chore(deps): update docker/dockerfile docker tag to v1.28

* Update install.sh

* Update answer.sh

.devcontainer/010 - Windows 11 Enterprise/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows 11 Enterprise",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "11e"
+  },
+  "forwardPorts": [8006],  
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/020 - Windows 11 LTSC/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows 11 LTSC",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "11l"
+  },
+  "forwardPorts": [8006],  
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/030 - Windows 10 Pro/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows 10 Pro",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "10"
+  },
+  "forwardPorts": [8006],  
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/040 - Windows 10 Enterprise/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows 10 Enterprise",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "10e"
+  },
+  "forwardPorts": [8006],  
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/050 - Windows 10 LTSC/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows 10 LTSC",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "10l"
+  },
+  "forwardPorts": [8006],  
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/060 - Windows 8.1 Enterprise/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows 8.1 Enterprise",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "8e"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/070 - Windows 7 Ultimate/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows 7 Ultimate",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "7u"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/080 - Windows Vista Ultimate/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows Vista Ultimate",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "vu"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/090 - Windows XP Professional/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows XP Professional",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "xp"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/100 - Windows 2000 Professional/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows 2000 Professional",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "2k"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/102 - Windows ME/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows ME",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "me"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/104 - Windows 98/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows 98",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "98"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/106 - Windows 95/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows 95",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "95"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/110 - Windows Server 2025/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows Server 2025",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "2025"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/120 - Windows Server 2022/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows Server 2022",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "2022"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/130 - Windows Server 2019/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows Server 2019",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "2019"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/140 - Windows Server 2016/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows Server 2016",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "2016"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/150 - Windows Server 2012 R2/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows Server 2012 R2",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "2012"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/160 - Windows Server 2008 R2/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows Server 2008 R2",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "2008"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/170 - Windows Server 2003/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows Server 2003",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "2003"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/180 - Tiny11 Core/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Tiny11 Core",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "core11"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/190 - Tiny11/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Tiny11",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "tiny11"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/200 - Tiny10/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Tiny10",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "tiny10"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/210 - Reactos/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Reactos",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "reactos"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/codespaces.yml

@@ -0,0 +1,22 @@
+services:
+  windows:
+    container_name: windows
+    image: ghcr.io/dockur/windows
+    environment:
+      RAM_SIZE: "half"
+      DISK_SIZE: "max"
+      CPU_CORES: "max"
+      DISK_MINIMUM: "1G"
+    devices:
+      - /dev/kvm
+      - /dev/net/tun
+    cap_add:
+      - NET_ADMIN
+    ports:
+      - 8006:8006
+      - 3389:3389/tcp
+      - 3389:3389/udp
+    volumes:
+      - ./windows:/storage
+    restart: on-failure
+    stop_grace_period: 2m

.devcontainer/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Windows 11 Pro",
+  "service": "windows",
+  "containerEnv": {
+    "VERSION": "11"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  },
+  "dockerComposeFile": "codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.dockerignore

@@ -1,4 +1,5 @@
 .dockerignore
+.devcontainer
 .git
 .github
 .gitignore

.github/ISSUE_TEMPLATE/1-issue.yml

@@ -21,6 +21,7 @@ body:
     attributes:
       label: Docker compose
       description: The compose file (or otherwise the `docker run` command used).
+      render: yaml
     validations:
       required: true
   - type: textarea
@@ -28,6 +29,7 @@ body:
     attributes:
       label: Docker log
       description: The logfile of the container (as shown by `docker logs windows`).
+      render: shell
     validations:
       required: true
   - type: textarea

.github/ISSUE_TEMPLATE/3-bug.yml

@@ -23,6 +23,7 @@ body:
     attributes:
       label: Docker compose
       description: The compose file (or otherwise the `docker run` command used).
+      render: yaml
     validations:
       required: true
   - type: textarea
@@ -30,6 +31,7 @@ body:
     attributes:
       label: Docker log
       description: The logfile of the container (as shown by `docker logs windows`).
+      render: shell
     validations:
       required: true
   - type: textarea

.github/dependabot.yml

@@ -1,10 +1,21 @@
 version: 2
+
 updates:
   - package-ecosystem: docker
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
+
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-minor
+          - version-update:semver-patch

.github/workflows/build.yml

@@ -2,16 +2,6 @@ name: Build
 
 on:
   workflow_dispatch:
-  push:
-    branches:
-      - master
-    paths-ignore:
-      - '**/*.md'
-      - '**/*.yml'
-      - '.gitignore'
-      - '.dockerignore'
-      - '.github/**'
-      - '.github/workflows/**'
 
 concurrency:
   group: build
@@ -32,13 +22,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       -
         name: Docker metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           context: git
           images: |
@@ -53,23 +43,23 @@ jobs:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
       - 
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       -
         name: Login into Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       -
         name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Build Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: true

.github/workflows/check.yml

@@ -1,5 +1,7 @@
 on: [workflow_call]
+
 name: "Check"
+
 permissions: {}
 
 jobs:
@@ -7,19 +9,34 @@ jobs:
     name: shellcheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      -
-      - name: Run ShellCheck
+        name: Checkout
+        uses: actions/checkout@v7
+      - parallel:
+          -
+            name: Run ShellCheck
             uses: ludeeus/action-shellcheck@master
             env:
-          SHELLCHECK_OPTS: -x --source-path=src -e SC1091 -e SC2001 -e SC2002 -e SC2034 -e SC2064 -e SC2153 -e SC2317 -e SC2028
+              SHELLCHECK_OPTS: >-
-      - name: Validate XML
+                -x
+                --source-path=src
+                -e SC1091
+                -e SC2034
+                -e SC2153
+                -e SC2317
+          -
+            name: Lint Dockerfile
+            uses: hadolint/[email protected]
+            with:
+              dockerfile: Dockerfile
+              ignore: DL3006,DL3008,DL3067
+              failure-threshold: warning
+          -
+            name: Validate XML
             uses: action-pack/valid-xml@v1
             with:
               path: "assets"
               file-endings: ".xml"
-      - name: Lint Dockerfile
+          -
-        uses: hadolint/[email protected]
+            name: Validate JSON and YML files
-        with:
+            uses: GrantBirki/json-yaml-validate@v5
-          dockerfile: Dockerfile
-          ignore: DL3008
-          failure-threshold: warning

.github/workflows/hub.yml

@@ -12,10 +12,12 @@ jobs:
   dockerHubDescription:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+      -
+        name: Checkout repo
+        uses: actions/checkout@v7
       - 
         name: Docker Hub Description
-      uses: peter-evans/dockerhub-description@v4
+        uses: peter-evans/dockerhub-description@v5
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/links.yml

