N"}" # GPU acceleration +: "${DISPLAY:="web"}" # Display type +: "${LOSSY:="N"}" # Lossy VNC compression +: "${VNC_PORT:="5900"}" # VNC port +: "${RENDERNODE:=""}" # Render node +: "${VRAM_SIZE:="4G"}" # VirtIO GPU memory budget + +# Sanitize variables +VGA=$(strip "$VGA") +LOSSY=$(strip "$LOSSY") +DISPLAY=$(strip "$DISPLAY") +VNC_PORT=$(strip "$VNC_PORT") +VRAM_SIZE=$(strip "$VRAM_SIZE") +RENDERNODE=$(strip "$RENDERNODE") +WSS_SOCKET="${WSS_SOCKET:-$QEMU_DIR/vnc-ws.sock}" + +VGA_DEVICE="${VGA%%,*}" +VGA_OPTIONS="${VGA#"$VGA_DEVICE"}" + +case "${VGA_DEVICE,,}" in + "std" | "vga" ) + VGA_DEVICE="VGA" + VGA_ARG="-device" ;; + "vmvga" | "vmware" | "vmware-svga" ) + VGA_DEVICE="vmvga" + VGA_ARG="-device" + [ -z "${VMPORT:-}" ] && VMPORT="Y" ;; + "virtio" ) + VGA_DEVICE="virtio-vga" + VGA_ARG="-device" ;; + "virtio-"* ) + VGA_DEVICE="${VGA_DEVICE,,}" + VGA_ARG="-device" ;; + * ) + VGA_ARG="-vga" ;; +esac + +VGA="${VGA_DEVICE}${VGA_OPTIONS}" +VGA_ARG+=" ${VGA}" + +# QEMU accepts a VNC display number rather than a TCP port, +# so translate the configured port back to its :N display index. +port=$(( VNC_PORT - 5900 )) + +LOSSY_OPT="" +enabled "$LOSSY" && LOSSY_OPT=",lossy=on" + +# Preserve the historic :0 setting as an alias for the managed web display. +[[ "$DISPLAY" == ":0" ]] && DISPLAY="web" + +case "${DISPLAY,,}" in + + "vnc" ) + DISPLAY_OPTS="-display vnc=:${port}${LOSSY_OPT} ${VGA_ARG}" ;; + "web" ) + DISPLAY_OPTS="-display vnc=:${port},websocket=unix:${WSS_SOCKET}${LOSSY_OPT} ${VGA_ARG}" ;; + "disabled" ) + DISPLAY_OPTS="-display none ${VGA_ARG}" ;; + "none" ) + DISPLAY_OPTS="-display none -vga none" ;; + *) + DISPLAY_OPTS="-display ${DISPLAY} ${VGA_ARG}" ;; + +esac + +gpuSetupFailure() { + + local reason="$1" + + error "$reason" + exit 87 +} + +vmwareLibraryPath() { + + local library="$1" + local path="" + + if command -v ldconfig >/dev/null 2>&1; then + path="$(ldconfig -p 2>/dev/null | awk -v library="$library" '$1 == library && !found { print $NF; found = 1 }')" + if [ -n "$path" ] && [ -r "$path" ]; then + printf '%s\n' "$path" + return 0 + fi + fi + + for path in /usr/lib/*/"$library" /usr/lib/"$library" /usr/lib64/"$library" \ + /usr/local/lib/*/"$library" /usr/local/lib/"$library" /usr/local/lib64/"$library"; do + [ -r "$path" ] || continue + printf '%s\n' "$path" + return 0 + done + + return 1 +} + +vmwareLibraryReady() { + + local library="$1" + local path="" + local dependencies="" + VMWARE_LIBRARY_REASON="" + + if ! path="$(vmwareLibraryPath "$library")"; then + VMWARE_LIBRARY_REASON="the $library runtime library is not available in the container" + return 1 + fi + + if command -v ldd >/dev/null 2>&1; then + dependencies="$(ldd "$path" 2>&1 || true)" + if grep -q '=> not found' <<< "$dependencies"; then + VMWARE_LIBRARY_REASON="$library has missing runtime dependencies" + return 1 + fi + fi + + return 0 +} + +# VMVGA lets DXVK select the Vulkan device itself, so this render node is only +# a host-GPU sanity check and is never passed to QEMU or DXVK. +vmwareRenderNodeReady() { + + local node gpu_fd + VMWARE_RENDER_NODE="" + VMWARE_RENDER_NODE_FOUND="N" + VMWARE_RENDER_REASON="" + + if [ ! -d /dev/dri ]; then + VMWARE_RENDER_REASON="'/dev/dri' was not added to the devices section of your compose file" + return 1 + fi + + for node in /dev/dri/renderD*; do + + [ -e "$node" ] || continue + VMWARE_RENDER_NODE_FOUND="Y" + [ -c "$node" ] || continue + + if { exec {gpu_fd}<>"$node"; } 2>/dev/null; then + { exec {gpu_fd}>&-; } 2>/dev/null || true + VMWARE_RENDER_NODE="$node" + return 0 + fi + + done + + if [[ "$VMWARE_RENDER_NODE_FOUND" != "Y" ]]; then + VMWARE_RENDER_REASON="/dev/dri is available, but no GPU render nodes were found" + else + VMWARE_RENDER_REASON="no accessible GPU render node was found" + fi + + return 1 +} + +vmwareVersionAtLeast() { + + local version="$1" + local required_major="$2" + local required_minor="$3" + local major minor + + IFS='.' read -r major minor _ <<< "$version" + [[ "$major" =~ ^[0-9]+$ && "$minor" =~ ^[0-9]+$ ]] || return 1 + + (( major > required_major || (major == required_major && minor >= required_minor) )) +} + +# Match the VMVGA renderer preflight: Vulkan 1.3, its headless WSI instance +# extensions, and the device extensions required by the DXVK D3D9 backend. +vmwareVulkanReady() { + + local summary details loader selected extension + local api type name driver + VMWARE_VULKAN_REASON="" + + if ! command -v vulkaninfo >/dev/null 2>&1; then + VMWARE_VULKAN_REASON="vulkaninfo is not available in the container" + return 1 + fi + + if ! summary="$(vulkaninfo --summary 2>&1)"; then + VMWARE_VULKAN_REASON="Vulkan device enumeration failed" + return 1 + fi + + loader="$(sed -n 's/^Vulkan Instance Version:[[:space:]]*//p' <<< "$summary")" + if [ -z "$loader" ] || ! vmwareVersionAtLeast "$loader" 1 3; then + VMWARE_VULKAN_REASON="Vulkan 1.3 or newer is required by VMVGA" + return 1 + fi + + selected="$(awk ' + function emit() { + if (found || !in_gpu || api == "" || type == "") { + return + } + + split(api, version, ".") + if (type != "PHYSICAL_DEVICE_TYPE_CPU" && + (version[1] > 1 || (version[1] == 1 && version[2] >= 3))) { + print api "|" type "|" name "|" driver + found = 1 + } + } + + /^GPU[0-9]+:/ { + emit() + in_gpu = 1 + api = "" + type = "" + name = "" + driver = "" + next + } + + in_gpu && /^[[:space:]]*apiVersion[[:space:]]*=/ { + api = $0 + sub(/^.*=[[:space:]]*/, "", api) + if (match(api, /\([0-9]+\.[0-9]+(\.[0-9]+)?\)/)) { + api = substr(api, RSTART + 1, RLENGTH - 2) + } else { + sub(/[[:space:]].*$/, "", api) + } + next + } + + in_gpu && /^[[:space:]]*deviceType[[:space:]]*=/ { + type = $0 + sub(/^.*=[[:space:]]*/, "", type) + sub(/[[:space:]].*$/, "", type) + next + } + + in_gpu && /^[[:space:]]*deviceName[[:space:]]*=/ { + name = $0 + sub(/^.*=[[:space:]]*/, "", name) + next + } + + in_gpu && /^[[:space:]]*driverName[[:space:]]*=/ { + driver = $0 + sub(/^.*=[[:space:]]*/, "", driver) + next + } + + END { emit() } + ' <<< "$summary")" + + if [ -z "$selected" ]; then + VMWARE_VULKAN_REASON="no Vulkan 1.3 capable hardware device was found" + return 1 + fi + + IFS='|' read -r api type name driver <<< "$selected" + + if ! details="$(vulkaninfo 2>&1)"; then + VMWARE_VULKAN_REASON="Vulkan capability enumeration failed" + return 1 + fi + + for extension in VK_KHR_surface VK_EXT_headless_surface; do + if ! grep -Eq "^[[:space:]]*${extension}[[:space:]:]" <<< "$details"; then + VMWARE_VULKAN_REASON="the Vulkan loader does not support $extension required by VMVGA" + return 1 + fi + done + + for extension in VK_KHR_maintenance5 VK_EXT_robustness2; do + if ! grep -Eq "^[[:space:]]*${extension}[[:space:]:]" <<< "$details"; then + VMWARE_VULKAN_REASON="no Vulkan device exposes $extension required by VMVGA" + return 1 + fi + done + + VMWARE_VULKAN_API="$api" + VMWARE_VULKAN_DEVICE="$name" + VMWARE_VULKAN_DRIVER="$driver" + return 0 +} + +vmvgaGpuSetup() { + + VMWARE_LIBRARY_REASON="" + VMWARE_RENDER_REASON="" + VMWARE_VULKAN_REASON="" + + if ! vmwareRenderNodeReady; then + gpuSetupFailure "VMware GPU acceleration requires a usable host GPU, but $VMWARE_RENDER_REASON" + fi + + local library + for library in libvulkan.so.1 libdxvk_d3d9.so.0 libdxvk_d3d11.so.0; do + if ! vmwareLibraryReady "$library"; then + gpuSetupFailure "VMware GPU acceleration is unavailable because $VMWARE_LIBRARY_REASON" + fi + done + + if ! vmwareVulkanReady; then + gpuSetupFailure "VMware GPU acceleration is unavailable because $VMWARE_VULKAN_REASON" + fi + + echo + info "Hardware rendering enabled:" + info + info "Device: ${VMWARE_VULKAN_DEVICE:-GPU}" + [ -n "${VMWARE_VULKAN_DRIVER:-}" ] && info "Driver: $VMWARE_VULKAN_DRIVER" + info "Vulkan: $VMWARE_VULKAN_API" + + return 0 +} + +vmvgaSetup() { + + if [[ "${BOOT_MODE:-}" == "windows_legacy" ]]; then + DISPLAY_OPTS+=",vgamem_mb=16" + fi + + if enabled "$GPU"; then + + VGPU=$(strip "${VGPU:-}") + + if [ -n "$VGPU" ] && [[ "${VGPU,,}" != "auto" ]]; then + DISPLAY_OPTS+=",vgpu=$VGPU" + fi + + else + + DISPLAY_OPTS+=",3d=off" + + fi + + if enabled "${DEBUG_GPU:-}"; then + DISPLAY_OPTS+=",debug=on" + fi + + return 0 +} + +if [[ "${VGA_DEVICE,,}" == "vmvga" ]]; then + vmvgaSetup +fi + +enabled "$GPU" || return 0 + +msg="Configuring display drivers..." +enabled "$DEBUG" && echo "$msg" + +if [[ "$ARCH" != "amd64" ]]; then + gpuSetupFailure "GPU acceleration is only supported for the AMD64 platform" +fi + +if [[ "${VGA_DEVICE,,}" == "vmvga" ]]; then + vmvgaGpuSetup + return 0 +fi + +if [[ "${BOOT_MODE:-}" == "windows_legacy" ]]; then + gpuSetupFailure "GPU acceleration is not supported by your Windows version" + return 0 +fi + +case "${VGA_DEVICE,,}" in + "none" ) + VGA_DEVICE="virtio-gpu-gl" ;; + "virtio-vga" ) + VGA_DEVICE="virtio-vga-gl" ;; + "virtio-gpu" ) + VGA_DEVICE="virtio-gpu-gl" ;; + "virtio-vga-gl"* | "virtio-gpu-gl"* ) ;; + * ) + gpuSetupFailure "GPU acceleration requires a VirtIO GPU display, but VGA='$VGA'" + return 0 ;; +esac + +VGA="${VGA_DEVICE}${VGA_OPTIONS}" + +VRAM_SIZE="${VRAM_SIZE// /}" +[ -z "$VRAM_SIZE" ] && VRAM_SIZE="4G" + +# Match the size conventions used by RAM_SIZE: small bare values are GiB, +# while larger bare values remain MiB for compatibility with numeric settings. +if [ -z "${VRAM_SIZE//[0-9. ]}" ]; then + [ "${VRAM_SIZE%%.*}" -lt "130" ] && VRAM_SIZE="${VRAM_SIZE}G" || VRAM_SIZE="${VRAM_SIZE}M" +fi + +VRAM_SIZE=$(echo "${VRAM_SIZE^^}" | sed 's/MB/M/g;s/GB/G/g;s/TB/T/g') +if ! VRAM_BYTES=$(numfmt --from=iec "$VRAM_SIZE" 2>/dev/null); then + error "Invalid VRAM_SIZE: $VRAM_SIZE" + exit 16 +fi + +# The host-visible PCI aperture must be a positive power-of-two size. Requiring +# whole MiB also keeps the renderer's advertised VRAM value exact. +if (( VRAM_BYTES < 1048576 || (VRAM_BYTES & (VRAM_BYTES - 1)) != 0 )); then + error "VRAM_SIZE must be a power-of-two size of at least 1M: $VRAM_SIZE" + exit 16 +fi + +VKR_DEVICE_MEMORY_LIMIT_BYTES="$VRAM_BYTES" +override_vram_size="$(( VRAM_BYTES / 1048576 ))" +export VKR_DEVICE_MEMORY_LIMIT_BYTES override_vram_size + +# Return the PCI vendor for a usable DRM render node. Any malformed, missing, +# inaccessible or disappearing node is rejected before hardware rendering is enabled. + +gpuNodeVendor() { + + local node="$1" + + local render_name="${node##*/}" + [[ "$render_name" =~ ^renderD[0-9]{3}$ ]] || return 1 + + local render_number="${render_name#renderD}" + (( 10#$render_number >= 128 )) || return 1 + [ -c "$node" ] || return 1 + + local gpu_fd + if ! { exec {gpu_fd}<>"$node"; } 2>/dev/null; then + return 1 + fi + + { exec {gpu_fd}>&-; } 2>/dev/null || true + + local vendor_file="/sys/class/drm/${render_name}/device/vendor" + [ -r "$vendor_file" ] || return 1 + + if ! IFS= read -r GPU_VENDOR < "$vendor_file"; then + return 1 + fi + + GPU_VENDOR="${GPU_VENDOR,,}" + return 0 +} + +# qemu-render omits Mesa's legacy i915 Gallium driver. Reject the Gen3 Intel +# devices that have no Crocus or Iris fallback before enabling EGL rendering. + +intelMesaReady() { + + local node="$1" + local render_name="${node##*/}" + local device="" + local device_file="/sys/class/drm/${render_name}/device/device" + + [ -r "$device_file" ] || return 1 + IFS= read -r device < "$device_file" || return 1 + + case "${device,,}" in + "0x2582" | "0x258a" | "0x2592" | "0x2772" | "0x27a2" | "0x27ae" | \ + "0x29b2" | "0x29c2" | "0x29d2" | "0xa001" | "0xa011" ) return 1 ;; + esac + + return 0 +} + +vulkanLibraryAvailable() { + + local library="$1" + + compgen -G "/usr/lib/*/${library}" >/dev/null 2>&1 \ + || [ -e "/usr/lib/${library}" ] \ + || [ -e "/usr/lib64/${library}" ] +} + +vulkanManifestAvailable() { + + local manifest="$1" + + compgen -G "/etc/vulkan/icd.d/${manifest}*.json" >/dev/null 2>&1 \ + || compgen -G "/usr/share/vulkan/icd.d/${manifest}*.json" >/dev/null 2>&1 +} + +vulkanRuntimeReady() { + + local summary details selected extensions api type + local external_memory_fd external_memory_dma_buf + local prime="" + local vendor="${GPU_VENDOR,,}" + local device="${GPU_DEVICE,,}" + VULKAN_REASON="" + + if ! command -v vulkaninfo >/dev/null 2>&1; then + VULKAN_REASON="vulkaninfo is not available in the container" + return 1 + fi + + if [ -z "$device" ]; then + VULKAN_REASON="the selected GPU PCI device ID cannot be determined" + return 1 + fi + + # Mesa can scope Vulkan enumeration to the exact DRM device by PCI address. + # Keep this probe local: QEMU still receives the selected render node normally. + case "$vendor" in + "0x8086" | "0x1002" ) + if [[ "$GPU_PCI_SLOT" =~ ^[0-9a-fA-F]{4}:[0-9a-fA-F]{2}:[0-9a-fA-F]{2}\.