@@ -0,0 +1,259 @@
+name: Links
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * *'
+
+concurrency:
+  group: links
+  cancel-in-progress: false
+
+jobs:
+  links:
+    name: Links
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      packages: read
+      contents: read
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      -
+        name: Install aria2
+        run: |
+          if ! command -v aria2c > /dev/null; then
+            sudo apt-get update -qq
+            sudo apt-get install -qq --no-install-recommends -y aria2
+          fi
+      -
+        name: Validate all download mirrors
+        id: validate
+        run: |
+          errors=0
+          tested=0
+          host=""
+          failed_links=""
+          failed_links_html=""
+          declare -A seen
+
+          ignored_domains=(
+            files.dog
+          )
+
+          check() {
+            local url="$1"
+            local agent="Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0"
+            local tmp output pid blocks bytes rc status delay
+            local attempt=1
+            local attempts=3
+            local start
+
+            tmp=$(mktemp -d)
+
+            while (( attempt <= attempts )); do
+              output="$tmp/aria2.log"
+              rm -f -- "$tmp/probe" "$tmp/probe.aria2" "$output"
+              start=$SECONDS
+
+              aria2c \
+                --no-conf=true \
+                --connect-timeout=30 \
+                --timeout=30 \
+                --max-tries=2 \
+                --retry-wait=2 \
+                --async-dns=false \
+                --follow-metalink=false \
+                --follow-torrent=false \
+                --user-agent="$agent" \
+                --split=4 \
+                --max-connection-per-server=4 \
+                --file-allocation=none \
+                --allow-overwrite=true \
+                --auto-file-renaming=false \
+                --continue=false \
+                --dir="$tmp" \
+                --out=probe \
+                --console-log-level=error \
+                --summary-interval=0 \
+                --download-result=hide \
+                --show-console-readout=false \
+                --enable-color=false \
+                -- "$url" > "$output" 2>&1 &
+              pid=$!
+
+              while kill -0 "$pid" 2>/dev/null; do
+                if [[ -f "$tmp/probe" ]]; then
+                  blocks=$(stat -c '%b' "$tmp/probe" 2>/dev/null || echo 0)
+                  bytes=$((blocks * 512))
+
+                  if (( bytes >= 1048576 )); then
+                    kill "$pid" 2>/dev/null || true
+                    wait "$pid" 2>/dev/null || true
+                    rm -rf -- "$tmp"
+                    return 0
+                  fi
+                fi
+
+                if (( SECONDS - start >= 60 )); then
+                  kill "$pid" 2>/dev/null || true
+                  break
+                fi
+
+                sleep 0.2
+              done
+
+              if wait "$pid"; then
+                rc=0
+              else
+                rc=$?
+              fi
+
+              blocks=0
+
+              if [[ -f "$tmp/probe" ]]; then
+                blocks=$(stat -c '%b' "$tmp/probe" 2>/dev/null || echo 0)
+              fi
+
+              bytes=$((blocks * 512))
+
+              if (( bytes >= 1048576 || (rc == 0 && bytes > 0) )); then
+                rm -rf -- "$tmp"
+                return 0
+              fi
+
+              status=$(sed -n 's/.*status=\([0-9][0-9][0-9]\).*/\1/p' "$output" | tail -n 1)
+
+              if (( attempt < attempts )) && [[ "$status" == "429" || "$status" == 5?? ]]; then
+                delay=$((attempt * 15))
+                echo "      HTTP ${status}, retrying in ${delay} seconds..." >&2
+                sleep "$delay"
+                attempt=$((attempt + 1))
+                continue
+              fi
+
+              sed 's/^/      /' "$output" >&2
+              echo "      Downloaded bytes: $bytes" >&2
+              echo "      aria2c exit status: $rc" >&2
+              rm -rf -- "$tmp"
+              return 1
+            done
+
+            rm -rf -- "$tmp"
+            return 1
+          }
+
+          isIgnoredDomain() {
+            local url="$1"
+            local domain ignored
+
+            domain="${url#*://}"
+            domain="${domain%%/*}"
+            domain="${domain%%:*}"
+            domain="${domain,,}"
+
+            for ignored in "${ignored_domains[@]}"; do
+              if [[ "$domain" == "$ignored" || "$domain" == *."$ignored" ]]; then
+                return 0
+              fi
+            done
+
+            return 1
+          }
+
+          while IFS= read -r line; do
+            if [[ "$line" =~ ^[[:space:]]*local[[:space:]]+host=\"(https://[^\"]+)\" ]]; then
+              host="${BASH_REMATCH[1]%/}"
+              continue
+            fi
+
+            [[ "$line" =~ ^[[:space:]]*url=\"(.+)\" ]] || continue
+            val="${BASH_REMATCH[1]#/}"
+
+            if [[ "$val" == https://* ]]; then
+              url="$val"
+            elif [[ -n "$host" ]]; then
+              url="$host/$val"
+            else
+              continue
+            fi
+
+            [[ -v seen[$url] ]] && continue
+            seen[$url]=1
+
+            if isIgnoredDomain "$url"; then
+              echo "SKIP: $url"
+              continue
+            fi
+
+            tested=$((tested + 1))
+
+            if check "$url"; then
+              echo "  OK: $url"
+            else
+              echo "FAIL: $url"
+              errors=$((errors + 1))
+              failed_links+="$url"$'\n'
+              failed_links_html+="<li><a href=\"$url\">$url</a></li>"$'\n'
+            fi
+
+            sleep 2
+          done < "src/define.sh"
+
+          echo ""
+          printf '%d/%d tested links valid\n' "$((tested - errors))" "$tested"
+
+          if (( errors > 0 )); then
+            printf '%d blocking failure(s)\n' "$errors"
+
+            {
+              echo "failed=true"
+              echo "links<<EOF"
+              printf '%s' "$failed_links"
+              echo "EOF"
+              echo "html_links<<EOF"
+              printf '%s' "$failed_links_html"
+              echo "EOF"
+            } >> "$GITHUB_OUTPUT"
+          else
+            echo "failed=false" >> "$GITHUB_OUTPUT"
+          fi
+      -
+        name: Send mail
+        if: steps.validate.outputs.failed == 'true'
+        uses: action-pack/send-mail@v1
+        with:
+          to: ${{secrets.MAILTO}}
+          from: Github Actions <${{secrets.MAILTO}}>
+          connection_url: ${{secrets.MAIL_CONNECTION}}
+          subject: Mirror verification failed!
+          body: |
+            Mirror verification failed!
+
+            The following links failed:
+
+            ${{ steps.validate.outputs.links }}
+
+            See https://github.com/${{ github.repository }}/actions for more information.
+          html_body: |
+            <p>Mirror verification failed!</p>
+
+            <p>The following links failed:</p>
+
+            <ul>
+            ${{ steps.validate.outputs.html_links }}
+            </ul>
+
+            <p>
+              See
+              <a href="https://github.com/${{ github.repository }}/actions">GitHub Actions</a>
+              for more information.
+            </p>
+      -
+        name: Fail workflow
+        if: always() && steps.validate.outputs.failed == 'true'
+        run: exit 1

.github/workflows/review.yml

@@ -0,0 +1,14 @@
+on:
+  pull_request:
+
+name: "Review"
+
+permissions:
+  contents: read
+  pull-requests: write
+  checks: write
+
+jobs:
+  review:
+    name: review
+    uses: action-pack/.github/.github/workflows/review.yml@master

.github/workflows/settings.yml

@@ -0,0 +1,64 @@
+name: Settings
+
+on:
+  workflow_call:
+    inputs:
+      name:
+        description: Display name for the Windows version
+        required: true
+        type: string
+
+      version:
+        description: VERSION value passed to the container
+        required: true
+        type: string
+
+      callback:
+        description: Guest script type
+        required: false
+        default: powershell
+        type: string
+
+      expected_caption:
+        description: Text expected in the Windows caption
+        required: true
+        type: string
+
+      expected_edition:
+        description: Expected Windows EditionID
+        required: false
+        default: ""
+        type: string
+
+      minimum_build:
+        description: Minimum acceptable Windows build number
+        required: true
+        type: number
+
+      platform:
+        description: Expected Windows platform
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  install:
+    name: ${{ inputs.name }}
+    uses: ./.github/workflows/install.yml
+    with:
+      name: ${{ inputs.name }}
+      version: ${{ inputs.version }}
+      callback: ${{ inputs.callback }}
+      enable_tunnel: false
+      tunnel_delay: 1800
+      kill_on_failure: true
+      install_timeout: 9000
+      reboot_timeout: 18000
+      minimum_reboots: 1
+      boot_loop_limit: 10
+      expected_caption: ${{ inputs.expected_caption }}
+      expected_edition: ${{ inputs.expected_edition }}
+      minimum_build: ${{ inputs.minimum_build }}
+      platform: ${{ inputs.platform }}

.github/workflows/test.yml

@@ -1,12 +1,6 @@
 on:
   workflow_dispatch:
   pull_request:
-    paths:
-      - '**/*.sh'
-      - '**/*.xml'
-      - '.github/workflows/test.yml'
-      - '.github/workflows/check.yml'
-      - 'Dockerfile'
 