[0-7]$ ]]; then + prime="pci-${GPU_PCI_SLOT//[:.]/_}!" + fi ;; + esac + + if [ -n "$prime" ]; then + if ! summary="$(DRI_PRIME="$prime" vulkaninfo --summary 2>&1)"; then + VULKAN_REASON="Vulkan device enumeration failed for the selected GPU" + return 1 + fi + elif ! summary="$(vulkaninfo --summary 2>&1)"; then + VULKAN_REASON="Vulkan device enumeration failed" + return 1 + fi + + selected="$(awk -v want_vendor="$vendor" -v want_device="$device" ' + function emit() { + if (!found && in_gpu && tolower(vendor) == want_vendor && + tolower(device) == want_device && api != "" && type != "") { + print api "|" type + found = 1 + } + } + + /^GPU[0-9]+:/ { + emit() + in_gpu = 1 + vendor = "" + device = "" + api = "" + type = "" + next + } + + in_gpu && /^[[:space:]]*apiVersion[[:space:]]*=/ { + api = $0 + sub(/^.*=[[:space:]]*/, "", api) + if (match(api, /\([0-9]+\.[0-9]+(\.[0-9]+)?\)/)) { + api = substr(api, RSTART + 1, RLENGTH - 2) + } else { + sub(/[[:space:]].*$/, "", api) + } + next + } + + in_gpu && /^[[:space:]]*vendorID[[:space:]]*=/ { + vendor = $0 + sub(/^.*=[[:space:]]*/, "", vendor) + sub(/[[:space:]].*$/, "", vendor) + next + } + + in_gpu && /^[[:space:]]*deviceID[[:space:]]*=/ { + device = $0 + sub(/^.*=[[:space:]]*/, "", device) + sub(/[[:space:]].*$/, "", device) + next + } + + in_gpu && /^[[:space:]]*deviceType[[:space:]]*=/ { + type = $0 + sub(/^.*=[[:space:]]*/, "", type) + sub(/[[:space:]].*$/, "", type) + next + } + + END { emit() } + ' <<< "$summary")" + + if [ -z "$selected" ]; then + VULKAN_REASON="the selected GPU is not available through Vulkan" + return 1 + fi + + IFS='|' read -r api type <<< "$selected" + if [[ "$type" == "PHYSICAL_DEVICE_TYPE_CPU" ]]; then + VULKAN_REASON="the selected Vulkan device is a software CPU renderer" + return 1 + fi + + local major minor + IFS='.' read -r major minor _ <<< "$api" + if ! [[ "$major" =~ ^[0-9]+$ && "$minor" =~ ^[0-9]+$ ]]; then + VULKAN_REASON="the selected GPU reports an invalid Vulkan API version '$api'" + return 1 + fi + + if (( major < 1 || (major == 1 && minor < 1) )); then + VULKAN_REASON="the selected GPU supports Vulkan $major.$minor, but Venus requires Vulkan 1.1 or newer" + return 1 + fi + + if [ -n "$prime" ]; then + if ! details="$(DRI_PRIME="$prime" vulkaninfo 2>&1)"; then + VULKAN_REASON="Vulkan capability enumeration failed for the selected GPU" + return 1 + fi + elif ! details="$(vulkaninfo 2>&1)"; then + VULKAN_REASON="Vulkan capability enumeration failed" + return 1 + fi + + extensions="$(awk -v want_vendor="$vendor" -v want_device="$device" ' + function finish() { + if (!found && in_gpu && tolower(vendor) == want_vendor && + tolower(device) == want_device) { + print external_memory_fd "|" external_memory_dma_buf + found = 1 + } + } + + /^GPU[0-9]+:/ { + finish() + in_gpu = 1 + vendor = "" + device = "" + external_memory_fd = 0 + external_memory_dma_buf = 0 + next + } + + in_gpu && /^[[:space:]]*vendorID[[:space:]]*=/ { + vendor = $0 + sub(/^.*=[[:space:]]*/, "", vendor) + sub(/[[:space:]].*$/, "", vendor) + next + } + + in_gpu && /^[[:space:]]*deviceID[[:space:]]*=/ { + device = $0 + sub(/^.*=[[:space:]]*/, "", device) + sub(/[[:space:]].*$/, "", device) + next + } + + in_gpu && /VK_KHR_external_memory_fd/ { + external_memory_fd = 1 + next + } + + in_gpu && /VK_EXT_external_memory_dma_buf/ { + external_memory_dma_buf = 1 + next + } + + END { + finish() + } + ' <<< "$details")" + + IFS='|' read -r external_memory_fd external_memory_dma_buf <<< "$extensions" + + if [[ "$external_memory_fd" != "1" ]]; then + VULKAN_REASON="the selected GPU does not support VK_KHR_external_memory_fd required by Venus" + return 1 + fi + + if [[ "$external_memory_dma_buf" != "1" ]]; then + VULKAN_REASON="the selected GPU does not support VK_EXT_external_memory_dma_buf required by Helios" + return 1 + fi + + return 0 +} + +mesaVulkanReady() { + + local vendor="$1" + local library manifest + VULKAN_REASON="" + + if ! vulkanLibraryAvailable "libvulkan.so.1"; then + VULKAN_REASON="the Vulkan loader is not available in the container" + return 1 + fi + + case "$vendor" in + "0x8086" ) + for library in libvulkan_intel.so libvulkan_intel_hasvk.so; do + if ! vulkanLibraryAvailable "$library"; then + VULKAN_REASON="the Intel Vulkan driver library '$library' is not available in the container" + return 1 + fi + done + + for manifest in intel_icd intel_hasvk_icd; do + if ! vulkanManifestAvailable "$manifest"; then + VULKAN_REASON="the Intel Vulkan ICD '$manifest' is not available in the container" + return 1 + fi + done ;; + + "0x1002" ) + if ! vulkanLibraryAvailable "libvulkan_radeon.so"; then + VULKAN_REASON="the AMD Vulkan driver library 'libvulkan_radeon.so' is not available in the container" + return 1 + fi + + if ! vulkanManifestAvailable "radeon_icd"; then + VULKAN_REASON="the AMD Vulkan ICD 'radeon_icd' is not available in the container" + return 1 + fi ;; + esac + + vulkanRuntimeReady || return 1 + + return 0 +} + +# NVIDIA uses the proprietary host driver injected by NVIDIA Container Toolkit +# rather than a Mesa Gallium driver from qemu-minimal. Require the complete EGL +# and GBM path before selecting an NVIDIA render node. Venus additionally needs +# the Vulkan loader, NVIDIA ICD and NVIDIA Vulkan userspace libraries. + +nvidiaDriverVersion() { + + local data="" + NVIDIA_DRIVER_VERSION="" + + if [ -r /proc/driver/nvidia/version ]; then + data="$(head -n 1 /proc/driver/nvidia/version 2>/dev/null || true)" + elif [ -r /sys/module/nvidia/version ]; then + data="$(cat /sys/module/nvidia/version 2>/dev/null || true)" + fi + + if [[ "$data" =~ ([0-9]{3,})\.([0-9]+)(\.[0-9]+)? ]]; then + NVIDIA_DRIVER_VERSION="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}${BASH_REMATCH[3]:-}" + return 0 + fi + + return 1 +} + +nvidiaVulkanReady() { + + local icd="" + local major minor + + if ! nvidiaDriverVersion; then + NVIDIA_REASON="the NVIDIA driver version cannot be determined" + return 1 + fi + +if ! [[ "$NVIDIA_DRIVER_VERSION" =~ ^([0-9]+)\.([0-9]+) ]]; then + NVIDIA_REASON="the NVIDIA driver version '$NVIDIA_DRIVER_VERSION' could not be parsed" + return 1 +fi +major="${BASH_REMATCH[1]}" +minor="${BASH_REMATCH[2]}" + + if (( major < 570 || (major == 570 && minor < 86) )); then + NVIDIA_REASON="NVIDIA driver $NVIDIA_DRIVER_VERSION is older than the 570.86 minimum required by Venus" + return 1 + fi + + if ! compgen -G '/usr/lib/*/libvulkan.so.1' >/dev/null 2>&1 \ + && [ ! -e /usr/lib/libvulkan.so.1 ] \ + && [ ! -e /usr/lib64/libvulkan.so.1 ]; then + NVIDIA_REASON="the Vulkan loader is not available in the container" + return 1 + fi + + for icd in /etc/vulkan/icd.d/nvidia_icd*.json /usr/share/vulkan/icd.d/nvidia_icd*.json; do + [ -r "$icd" ] && break + icd="" + done + + if [ -z "$icd" ]; then + NVIDIA_REASON="the NVIDIA Vulkan ICD is not available in the container" + return 1 + fi + + if ! compgen -G '/usr/lib/*/libGLX_nvidia.so.*' >/dev/null 2>&1 \ + && ! compgen -G '/usr/lib/*/nvidia/*/libGLX_nvidia.so.*' >/dev/null 2>&1 \ + && ! compgen -G '/usr/lib/nvidia/*/libGLX_nvidia.so.*' >/dev/null 2>&1 \ + && ! compgen -G '/usr/lib/libGLX_nvidia.so.*' >/dev/null 2>&1 \ + && ! compgen -G '/usr/lib64/nvidia/*/libGLX_nvidia.so.*' >/dev/null 2>&1 \ + && ! compgen -G '/usr/lib64/libGLX_nvidia.so.*' >/dev/null 2>&1; then + NVIDIA_REASON="the NVIDIA Vulkan driver library is not available in the container" + return 1 + fi + + if ! compgen -G '/usr/lib/*/libnvidia-glvkspirv.so.*' >/dev/null 2>&1 \ + && ! compgen -G '/usr/lib/*/nvidia/*/libnvidia-glvkspirv.so.