 name: "Test"
 permissions: {}

.github/workflows/validate.yml

@@ -0,0 +1,272 @@
+name: Validation
+
+on:
+  release:
+    types:
+      - published
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: validation-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  desktop:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Windows 11 Pro
+            version: "11"
+            expected_caption: Windows 11
+            expected_edition: Professional
+            minimum_build: 22000
+            platform: x64
+
+          - name: Windows 11 LTSC
+            version: "11l"
+            expected_caption: Windows 11
+            expected_edition: EnterpriseS
+            minimum_build: 26100
+            platform: x64
+
+          - name: Windows 11 Enterprise
+            version: "11e"
+            expected_caption: Windows 11
+            expected_edition: Enterprise
+            minimum_build: 22000
+            platform: x64
+
+          - name: Windows 11 IoT
+            version: "11i"
+            expected_caption: Windows 11
+            expected_edition: IoTEnterpriseS
+            minimum_build: 26100
+            platform: x64
+
+          - name: Windows 10 Pro
+            version: "10"
+            expected_caption: Windows 10
+            expected_edition: Professional
+            minimum_build: 10240
+            platform: x64
+
+          - name: Windows 10 LTSC
+            version: "10l"
+            expected_caption: Windows 10
+            expected_edition: EnterpriseS
+            minimum_build: 17763
+            platform: x64
+
+          - name: Windows 10 Enterprise
+            version: "10e"
+            expected_caption: Windows 10
+            expected_edition: Enterprise
+            minimum_build: 10240
+            platform: x64
+
+          - name: Windows 10 IoT
+            version: "10i"
+            expected_caption: Windows 10
+            expected_edition: IoTEnterpriseS
+            minimum_build: 19044
+            platform: x64
+
+          - name: Windows 8.1 Enterprise
+            version: "8e"
+            expected_caption: Windows 8.1
+            expected_edition: Enterprise
+            minimum_build: 9600
+            platform: x64
+
+    name: ${{ matrix.name }}
+    uses: ./.github/workflows/settings.yml
+    with:
+      name: ${{ matrix.name }}
+      version: ${{ matrix.version }}
+      expected_caption: ${{ matrix.expected_caption }}
+      expected_edition: ${{ matrix.expected_edition }}
+      minimum_build: ${{ matrix.minimum_build }}
+      platform: ${{ matrix.platform }}
+
+  server:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Windows Server 2025
+            version: "2025"
+            expected_caption: Windows Server 2025
+            minimum_build: 26100
+            platform: x64
+
+          - name: Windows Server 2022
+            version: "2022"
+            expected_caption: Windows Server 2022
+            minimum_build: 20348
+            platform: x64
+
+          - name: Windows Server 2019
+            version: "2019"
+            expected_caption: Windows Server 2019
+            minimum_build: 17763
+            platform: x64
+
+          - name: Windows Server 2016
+            version: "2016"
+            expected_caption: Windows Server 2016
+            minimum_build: 14393
+            platform: x64
+
+          - name: Windows Server 2012
+            version: "2012"
+            expected_caption: Windows Server 2012 R2
+            minimum_build: 9600
+            platform: x64
+
+    name: ${{ matrix.name }}
+    uses: ./.github/workflows/settings.yml
+    with:
+      name: ${{ matrix.name }}
+      version: ${{ matrix.version }}
+      expected_caption: ${{ matrix.expected_caption }}
+      minimum_build: ${{ matrix.minimum_build }}
+      platform: ${{ matrix.platform }}
+
+  legacy:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Windows 7 x64
+            version: "7u"
+            expected_caption: Windows 7
+            minimum_build: 7601
+            platform: x64
+
+          - name: Windows 7 x86
+            version: "7x86"
+            expected_caption: Windows 7
+            minimum_build: 7601
+            platform: x86
+
+          - name: Windows Vista x64
+            version: "vu"
+            expected_caption: Windows Vista
+            minimum_build: 6002
+            platform: x64
+
+          - name: Windows Vista x86
+            version: "vistax86"
+            expected_caption: Windows Vista
+            minimum_build: 6002
+            platform: x86
+
+          - name: Windows XP x86
+            version: "xp"
+            expected_caption: Windows XP
+            minimum_build: 2600
+            platform: x86
+
+          - name: Windows XP x64
+            version: "xp64"
+            expected_caption: Windows XP
+            minimum_build: 3790
+            platform: x64
+
+          - name: Windows 2000
+            version: "2k"
+            expected_caption: Windows 2000
+            minimum_build: 2195
+            platform: x86
+
+          - name: Windows Server 2008
+            version: "2008"
+            expected_caption: Windows Server 2008 R2
+            minimum_build: 7601
+            platform: x64
+
+          - name: Windows Server 2003
+            version: "2003"
+            expected_caption: Windows Server 2003
+            minimum_build: 3790
+            platform: x64
+
+    name: ${{ matrix.name }}
+    uses: ./.github/workflows/settings.yml
+    with:
+      name: ${{ matrix.name }}
+      version: ${{ matrix.version }}
+      callback: legacy
+      expected_caption: ${{ matrix.expected_caption }}
+      minimum_build: ${{ matrix.minimum_build }}
+      platform: ${{ matrix.platform }}
+
+  win9x:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Windows 95
+            version: "95"
+            expected_caption: Windows 95
+            minimum_build: 950
+            platform: x86
+
+          - name: Windows 98
+            version: "98"
+            expected_caption: Windows 98
+            minimum_build: 2222
+            platform: x86
+
+          - name: Windows ME
+            version: "me"
+            expected_caption: Windows Millennium
+            minimum_build: 3000
+            platform: x86
+
+    name: ${{ matrix.name }}
+    uses: ./.github/workflows/settings.yml
+    with:
+      name: ${{ matrix.name }}
+      version: ${{ matrix.version }}
+      callback: basic
+      expected_caption: ${{ matrix.expected_caption }}
+      minimum_build: ${{ matrix.minimum_build }}
+      platform: ${{ matrix.platform }}
+
+  tiny:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Core 11
+            version: "core11"
+            expected_caption: Windows 11
+            minimum_build: 22000
+            platform: x64
+
+          - name: Tiny 11
+            version: "tiny11"
+            expected_caption: Windows 11
+            minimum_build: 22000
+            platform: x64
+
+          - name: Tiny 10
+            version: "tiny10"
+            expected_caption: Windows 10
+            minimum_build: 19041
+            platform: x64
+
+    name: ${{ matrix.name }}
+    uses: ./.github/workflows/settings.yml
+    with:
+      name: ${{ matrix.name }}
+      version: ${{ matrix.version }}
+      expected_caption: ${{ matrix.expected_caption }}
+      minimum_build: ${{ matrix.minimum_build }}
+      platform: ${{ matrix.platform }}

.gitignore

@@ -1 +1,268 @@
+##############################
+# Operating System Files
+##############################
 
+.DS_Store
+.AppleDouble
+.LSOverride
+Thumbs.db
+ehthumbs.db
+Desktop.ini
+Icon?
+$RECYCLE.BIN/
+.Spotlight-V100/
+.Trashes/
+.fseventsd
+
+##############################
+# IDEs
+##############################
+
+.vscode/
+.idea/
+*.iml
+*.ipr
+*.iws
+
+##############################
+# VS Code
+##############################
+
+.history/
+*.code-workspace
+
+##############################
+# Vim
+##############################
+
+*.swp
+*.swo
+Session.vim
+
+##############################
+# Sublime
+##############################
+
+*.sublime-workspace
+*.sublime-project
+
+##############################
+# Temporary Files
+##############################
+
+*.tmp
+*.temp
+*.bak
+*.old
+*.orig
+*.rej
+*.save
+
+##############################
+# Logs
+##############################
+
+*.log
+logs/
+log/
+*.out
+*.err
+*.trace
+
+##############################
+# Runtime
+##############################
+
+*.pid
+*.seed
+*.pid.lock
+
+##############################
+# Secrets
+##############################
+
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+*.crt
+*.cer
+*.p12
+*.pfx
+*.kdbx
+*.secret
+*.token
+
+##############################
+# SSH
+##############################
+
+.ssh/
+
+##############################
+# Docker
+##############################
+
+docker-compose.override.yml
+docker-compose.local.yml
+
+##############################
+# VM Storage
+##############################
+
+storage/
+windows/
+downloads/
+
+##############################
+# Disk Images
+##############################
+
+*.qcow2
+*.qcow
+*.vhd
+*.vhdx
+*.vdi
+*.raw
+*.img
+*.iso
+*.bin
+
+##############################
+# QEMU
+##############################
+
+*.nvram
+*.fd
+*.efi
+*.sock
+*.monitor
+*.serial
+
+##############################
+# Samba
+##############################
+
+shared/
+share/
+
+##############################
+# Backups
+##############################
+
+backup/
+backups/
+*.backup
+
+##############################
+# Cache
+##############################
+
+.cache/
+.cache-loader/
+.tmp/
+temp/
+tmp/
+
+##############################
+# Python
+##############################
+
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.mypy_cache/
+.venv/
+venv/
+
+##############################
+# Node
+##############################
+
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+
+##############################
+# Build
+##############################
+
+dist/
+build/
+out/
+release/
+
+##############################
+# Coverage
+##############################
+
+coverage/
+.coverage
+coverage.xml
+
+##############################
+# Archives
+##############################
+
+*.zip
+*.tar
+*.tar.gz
+*.tgz
+*.7z
+*.rar
+
+##############################
+# Generated Config
+##############################
+
+config.local.*
+settings.local.*
+local.env
+
+##############################
+# Test Files
+##############################
+
+test-output/
+playwright-report/
+
+##############################
+# macOS
+##############################
+
+.AppleDB
+.AppleDesktop
+Network Trash Folder
+Temporary Items
+
+##############################
+# Linux
+##############################
+
+*~
+.nfs*
+
+##############################
+# Windows
+##############################
+
+*.stackdump
+
+##############################
+# Misc
+##############################
+
+*.cache
+*.lock
+*.lock.json
+*.bak.*
+
+##############################
+# Keep Examples
+##############################
+
+!.gitkeep
+!.env.example

Dockerfile

@@ -1,41 +1,72 @@
-FROM scratch
+# syntax=docker/dockerfile:1.28
-COPY --from=qemux/qemu-docker:6.03 / /
+
+ARG VERSION_ARG="latest"
+FROM scratch AS build-amd64
+
+COPY --from=qemux/qemu:7.50 --exclude=usr/bin/qemu-system-x86_64 / /
+
+ARG TARGETARCH
+
+ARG VERSION_WSDD="1.27"
+ARG VERSION_DXVK="3.1.1"
+ARG VERSION_VIRTIO="1.9.61"
+ARG VERSION_BLINTER="1.0.112"
 
-ARG VERSION_ARG="0.0"
 ARG DEBCONF_NOWARNINGS="yes"
 ARG DEBIAN_FRONTEND="noninteractive"
 ARG DEBCONF_NONINTERACTIVE_SEEN="true"
 
-RUN set -eu && \
+RUN <<EOF
-    apt-get update && \
+  set -eu
+
+  apt-get update
   apt-get --no-install-recommends -y install \
-        bc \
+    gcab \
-        curl \
-        7zip \
-        wsdd \
     samba \
-        xz-utils \
+    mtools \
     wimtools \
     dos2unix \
     cabextract \
-        genisoimage \
+    xmlstarlet \
-        libxml2-utils && \
+    icu-devtools \
-    apt-get clean && \
+    libxml2-utils \
-    echo "$VERSION_ARG" > /run/version && \
+    libarchive-tools
+
+  # Install Blinter
+  python3 -m pip install --break-system-packages --root-user-action=ignore --no-cache-dir "Blinter==${VERSION_BLINTER}"
+
+  # Install wsddn package
+  wget "https://github.com/gershnik/wsdd-native/releases/download/v${VERSION_WSDD}/wsddn_${VERSION_WSDD}_${TARGETARCH}.deb" -O /tmp/wsddn.deb -q --timeout=10
+  dpkg -i /tmp/wsddn.deb
+
+  # Install dxvk-native
+  wget "https://github.com/doitsujin/dxvk/releases/download/v${VERSION_DXVK}/dxvk-native-${VERSION_DXVK}-steamrt-sniper.tar.gz" -O /tmp/dxvk-native.tar.gz -q --timeout=10
+  tar -xzf /tmp/dxvk-native.tar.gz -C /
+  ldconfig
+
+  apt-get clean
   rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+EOF
 
 COPY --chmod=755 ./src /run/
 COPY --chmod=755 ./assets /run/assets
+COPY --from=qemux/udfread:1.2.0 /udfread /usr/bin/
+COPY --from=qemux/qemu-windows:11.2.23 /usr/bin/qemu-system-x86_64 /usr/bin/
 
-ADD --chmod=755 https://raw.githubusercontent.com/christgau/wsdd/v0.8/src/wsdd.py /usr/sbin/wsdd
+ADD --chmod=664 https://github.com/qemus/virtiso-whql/releases/download/v${VERSION_VIRTIO}-0/virtio-win-${VERSION_VIRTIO}.tar.xz /var/drivers.txz
-ADD --chmod=664 https://github.com/qemus/virtiso-whql/releases/download/v1.9.43-0/virtio-win-1.9.43.tar.xz /drivers.txz
+
+FROM dockurr/windows-arm:${VERSION_ARG} AS build-arm64
+FROM build-${TARGETARCH}
+
+ARG VERSION_ARG="0.00"
+RUN echo "$VERSION_ARG" > /etc/version
 
-EXPOSE 8006 3389
 VOLUME /storage
+EXPOSE 3389 8006
 
+ENV VERSION="11"
 ENV RAM_SIZE="4G"
 ENV CPU_CORES="2"
 ENV DISK_SIZE="64G"
-ENV VERSION="win11"
 
 ENTRYPOINT ["/usr/bin/tini", "-s", "/run/entry.sh"]

assets/win10x64-enterprise-eval.xml

@@ -1,424 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-  <settings pass="windowsPE">
-    <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SetupUILanguage>
-        <UILanguage>en-US</UILanguage>
-      </SetupUILanguage>
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UserLocale>en-US</UserLocale>
-    </component>
-    <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DiskConfiguration>
-        <Disk wcm:action="add">
-          <DiskID>0</DiskID>
-          <WillWipeDisk>true</WillWipeDisk>
-          <CreatePartitions>
-            <!-- System partition (ESP) -->
-            <CreatePartition wcm:action="add">
-              <Order>1</Order>
-              <Type>EFI</Type>
-              <Size>128</Size>
-            </CreatePartition>
-            <!-- Microsoft reserved partition (MSR) -->
-            <CreatePartition wcm:action="add">
-              <Order>2</Order>
-              <Type>MSR</Type>
-              <Size>128</Size>
-            </CreatePartition>
-            <!-- Windows partition -->
-            <CreatePartition wcm:action="add">
-              <Order>3</Order>
-              <Type>Primary</Type>
-              <Extend>true</Extend>
-            </CreatePartition>
-          </CreatePartitions>
-          <ModifyPartitions>
-            <!-- System partition (ESP) -->
-            <ModifyPartition wcm:action="add">
-              <Order>1</Order>
-              <PartitionID>1</PartitionID>
-              <Label>System</Label>
-              <Format>FAT32</Format>
-            </ModifyPartition>
-            <!-- MSR partition does not need to be modified -->
-            <ModifyPartition wcm:action="add">
-              <Order>2</Order>
-              <PartitionID>2</PartitionID>
-            </ModifyPartition>
-            <!-- Windows partition -->
-            <ModifyPartition wcm:action="add">
-              <Order>3</Order>
-              <PartitionID>3</PartitionID>
-              <Label>Windows</Label>
-              <Letter>C</Letter>
-              <Format>NTFS</Format>
-            </ModifyPartition>
-          </ModifyPartitions>
-        </Disk>
-      </DiskConfiguration>
-      <ImageInstall>
-        <OSImage>
-          <InstallTo>
-            <DiskID>0</DiskID>
-            <PartitionID>3</PartitionID>
-          </InstallTo>
-          <InstallToAvailablePartition>false</InstallToAvailablePartition>
-        </OSImage>
-      </ImageInstall>
-      <DynamicUpdate>
-        <Enable>true</Enable>
-        <WillShowUI>Never</WillShowUI>
-      </DynamicUpdate>
-      <UpgradeData>
-        <Upgrade>false</Upgrade>
-        <WillShowUI>Never</WillShowUI>
-      </UpgradeData>
-      <UserData>
-        <AcceptEula>true</AcceptEula>
-        <FullName>Docker</FullName>
-        <Organization>Windows for Docker</Organization>
-      </UserData>
-      <EnableFirewall>false</EnableFirewall>
-      <Diagnostics>
-        <OptIn>false</OptIn>
-      </Diagnostics>
-    </component>
-  </settings>
-  <settings pass="offlineServicing">
-    <component name="Microsoft-Windows-LUA-Settings" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <EnableLUA>false</EnableLUA>
-    </component>
-  </settings>
-  <settings pass="generalize">
-    <component name="Microsoft-Windows-PnPSysprep" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <PersistAllDeviceInstalls>true</PersistAllDeviceInstalls>
-    </component>
-    <component name="Microsoft-Windows-Security-SPP" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SkipRearm>1</SkipRearm>
-    </component>
-  </settings>
-  <settings pass="specialize">
-    <component name="Microsoft-Windows-Security-SPP-UX" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SkipAutoActivation>true</SkipAutoActivation>
-    </component>
-    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <ComputerName>*</ComputerName>
-      <OEMInformation>
-        <Manufacturer>Dockur</Manufacturer>
-        <Model>Windows for Docker</Model>
-        <SupportHours>24/7</SupportHours>
-        <SupportPhone />
-        <SupportProvider>Dockur</SupportProvider>
-        <SupportURL>https://github.com/dockur/windows/issues</SupportURL>
-      </OEMInformation>
-      <OEMName>Windows for Docker</OEMName>
-    </component>
-    <component name="Microsoft-Windows-ErrorReportingCore" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableWER>1</DisableWER>
-    </component>
-    <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableAccelerators>true</DisableAccelerators>
-      <DisableFirstRunWizard>true</DisableFirstRunWizard>
-      <Home_Page>https://google.com</Home_Page>
-      <Help_Page>about:blank</Help_Page>
-    </component>
-    <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="wow64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableAccelerators>true</DisableAccelerators>
-      <DisableFirstRunWizard>true</DisableFirstRunWizard>
-      <Home_Page>https://google.com</Home_Page>
-      <Help_Page>about:blank</Help_Page>
-    </component>
-    <component name="Microsoft-Windows-SQMApi" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <CEIPEnabled>0</CEIPEnabled>
-    </component>
-    <component name="Microsoft-Windows-SystemRestore-Main" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableSR>1</DisableSR>
-    </component>
-    <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UserLocale>en-US</UserLocale>
-    </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <Path>reg.exe unload "HKU\mount"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
-          <Description>Set Network Location to Home</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
-    <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <fDenyTSConnections>false</fDenyTSConnections>
-    </component>
-    <component name="Microsoft-Windows-TerminalServices-RDP-WinStationExtensions" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <UserAuthentication>0</UserAuthentication>
-    </component>
-    <component name="Networking-MPSSVC-Svc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <FirewallGroups>
-        <FirewallGroup wcm:action="add" wcm:keyValue="RemoteDesktop">
-          <Active>true</Active>
-          <Profile>all</Profile>
-          <Group>@FirewallAPI.dll,-28752</Group>
-        </FirewallGroup>
-      </FirewallGroups>
-    </component>
-  </settings>
-  <settings pass="auditSystem" />
-  <settings pass="auditUser" />
-  <settings pass="oobeSystem">
-    <component name="Microsoft-Windows-SecureStartup-FilterDriver" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <PreventDeviceEncryption>true</PreventDeviceEncryption>
-    </component>
-    <component name="Microsoft-Windows-EnhancedStorage-Adm" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <TCGSecurityActivationDisabled>1</TCGSecurityActivationDisabled>
-    </component>
-    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <UserAccounts>
-        <LocalAccounts>
-          <LocalAccount wcm:action="add">
-            <Name>Docker</Name>
-            <Group>Administrators</Group>
-            <Password>
-              <Value />
-              <PlainText>true</PlainText>
-            </Password>
-          </LocalAccount>
-        </LocalAccounts>
-        <AdministratorPassword>
-          <Value>password</Value>
-          <PlainText>true</PlainText>
-        </AdministratorPassword>
-      </UserAccounts>
-      <AutoLogon>
-        <Username>Docker</Username>
-        <Enabled>true</Enabled>
-        <LogonCount>65432</LogonCount>
-        <Password>
-          <Value />
-          <PlainText>true</PlainText>
-        </Password>
-      </AutoLogon>
-      <Display>
-        <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
-      </Display>
-      <OOBE>
-        <HideEULAPage>true</HideEULAPage>
-        <HideLocalAccountScreen>true</HideLocalAccountScreen>
-        <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
-        <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
-        <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
-        <NetworkLocation>Home</NetworkLocation>
-        <ProtectYourPC>3</ProtectYourPC>
-        <SkipUserOOBE>true</SkipUserOOBE>
-        <SkipMachineOOBE>true</SkipMachineOOBE>
-      </OOBE>
-      <RegisteredOrganization>Dockur</RegisteredOrganization>
-      <RegisteredOwner>Windows for Docker</RegisteredOwner>
-      <FirstLogonCommands>
-        <SynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
-        </SynchronousCommand>
-      </FirstLogonCommands>
-    </component>
-  </settings>
-</unattend>