*' >/dev/null 2>&1 \ + && ! compgen -G '/usr/lib/nvidia/*/libnvidia-glvkspirv.so.*' >/dev/null 2>&1 \ + && ! compgen -G '/usr/lib/libnvidia-glvkspirv.so.*' >/dev/null 2>&1 \ + && ! compgen -G '/usr/lib64/nvidia/*/libnvidia-glvkspirv.so.*' >/dev/null 2>&1 \ + && ! compgen -G '/usr/lib64/libnvidia-glvkspirv.so.*' >/dev/null 2>&1; then + NVIDIA_REASON="the NVIDIA Vulkan SPIR-V compiler library is not available in the container" + return 1 + fi + + if ! vulkanRuntimeReady; then + NVIDIA_REASON="$VULKAN_REASON" + return 1 + fi + + return 0 +} + +nvidiaGpuReady() { + + local modeset="" + NVIDIA_REASON="" + + if ! compgen -G '/usr/lib/*/libEGL_nvidia.so.*' >/dev/null 2>&1 \ + && ! compgen -G '/usr/lib/libEGL_nvidia.so.*' >/dev/null 2>&1 \ + && ! compgen -G '/usr/lib64/libEGL_nvidia.so.*' >/dev/null 2>&1; then + NVIDIA_REASON="the NVIDIA EGL driver is not available in the container" + return 1 + fi + + if ! compgen -G '/usr/lib/*/libnvidia-egl-gbm.so.*' >/dev/null 2>&1 \ + && ! compgen -G '/usr/lib/libnvidia-egl-gbm.so.*' >/dev/null 2>&1 \ + && ! compgen -G '/usr/lib64/libnvidia-egl-gbm.so.*' >/dev/null 2>&1; then + NVIDIA_REASON="the NVIDIA EGL GBM platform library is not available in the container" + return 1 + fi + + if ! compgen -G '/usr/lib/*/gbm/nvidia-drm_gbm.so' >/dev/null 2>&1 \ + && [ ! -e /usr/lib/gbm/nvidia-drm_gbm.so ] \ + && [ ! -e /usr/lib64/gbm/nvidia-drm_gbm.so ]; then + NVIDIA_REASON="the NVIDIA GBM backend is not available in the container" + return 1 + fi + + if [ ! -r /usr/share/glvnd/egl_vendor.d/10_nvidia.json ] \ + || [ ! -r /usr/share/egl/egl_external_platform.d/15_nvidia_gbm.json ]; then + NVIDIA_REASON="the NVIDIA EGL vendor configuration is not available in the container" + return 1 + fi + + if [ ! -r /sys/module/nvidia_drm/parameters/modeset ] \ + || ! IFS= read -r modeset < /sys/module/nvidia_drm/parameters/modeset; then + NVIDIA_REASON="the nvidia-drm KMS state cannot be determined" + return 1 + fi + + case "${modeset,,}" in + "y" | "1" ) ;; + * ) + NVIDIA_REASON="nvidia-drm modesetting is disabled" + return 1 ;; + esac + + return 0 +} + +hostBlobsSupported() { + + kernelAtLeast 6 13 +} + +venusGuestPatRequired() { + + local cpu_vendor driver device="" + + # TCG does not use the Intel KVM guest-PAT quirk. + disabled "${KVM:-}" && return 1 + + isIntelCpu || return 1 + + case "$GPU_VENDOR" in + "0x1002" | "0x10de" ) + # RADV/NVIDIA dGPU on an Intel CPU. + return 0 ;; + "0x8086" ) + driver=$(readlink -f "/sys/class/drm/${RENDER_NAME}/device/driver" 2>/dev/null || true) + driver="${driver##*/}" + [[ "$driver" == "xe" ]] && return 0 + + if [ -r "/sys/class/drm/${RENDER_NAME}/device/device" ]; then + IFS= read -r device < "/sys/class/drm/${RENDER_NAME}/device/device" || device="" + device="${device,,}" + fi + + # Meteor Lake requires guest PAT even when it is still using i915. + case "$device" in + "0x7d40" | "0x7d45" | "0x7d55" | "0x7d60" | "0x7dd5" ) return 0 ;; + esac ;; + esac + + return 1 +} + +venusGuestPatReady() { + + VULKAN_PAT_REASON="" + venusGuestPatRequired || return 0 + + if ! hasFlag "ss"; then + VULKAN_PAT_REASON="the Intel CPU cannot safely honor guest PAT because self-snoop is unavailable" + return 1 + fi + + if ! kernelAtLeast 6 16; then + VULKAN_PAT_REASON="Linux 6.16 or newer is required for guest PAT support on this Intel CPU/GPU combination" + return 1 + fi + + VIRTGPU_GUEST_PAT="Y" + return 0 +} + +GPU_VENDOR="" +NVIDIA_NODE="" +NVIDIA_REASON="" +VULKAN_REASON="" +VULKAN_PAT_REASON="" +VIRTGPU_GUEST_PAT="" + +if [ -n "$RENDERNODE" ]; then + + if ! gpuNodeVendor "$RENDERNODE"; then + gpuSetupFailure "GPU render node '$RENDERNODE' is unavailable or inaccessible" + return 0 + fi + + case "$GPU_VENDOR" in + "0x8086" ) + if ! intelMesaReady "$RENDERNODE"; then + gpuSetupFailure "Intel GPU at $RENDERNODE is not supported by qemu-render" + return 0 + fi ;; + "0x1002" ) ;; + "0x10de" ) + if ! nvidiaGpuReady; then + gpuSetupFailure "NVIDIA GPU at $RENDERNODE cannot be used for