assets/win10x64-enterprise.cmd

@@ -0,0 +1,169 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f
+reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f
+reg.exe unload "HKU\mount"
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f
+
+rem Set Network Location to Home
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win10x64-enterprise.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,14 +62,14 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -150,104 +150,8 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f</Path>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
-        </RunSynchronousCommand>
+          <Description>Run the specialize pass of the unattended setup script</Description>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <Path>reg.exe unload "HKU\mount"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
-          <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
       </RunSynchronous>
     </component>
@@ -283,14 +187,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -298,14 +202,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -323,103 +227,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win10x64-iot.cmd

@@ -0,0 +1,169 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f
+reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f
+reg.exe unload "HKU\mount"
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f
+
+rem Set Network Location to Home
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win10x64-iot.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -68,14 +68,14 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -156,104 +156,8 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f</Path>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
-        </RunSynchronousCommand>
+          <Description>Run the specialize pass of the unattended setup script</Description>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <Path>reg.exe unload "HKU\mount"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
-          <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
       </RunSynchronous>
     </component>
@@ -289,14 +193,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -304,14 +208,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -329,103 +233,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win10x64-ltsc.cmd

@@ -0,0 +1,169 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f
+reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f
+reg.exe unload "HKU\mount"
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f
+
+rem Set Network Location to Home
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win10x64-ltsc.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -68,14 +68,14 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -153,104 +153,8 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f</Path>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
-        </RunSynchronousCommand>
+          <Description>Run the specialize pass of the unattended setup script</Description>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <Path>reg.exe unload "HKU\mount"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
-          <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
       </RunSynchronous>
     </component>
@@ -286,14 +190,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -301,14 +205,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -326,103 +230,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win10x64.cmd

@@ -0,0 +1,168 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f
+reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f
+reg.exe unload "HKU\mount"
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f
+
+rem Set Network Location to Home
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win10x64.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,14 +62,14 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -150,104 +150,8 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f</Path>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
-        </RunSynchronousCommand>
+          <Description>Run the specialize pass of the unattended setup script</Description>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <Path>reg.exe unload "HKU\mount"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
-          <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
       </RunSynchronous>
     </component>
@@ -283,14 +187,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -298,14 +202,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -323,103 +227,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win11x64-enterprise-eval.xml

@@ -1,447 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-  <settings pass="windowsPE">
-    <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SetupUILanguage>
-        <UILanguage>en-US</UILanguage>
-      </SetupUILanguage>
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UserLocale>en-US</UserLocale>
-    </component>
-    <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DiskConfiguration>
-        <Disk wcm:action="add">
-          <DiskID>0</DiskID>
-          <WillWipeDisk>true</WillWipeDisk>
-          <CreatePartitions>
-            <!-- System partition (ESP) -->
-            <CreatePartition wcm:action="add">
-              <Order>1</Order>
-              <Type>EFI</Type>
-              <Size>128</Size>
-            </CreatePartition>
-            <!-- Microsoft reserved partition (MSR) -->
-            <CreatePartition wcm:action="add">
-              <Order>2</Order>
-              <Type>MSR</Type>
-              <Size>128</Size>
-            </CreatePartition>
-            <!-- Windows partition -->
-            <CreatePartition wcm:action="add">
-              <Order>3</Order>
-              <Type>Primary</Type>
-              <Extend>true</Extend>
-            </CreatePartition>
-          </CreatePartitions>
-          <ModifyPartitions>
-            <!-- System partition (ESP) -->
-            <ModifyPartition wcm:action="add">
-              <Order>1</Order>
-              <PartitionID>1</PartitionID>
-              <Label>System</Label>
-              <Format>FAT32</Format>
-            </ModifyPartition>
-            <!-- MSR partition does not need to be modified -->
-            <ModifyPartition wcm:action="add">
-              <Order>2</Order>
-              <PartitionID>2</PartitionID>
-            </ModifyPartition>
-            <!-- Windows partition -->
-            <ModifyPartition wcm:action="add">
-              <Order>3</Order>
-              <PartitionID>3</PartitionID>
-              <Label>Windows</Label>
-              <Letter>C</Letter>
-              <Format>NTFS</Format>
-            </ModifyPartition>
-          </ModifyPartitions>
-        </Disk>
-      </DiskConfiguration>
-      <ImageInstall>
-        <OSImage>
-          <InstallTo>
-            <DiskID>0</DiskID>
-            <PartitionID>3</PartitionID>
-          </InstallTo>
-          <InstallToAvailablePartition>false</InstallToAvailablePartition>
-        </OSImage>
-      </ImageInstall>
-      <DynamicUpdate>
-        <Enable>true</Enable>
-        <WillShowUI>Never</WillShowUI>
-      </DynamicUpdate>
-      <UpgradeData>
-        <Upgrade>false</Upgrade>
-        <WillShowUI>Never</WillShowUI>
-      </UpgradeData>
-      <UserData>
-        <AcceptEula>true</AcceptEula>
-        <FullName>Docker</FullName>
-        <Organization>Windows for Docker</Organization>
-      </UserData>
-      <EnableFirewall>false</EnableFirewall>
-      <Diagnostics>
-        <OptIn>false</OptIn>
-      </Diagnostics>
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassTPMCheck /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassSecureBootCheck /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <Path>reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassRAMCheck /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <Path>reg.exe add "HKLM\SYSTEM\Setup\MoSetup" /v AllowUpgradesWithUnsupportedTPMOrCPU /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
-  </settings>
-  <settings pass="offlineServicing">
-    <component name="Microsoft-Windows-LUA-Settings" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <EnableLUA>false</EnableLUA>
-    </component>
-  </settings>
-  <settings pass="generalize">
-    <component name="Microsoft-Windows-PnPSysprep" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <PersistAllDeviceInstalls>true</PersistAllDeviceInstalls>
-    </component>
-    <component name="Microsoft-Windows-Security-SPP" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SkipRearm>1</SkipRearm>
-    </component>
-  </settings>
-  <settings pass="specialize">
-    <component name="Microsoft-Windows-Security-SPP-UX" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SkipAutoActivation>true</SkipAutoActivation>
-    </component>
-    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <ComputerName>*</ComputerName>
-      <OEMInformation>
-        <Manufacturer>Dockur</Manufacturer>
-        <Model>Windows for Docker</Model>
-        <SupportHours>24/7</SupportHours>
-        <SupportPhone />
-        <SupportProvider>Dockur</SupportProvider>
-        <SupportURL>https://github.com/dockur/windows/issues</SupportURL>
-      </OEMInformation>
-      <OEMName>Windows for Docker</OEMName>
-    </component>
-    <component name="Microsoft-Windows-ErrorReportingCore" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableWER>1</DisableWER>
-    </component>
-    <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableAccelerators>true</DisableAccelerators>
-      <DisableFirstRunWizard>true</DisableFirstRunWizard>
-      <Home_Page>https://google.com</Home_Page>
-      <Help_Page>about:blank</Help_Page>
-    </component>
-    <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="wow64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableAccelerators>true</DisableAccelerators>
-      <DisableFirstRunWizard>true</DisableFirstRunWizard>
-      <Home_Page>https://google.com</Home_Page>
-      <Help_Page>about:blank</Help_Page>
-    </component>
-    <component name="Microsoft-Windows-SQMApi" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <CEIPEnabled>0</CEIPEnabled>
-    </component>
-    <component name="Microsoft-Windows-SystemRestore-Main" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableSR>1</DisableSR>
-    </component>
-    <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UserLocale>en-US</UserLocale>
-    </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <Path>reg.exe unload "HKU\mount"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
-          <Description>Set Network Location to Home</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
-    <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <fDenyTSConnections>false</fDenyTSConnections>
-    </component>
-    <component name="Microsoft-Windows-TerminalServices-RDP-WinStationExtensions" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <UserAuthentication>0</UserAuthentication>
-    </component>
-    <component name="Networking-MPSSVC-Svc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <FirewallGroups>
-        <FirewallGroup wcm:action="add" wcm:keyValue="RemoteDesktop">
-          <Active>true</Active>
-          <Profile>all</Profile>
-          <Group>@FirewallAPI.dll,-28752</Group>
-        </FirewallGroup>
-      </FirewallGroups>
-    </component>
-  </settings>
-  <settings pass="auditSystem" />
-  <settings pass="auditUser" />
-  <settings pass="oobeSystem">
-    <component name="Microsoft-Windows-SecureStartup-FilterDriver" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <PreventDeviceEncryption>true</PreventDeviceEncryption>
-    </component>
-    <component name="Microsoft-Windows-EnhancedStorage-Adm" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <TCGSecurityActivationDisabled>1</TCGSecurityActivationDisabled>
-    </component>
-    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <UserAccounts>
-        <LocalAccounts>
-          <LocalAccount wcm:action="add">
-            <Name>Docker</Name>
-            <Group>Administrators</Group>
-            <Password>
-              <Value />
-              <PlainText>true</PlainText>
-            </Password>
-          </LocalAccount>
-        </LocalAccounts>
-        <AdministratorPassword>
-          <Value>password</Value>
-          <PlainText>true</PlainText>
-        </AdministratorPassword>
-      </UserAccounts>
-      <AutoLogon>
-        <Username>Docker</Username>
-        <Enabled>true</Enabled>
-        <LogonCount>65432</LogonCount>
-        <Password>
-          <Value />
-          <PlainText>true</PlainText>
-        </Password>
-      </AutoLogon>
-      <Display>
-        <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
-      </Display>
-      <OOBE>
-        <HideEULAPage>true</HideEULAPage>
-        <HideLocalAccountScreen>true</HideLocalAccountScreen>
-        <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
-        <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
-        <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
-        <NetworkLocation>Home</NetworkLocation>
-        <ProtectYourPC>3</ProtectYourPC>
-        <SkipUserOOBE>true</SkipUserOOBE>
-        <SkipMachineOOBE>true</SkipMachineOOBE>
-      </OOBE>
-      <RegisteredOrganization>Dockur</RegisteredOrganization>
-      <RegisteredOwner>Windows for Docker</RegisteredOwner>
-      <FirstLogonCommands>
-        <SynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
-        </SynchronousCommand>
-      </FirstLogonCommands>
-    </component>
-  </settings>
-</unattend>

assets/win11x64-enterprise.cmd

@@ -0,0 +1,188 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="pe" goto pe
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:pe
+
+reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassTPMCheck /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassSecureBootCheck /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassRAMCheck /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\SYSTEM\Setup\MoSetup" /v AllowUpgradesWithUnsupportedTPMOrCPU /t REG_DWORD /d 1 /f
+
+exit /b 0
+
+:specialize
+
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f
+reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f
+reg.exe unload "HKU\mount"
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f
+
+rem Set Network Location to Home
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Disable the SMB signing requirement.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable per-CPU clock tick scheduling.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "EnablePerCpuClockTickScheduling" /t REG_DWORD /d 2 /f
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Remove the empty Windows.old folder.
+if exist "%SystemDrive%\Windows.old" rd /q "%SystemDrive%\Windows.old"
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win11x64-enterprise.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,14 +62,14 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -168,104 +168,8 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f</Path>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
-        </RunSynchronousCommand>
+          <Description>Run the specialize pass of the unattended setup script</Description>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <Path>reg.exe unload "HKU\mount"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
-          <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
       </RunSynchronous>
     </component>
@@ -301,14 +205,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -316,14 +220,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -341,108 +245,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win11x64-iot.cmd

@@ -0,0 +1,188 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="pe" goto pe
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:pe
+
+reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassTPMCheck /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassSecureBootCheck /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassRAMCheck /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\SYSTEM\Setup\MoSetup" /v AllowUpgradesWithUnsupportedTPMOrCPU /t REG_DWORD /d 1 /f
+
+exit /b 0
+
+:specialize
+
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f
+reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f
+reg.exe unload "HKU\mount"
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f
+
+rem Set Network Location to Home
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Disable the SMB signing requirement.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable per-CPU clock tick scheduling.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "EnablePerCpuClockTickScheduling" /t REG_DWORD /d 2 /f
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Remove the empty Windows.old folder.
+if exist "%SystemDrive%\Windows.old" rd /q "%SystemDrive%\Windows.old"
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win11x64-iot.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -61,21 +61,15 @@
       </DiskConfiguration>
       <ImageInstall>
         <OSImage>
-          <InstallFrom>
-           <MetaData wcm:action="add">
-              <Key>/image/index</Key>
-              <Value>2</Value>
-            </MetaData>
-          </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -87,7 +81,7 @@
         <FullName>Docker</FullName>
         <Organization>Windows for Docker</Organization>
         <ProductKey>
-          <Key />
+          <Key>CGK42-GYN6Y-VD22B-BX98W-J8JXD</Key>
         </ProductKey>
       </UserData>
       <EnableFirewall>false</EnableFirewall>
@@ -174,104 +168,8 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f</Path>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
-        </RunSynchronousCommand>
+          <Description>Run the specialize pass of the unattended setup script</Description>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <Path>reg.exe unload "HKU\mount"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
-          <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
       </RunSynchronous>
     </component>
@@ -307,14 +205,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -322,14 +220,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -347,108 +245,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win11x64-ltsc.cmd