hardware rendering because $NVIDIA_REASON" + return 0 + fi ;; + * ) + gpuSetupFailure "Unsupported GPU at $RENDERNODE" + return 0 ;; + esac + +else + + if [ ! -d /dev/dri ]; then + gpuSetupFailure "GPU acceleration was requested, but '/dev/dri' was not added to the devices section of your compose file" + return 0 + fi + + RENDER_NODE_FOUND="N" + + for node in /dev/dri/renderD*; do + + [ -e "$node" ] || continue + RENDER_NODE_FOUND="Y" + + if ! gpuNodeVendor "$node"; then + continue + fi + + case "$GPU_VENDOR" in + "0x8086" ) + if intelMesaReady "$node"; then + RENDERNODE="$node" + break + fi ;; + "0x1002" ) + RENDERNODE="$node" + break ;; + "0x10de" ) + NVIDIA_NODE="$node" + if nvidiaGpuReady; then + RENDERNODE="$node" + break + fi ;; + esac + + done + + if [ -z "$RENDERNODE" ]; then + + if [ -n "$NVIDIA_NODE" ] && [ -n "$NVIDIA_REASON" ]; then + gpuSetupFailure "NVIDIA GPU at $NVIDIA_NODE cannot be used for hardware rendering because $NVIDIA_REASON" + elif [[ "$RENDER_NODE_FOUND" != "Y" ]]; then + gpuSetupFailure "/dev/dri is available, but no GPU render nodes were found" + else + gpuSetupFailure "No usable GPU render node found" + fi + + return 0 + fi + +fi + +# Re-read the selected node after auto-detection so the vendor name and device +# number below are based on the final render node and survive hotplug races. +if ! gpuNodeVendor "$RENDERNODE"; then + gpuSetupFailure "GPU render node '$RENDERNODE' became unavailable" + return 0 +fi + +RENDER_NAME="${RENDERNODE##*/}" +CARD_NUMBER="${RENDER_NAME#renderD}" +GPU_DEVICE="" +GPU_DRIVER="" + +if [ -r "/sys/class/drm/${RENDER_NAME}/device/device" ]; then + IFS= read -r GPU_DEVICE < "/sys/class/drm/${RENDER_NAME}/device/device" || GPU_DEVICE="" + GPU_DEVICE="${GPU_DEVICE,,}" +fi + +GPU_DRIVER=$(readlink -f "/sys/class/drm/${RENDER_NAME}/device/driver" 2>/dev/null || true) +GPU_DRIVER="${GPU_DRIVER##*/}" +GPU_DEVICE_NAME="" +GPU_PCI_SLOT=$(readlink -f "/sys/class/drm/${RENDER_NAME}/device" 2>/dev/null || true) +GPU_PCI_SLOT="${GPU_PCI_SLOT##*/}" + +if [[ "$GPU_PCI_SLOT" =~ ^[0-9a-fA-F]{4}:[0-9a-fA-F]{2}:[0-9a-fA-F]{2}\.[0-7]$ ]]; then + GPU_DEVICE_NAME=$(lspci -D -s "$GPU_PCI_SLOT" -vmm 2>/dev/null \ + | sed -n 's/^Device:[[:space:]]*//p' | head -n 1 || true) +fi + +case "$GPU_VENDOR" in + "0x8086" ) GPU_NAME="Intel" ;; + "0x1002" ) GPU_NAME="AMD" ;; + "0x10de" ) GPU_NAME="NVIDIA" ;; + * ) GPU_NAME="GPU" ;; +esac + +if [ ! -d /dev/dri ]; then + mkdir -m 755 /dev/dri 2>/dev/null || true +fi + +# Derive the matching DRM card from the validated render node number. +CARD_DEVICE="/dev/dri/card$((10#$CARD_NUMBER - 128))" + +# Containers normally have no udev, so reconstruct the matching DRM card and +# render character devices from the render-node minor number when necessary. +if [ ! -c "$CARD_DEVICE" ]; then + if mknod "$CARD_DEVICE" c 226 $((10#$CARD_NUMBER - 128)) 2>/dev/null; then + chmod 666 "$CARD_DEVICE" 2>/dev/null || true + fi +fi + +if [ ! -c "$RENDERNODE" ]; then + if mknod "$RENDERNODE" c 226 "$((10#$CARD_NUMBER))" 2>/dev/null; then + chmod 666 "$RENDERNODE" 2>/dev/null || true + fi +fi + +if ! gpuNodeVendor "$RENDERNODE"; then + gpuSetupFailure "GPU render node '$RENDERNODE' became unavailable" + return 0 +fi + +if ! hostBlobsSupported; then + gpuSetupFailure "Windows GPU acceleration requires virtio-gpu host blobs (Linux 6.13+ host kernel)" +fi + +VGA+=",hostmem=$VRAM_BYTES,max_hostmem=$VRAM_BYTES,blob=true" +VGA+=",host3d_blob_limit=$VRAM_BYTES" + +case "$GPU_VENDOR" in + "0x8086" | "0x1002" ) + if ! mesaVulkanReady "$GPU_VENDOR"; then + gpuSetupFailure "Windows GPU acceleration requires Vulkan via Venus, but $VULKAN_REASON" + fi ;; + "0x10de" ) + if ! nvidiaVulkanReady; then + gpuSetupFailure "Windows GPU acceleration requires Vulkan via Venus, but $NVIDIA_REASON" + fi ;; +esac + +if ! venusGuestPatReady; then + gpuSetupFailure "Windows GPU acceleration requires Vulkan via Venus, but $VULKAN_PAT_REASON" +fi + +VGA+=",venus=true" + +echo +info "Hardware rendering enabled:" +info + +info "Device: $GPU_NAME${GPU_DEVICE_NAME:+ $GPU_DEVICE_NAME}" + +if [ -n "$GPU_DEVICE" ]; then + info "PCI ID: ${GPU_VENDOR#0x}:${GPU_DEVICE#0x}" +fi + +info "Driver: ${GPU_DRIVER:-unknown}" + +if [[ "$GPU_VENDOR" == "0x10de" ]]; then + nvidiaDriverVersion || NVIDIA_DRIVER_VERSION="unknown" + info "Version: $NVIDIA_DRIVER_VERSION" +else + MESA_VERSION="$(dpkg-query -W -f='${Provides}\n' qemu-render 2>/dev/null \ + | sed -n 's/.