@@ -0,0 +1,188 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="pe" goto pe
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:pe
+
+reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassTPMCheck /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassSecureBootCheck /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassRAMCheck /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\SYSTEM\Setup\MoSetup" /v AllowUpgradesWithUnsupportedTPMOrCPU /t REG_DWORD /d 1 /f
+
+exit /b 0
+
+:specialize
+
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f
+reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f
+reg.exe unload "HKU\mount"
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f
+
+rem Set Network Location to Home
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Disable the SMB signing requirement.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable per-CPU clock tick scheduling.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "EnablePerCpuClockTickScheduling" /t REG_DWORD /d 2 /f
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Remove the empty Windows.old folder.
+if exist "%SystemDrive%\Windows.old" rd /q "%SystemDrive%\Windows.old"
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win11x64-ltsc.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -61,21 +61,15 @@
       </DiskConfiguration>
       <ImageInstall>
         <OSImage>
-          <InstallFrom>
-           <MetaData wcm:action="add">
-              <Key>/image/index</Key>
-              <Value>1</Value>
-            </MetaData>
-          </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -87,7 +81,7 @@
         <FullName>Docker</FullName>
         <Organization>Windows for Docker</Organization>
         <ProductKey>
-          <Key />
+          <Key>M7XTQ-FN8P6-TTKYV-9D4CC-J462D</Key>
         </ProductKey>
       </UserData>
       <EnableFirewall>false</EnableFirewall>
@@ -174,104 +168,8 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f</Path>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
-        </RunSynchronousCommand>
+          <Description>Run the specialize pass of the unattended setup script</Description>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <Path>reg.exe unload "HKU\mount"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
-          <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
       </RunSynchronous>
     </component>
@@ -307,14 +205,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -322,14 +220,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -347,108 +245,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win11x64.cmd

@@ -0,0 +1,188 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="pe" goto pe
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:pe
+
+reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassTPMCheck /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassSecureBootCheck /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassRAMCheck /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\SYSTEM\Setup\MoSetup" /v AllowUpgradesWithUnsupportedTPMOrCPU /t REG_DWORD /d 1 /f
+
+exit /b 0
+
+:specialize
+
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f
+reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f
+reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f
+reg.exe unload "HKU\mount"
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f
+
+rem Set Network Location to Home
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Disable the SMB signing requirement.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable per-CPU clock tick scheduling.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "EnablePerCpuClockTickScheduling" /t REG_DWORD /d 2 /f
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Remove the empty Windows.old folder.
+if exist "%SystemDrive%\Windows.old" rd /q "%SystemDrive%\Windows.old"
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win11x64.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,14 +62,14 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -168,104 +168,8 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f</Path>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
-        </RunSynchronousCommand>
+          <Description>Run the specialize pass of the unattended setup script</Description>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>reg.exe load "HKU\mount" "C:\Users\Default\NTUSER.DAT"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <Path>reg.exe add "HKU\mount\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <Path>reg.exe add "HKU\mount\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <Path>reg.exe unload "HKU\mount"</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t REG_DWORD /d 1 /f</Path>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
-          <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
       </RunSynchronous>
     </component>
@@ -301,14 +205,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -316,14 +220,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -341,108 +245,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2008r2-eval.xml

@@ -1,299 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-  <settings pass="windowsPE">
-    <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SetupUILanguage>
-        <UILanguage>en-US</UILanguage>
-      </SetupUILanguage>
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UserLocale>en-US</UserLocale>
-    </component>
-    <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DiskConfiguration>
-        <WillShowUI>OnError</WillShowUI>
-        <Disk wcm:action="add">
-          <DiskID>0</DiskID>
-          <WillWipeDisk>true</WillWipeDisk>
-          <CreatePartitions>
-            <CreatePartition wcm:action="add">
-              <Order>1</Order>
-              <Type>Primary</Type>
-              <Size>100</Size>
-            </CreatePartition>
-            <CreatePartition wcm:action="add">
-              <Order>2</Order>
-              <Type>Primary</Type>
-              <Extend>true</Extend>
-            </CreatePartition>
-          </CreatePartitions>
-          <ModifyPartitions>
-            <ModifyPartition wcm:action="add">
-              <Format>NTFS</Format>
-              <Label>System Reserved</Label>
-              <Order>1</Order>
-              <Active>true</Active>
-              <PartitionID>1</PartitionID>
-              <TypeID>0x27</TypeID>
-            </ModifyPartition>
-            <ModifyPartition wcm:action="add">
-              <Active>true</Active>
-              <Format>NTFS</Format>
-              <Label>Windows</Label>
-              <Letter>C</Letter>
-              <Order>2</Order>
-              <PartitionID>2</PartitionID>
-            </ModifyPartition>
-          </ModifyPartitions>
-        </Disk>
-      </DiskConfiguration>
-      <ImageInstall>
-        <OSImage>
-          <InstallFrom>
-            <MetaData wcm:action="add">
-              <Value>1</Value>
-              <Key>/IMAGE/INDEX</Key>
-            </MetaData>
-          </InstallFrom>
-          <InstallTo>
-            <DiskID>0</DiskID>
-            <PartitionID>2</PartitionID>
-          </InstallTo>
-          <InstallToAvailablePartition>false</InstallToAvailablePartition>
-        </OSImage>
-      </ImageInstall>
-      <DynamicUpdate>
-        <Enable>true</Enable>
-        <WillShowUI>Never</WillShowUI>
-      </DynamicUpdate>
-      <UpgradeData>
-        <Upgrade>false</Upgrade>
-        <WillShowUI>Never</WillShowUI>
-      </UpgradeData>
-      <UserData>
-        <AcceptEula>true</AcceptEula>
-        <FullName>Docker</FullName>
-        <Organization>Windows for Docker</Organization>
-      </UserData>
-      <EnableFirewall>false</EnableFirewall>
-      <Diagnostics>
-        <OptIn>false</OptIn>
-      </Diagnostics>
-    </component>
-  </settings>
-  <settings pass="offlineServicing">
-    <component name="Microsoft-Windows-LUA-Settings" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <EnableLUA>false</EnableLUA>
-    </component>
-  </settings>
-  <settings pass="generalize">
-    <component name="Microsoft-Windows-PnPSysprep" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <PersistAllDeviceInstalls>true</PersistAllDeviceInstalls>
-    </component>
-    <component name="Microsoft-Windows-Security-SPP" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SkipRearm>1</SkipRearm>
-    </component>
-  </settings>
-  <settings pass="specialize">
-    <component name="Microsoft-Windows-Security-SPP-UX" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SkipAutoActivation>true</SkipAutoActivation>
-    </component>
-    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <ComputerName>*</ComputerName>
-      <OEMInformation>
-        <Manufacturer>Dockur</Manufacturer>
-        <Model>Windows for Docker</Model>
-      </OEMInformation>
-    </component>
-    <component name="Microsoft-Windows-ErrorReportingCore" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableWER>1</DisableWER>
-    </component>
-    <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableAccelerators>true</DisableAccelerators>
-      <DisableFirstRunWizard>true</DisableFirstRunWizard>
-      <Home_Page>https://google.com</Home_Page>
-      <Help_Page>about:blank</Help_Page>
-    </component>
-    <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="wow64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableAccelerators>true</DisableAccelerators>
-      <DisableFirstRunWizard>true</DisableFirstRunWizard>
-      <Home_Page>https://google.com</Home_Page>
-      <Help_Page>about:blank</Help_Page>
-    </component>
-    <component name="Microsoft-Windows-SQMApi" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <CEIPEnabled>0</CEIPEnabled>
-    </component>
-    <component name="Microsoft-Windows-SystemRestore-Main" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableSR>1</DisableSR>
-    </component>
-    <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UserLocale>en-US</UserLocale>
-    </component>
-    <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DoNotOpenServerManagerAtLogon>true</DoNotOpenServerManagerAtLogon>
-    </component>
-    <component name="Microsoft-Windows-OutOfBoxExperience" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DoNotOpenInitialConfigurationTasksAtLogon>true</DoNotOpenInitialConfigurationTasksAtLogon>
-    </component>
-    <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <fDenyTSConnections>false</fDenyTSConnections>
-    </component>
-    <component name="Microsoft-Windows-TerminalServices-RDP-WinStationExtensions" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <UserAuthentication>0</UserAuthentication>
-    </component>
-    <component name="Networking-MPSSVC-Svc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <FirewallGroups>
-        <FirewallGroup wcm:action="add" wcm:keyValue="RemoteDesktop">
-          <Active>true</Active>
-          <Profile>all</Profile>
-          <Group>@FirewallAPI.dll,-28752</Group>
-        </FirewallGroup>
-      </FirewallGroups>
-    </component>
-  </settings>
-  <settings pass="oobeSystem">
-    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <UserAccounts>
-        <LocalAccounts>
-          <LocalAccount wcm:action="add">
-            <Name>Docker</Name>
-            <Group>Administrators</Group>
-            <Password>
-              <Value />
-              <PlainText>true</PlainText>
-            </Password>
-          </LocalAccount>
-        </LocalAccounts>
-        <AdministratorPassword>
-          <Value>password</Value>
-          <PlainText>true</PlainText>
-        </AdministratorPassword>
-      </UserAccounts>
-      <AutoLogon>
-        <Username>Docker</Username>
-        <Enabled>true</Enabled>
-        <LogonCount>65432</LogonCount>
-        <Password>
-          <Value />
-          <PlainText>true</PlainText>
-        </Password>
-      </AutoLogon>
-      <Display>
-        <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
-      </Display>
-      <OOBE>
-        <HideEULAPage>true</HideEULAPage>
-        <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
-        <NetworkLocation>Home</NetworkLocation>
-        <ProtectYourPC>3</ProtectYourPC>
-        <SkipUserOOBE>true</SkipUserOOBE>
-        <SkipMachineOOBE>true</SkipMachineOOBE>
-      </OOBE>
-      <RegisteredOrganization>Dockur</RegisteredOrganization>
-      <RegisteredOwner>Windows for Docker</RegisteredOwner>
-      <FirstLogonCommands>
-        <SynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
-        </SynchronousCommand>
-      </FirstLogonCommands>
-    </component>
-  </settings>
-</unattend>