*libgbm1 (= \([^)]*\)).*/\1/p' || true)" + + [ -n "$MESA_VERSION" ] && info "Mesa: $MESA_VERSION" +fi + +info "Render: $RENDERNODE" + +DISPLAY_OPTS="-display egl-headless,rendernode=$RENDERNODE" +DISPLAY_OPTS+=" -device $VGA" + +[[ "${DISPLAY,,}" == "vnc" ]] && DISPLAY_OPTS+=" -vnc :${port}${LOSSY_OPT}" +[[ "${DISPLAY,,}" == "web" ]] && DISPLAY_OPTS+=" -vnc :${port},websocket=unix:${WSS_SOCKET}${LOSSY_OPT}" + +return 0 diff --git a/src/install.sh b/src/install.sh index b9cdd1c9..a660763a 100644 --- a/src/install.sh +++ b/src/install.sh @@ -1423,8 +1423,7 @@ addDrivers() { fi if ! bsdtar -xf /var/drivers.txz -C "$drivers" \ - --exclude='win9x' --exclude='sata' --exclude='qbochs' \ - --exclude='vmsvga'; then + --exclude='win9x' --exclude='sata' --exclude='qbochs'; then error "Failed to extract drivers from archive!" && return 1 fi @@ -1439,11 +1438,10 @@ addDrivers() { mkdir -p "$dst" || return 1 cp -Lr "$dest/." "$dst" || return 1 - # Install the VirtIO display driver explicitly from SetupComplete.cmd so it + # Install display drivers explicitly from Unattend.cmd so it # cannot disrupt Windows Setup by loading through the WinPE driver path. - if ! isLegacy "$version"; then - rm -rf "$dest/viogpudo" || return 1 - fi + rm -rf "$dest/vmsvga" || return 1 + rm -rf "$dest/viogpudo" || return 1 local winpe="$stage/$target" rm -rf "$winpe" || return 1 @@ -1470,6 +1468,7 @@ selectDrivers() { viorng viostor viomem + vmsvga NetKVM Balloon vioscsi @@ -1723,8 +1722,10 @@ setDiskMinimum() { local id="$1" local required - required=$(getRequiredDisk "$id") || return - DISK_MINIMUM="$required" + if [ -z "${DISK_MINIMUM:-}" ]; then + required=$(getRequiredDisk "$id") || return + DISK_MINIMUM="$required" + fi return 0 } diff --git a/src/legacy.sh b/src/legacy.sh index 4b8d110a..81cc9241 100644 --- a/src/legacy.sh +++ b/src/legacy.sh @@ -26,18 +26,6 @@ setMachine() { esac - case "${id,,}" in - - "winnt4" ) - writeState "vga" "cirrus" || return 1 ;; - - "win9"* | "win2k"* | "winxp"* | "win2003"* ) - writeState "vga" "vmware" || return 1 ;; - - *) writeState "vga" "std" || return 1 ;; - - esac - case "${id,,}" in "win9"* | "winnt4" ) @@ -76,6 +64,19 @@ setMachine() { esac fi + case "${id,,}" in + + "winnt4" ) + writeState "vga" "cirrus" || return 1 ;; + + "win9"* | "win2k"* | "winxp"* | \ + "win2003"* | "win2008"* | "win2012"*| \ + "winvista"* | "win7"* | "win8"* | "reactos" ) + + writeState "vga" "vmvga" || return 1 ;; + + esac + restoreMachine || return 1 restoreBootMode || return 1 diff --git a/src/sif.sh b/src/sif.sh index bcb8dd55..0f14af0f 100644 --- a/src/sif.sh +++ b/src/sif.sh @@ -301,19 +301,15 @@ addVMSVGADriver() { local drivers="$4" local vmsvga_arch="$arch" - [[ "${vmsvga_arch,,}" == "amd64" ]] && vmsvga_arch="x64" - local source="$drivers/vmsvga/$driver/$vmsvga_arch" - local destination="$dir/\$OEM\$/\$1/Drivers/VMSVGA" + local destination="$dir/\$OEM\$/\$1/Drivers/vmsvga" if [ ! -d "$source" ]; then error "Failed to locate required VMware SVGA display driver directory: $source" return 1 fi - local files="vmx_svgaver.dll vmx_svga.cat vmx_mode.dll vmx_svga.sys vmwogl32.dll vmx_fb.dll vmx_svga.inf" - [[ "$vmsvga_arch" == "x64" ]] && files+=" vmwogl64.dll" - + local files="vmx_svgaver.dll vmx_svga.cat vmx_mode.dll vmx_svga.sys vmx_fb.dll vmx_svga.inf" local file for file in $files; do @@ -339,8 +335,6 @@ addDisplayDriver() { local drivers="$4" local qbochs_arch="$arch" - [[ "${qbochs_arch,,}" == "amd64" ]] && qbochs_arch="x64" - local source="$drivers/qbochs/$driver/$qbochs_arch" local destination="$dir/\$OEM\$/\$1/Drivers/QBochs"