assets/win2008r2.cmd

@@ -0,0 +1,129 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Disable Shutdown Event Tracker.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" /v "ShutdownReasonOn" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable AutoPlay for all drives.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /t REG_DWORD /d 255 /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2008r2.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,14 +57,14 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -157,6 +157,15 @@
         </FirewallGroup>
       </FirewallGroups>
     </component>
+    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+      <RunSynchronous>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
+          <Description>Run the specialize pass of the unattended setup script</Description>
+        </RunSynchronousCommand>
+      </RunSynchronous>
+    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -166,14 +175,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -181,14 +190,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -203,98 +212,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2012r2.cmd

@@ -0,0 +1,126 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Set Network Location to Home
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Disable Shutdown Event Tracker.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" /v "ShutdownReasonOn" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2012r2.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -77,7 +77,7 @@
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -155,8 +155,8 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
-          <Description>Set Network Location to Home</Description>
+          <Description>Run the specialize pass of the unattended setup script</Description>
         </RunSynchronousCommand>
       </RunSynchronous>
     </component>
@@ -196,14 +196,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -211,14 +211,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -236,83 +236,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2016-eval.xml

@@ -1,337 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-  <settings pass="windowsPE">
-    <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SetupUILanguage>
-        <UILanguage>en-US</UILanguage>
-      </SetupUILanguage>
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UILanguageFallback>en-US</UILanguageFallback>
-      <UserLocale>en-US</UserLocale>
-    </component>
-    <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DiskConfiguration>
-        <Disk wcm:action="add">
-          <DiskID>0</DiskID>
-          <WillWipeDisk>true</WillWipeDisk>
-          <CreatePartitions>
-            <!-- System partition (ESP) -->
-            <CreatePartition wcm:action="add">
-              <Order>1</Order>
-              <Type>EFI</Type>
-              <Size>128</Size>
-            </CreatePartition>
-            <!-- Microsoft reserved partition (MSR) -->
-            <CreatePartition wcm:action="add">
-              <Order>2</Order>
-              <Type>MSR</Type>
-              <Size>128</Size>
-            </CreatePartition>
-            <!-- Windows partition -->
-            <CreatePartition wcm:action="add">
-              <Order>3</Order>
-              <Type>Primary</Type>
-              <Extend>true</Extend>
-            </CreatePartition>
-          </CreatePartitions>
-          <ModifyPartitions>
-            <!-- System partition (ESP) -->
-            <ModifyPartition wcm:action="add">
-              <Order>1</Order>
-              <PartitionID>1</PartitionID>
-              <Label>System</Label>
-              <Format>FAT32</Format>
-            </ModifyPartition>
-            <!-- MSR partition does not need to be modified -->
-            <ModifyPartition wcm:action="add">
-              <Order>2</Order>
-              <PartitionID>2</PartitionID>
-            </ModifyPartition>
-            <!-- Windows partition -->
-            <ModifyPartition wcm:action="add">
-              <Order>3</Order>
-              <PartitionID>3</PartitionID>
-              <Label>Windows</Label>
-              <Letter>C</Letter>
-              <Format>NTFS</Format>
-            </ModifyPartition>
-          </ModifyPartitions>
-        </Disk>
-      </DiskConfiguration>
-      <ImageInstall>
-        <OSImage>
-          <InstallFrom>
-            <MetaData wcm:action="add">
-              <Key>/IMAGE/NAME</Key>
-              <Value>Windows Server 2016 SERVERSTANDARD</Value>
-            </MetaData>
-          </InstallFrom>
-          <InstallTo>
-            <DiskID>0</DiskID>
-            <PartitionID>3</PartitionID>
-          </InstallTo>
-          <WillShowUI>OnError</WillShowUI>
-          <InstallToAvailablePartition>false</InstallToAvailablePartition>
-        </OSImage>
-      </ImageInstall>
-      <DynamicUpdate>
-        <Enable>true</Enable>
-        <WillShowUI>Never</WillShowUI>
-      </DynamicUpdate>
-      <UpgradeData>
-        <Upgrade>false</Upgrade>
-        <WillShowUI>Never</WillShowUI>
-      </UpgradeData>
-      <UserData>
-        <AcceptEula>true</AcceptEula>
-        <FullName>Docker</FullName>
-        <Organization>Windows for Docker</Organization>
-      </UserData>
-      <EnableFirewall>false</EnableFirewall>
-      <Diagnostics>
-        <OptIn>false</OptIn>
-      </Diagnostics>
-    </component>
-  </settings>
-  <settings pass="offlineServicing">
-    <component name="Microsoft-Windows-LUA-Settings" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <EnableLUA>false</EnableLUA>
-    </component>
-  </settings>
-  <settings pass="generalize">
-    <component name="Microsoft-Windows-PnPSysprep" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <PersistAllDeviceInstalls>true</PersistAllDeviceInstalls>
-    </component>
-    <component name="Microsoft-Windows-Security-SPP" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SkipRearm>1</SkipRearm>
-    </component>
-  </settings>
-  <settings pass="specialize">
-    <component name="Microsoft-Windows-Security-SPP-UX" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SkipAutoActivation>true</SkipAutoActivation>
-    </component>
-    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <ComputerName>*</ComputerName>
-      <OEMInformation>
-        <Manufacturer>Dockur</Manufacturer>
-        <Model>Windows for Docker</Model>
-      </OEMInformation>
-      <OEMName>Windows for Docker</OEMName>
-    </component>
-    <component name="Microsoft-Windows-ErrorReportingCore" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableWER>1</DisableWER>
-    </component>
-    <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableAccelerators>true</DisableAccelerators>
-      <DisableFirstRunWizard>true</DisableFirstRunWizard>
-      <Home_Page>https://google.com</Home_Page>
-      <Help_Page>about:blank</Help_Page>
-    </component>
-    <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="wow64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableAccelerators>true</DisableAccelerators>
-      <DisableFirstRunWizard>true</DisableFirstRunWizard>
-      <Home_Page>https://google.com</Home_Page>
-      <Help_Page>about:blank</Help_Page>
-    </component>
-    <component name="Microsoft-Windows-SQMApi" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <CEIPEnabled>0</CEIPEnabled>
-    </component>
-    <component name="Microsoft-Windows-SystemRestore-Main" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableSR>1</DisableSR>
-    </component>
-    <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UILanguageFallback>en-US</UILanguageFallback>
-      <UserLocale>en-US</UserLocale>
-    </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
-          <Description>Set Network Location to Home</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
-    <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DoNotOpenServerManagerAtLogon>true</DoNotOpenServerManagerAtLogon>
-    </component>
-    <component name="Microsoft-Windows-OutOfBoxExperience" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DoNotOpenInitialConfigurationTasksAtLogon>true</DoNotOpenInitialConfigurationTasksAtLogon>
-    </component>
-    <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <fDenyTSConnections>false</fDenyTSConnections>
-    </component>
-    <component name="Microsoft-Windows-TerminalServices-RDP-WinStationExtensions" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <UserAuthentication>0</UserAuthentication>
-    </component>
-    <component name="Networking-MPSSVC-Svc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <FirewallGroups>
-        <FirewallGroup wcm:action="add" wcm:keyValue="RemoteDesktop">
-          <Active>true</Active>
-          <Profile>all</Profile>
-          <Group>@FirewallAPI.dll,-28752</Group>
-        </FirewallGroup>
-      </FirewallGroups>
-    </component>
-  </settings>
-  <settings pass="oobeSystem">
-    <component name="Microsoft-Windows-SecureStartup-FilterDriver" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <PreventDeviceEncryption>true</PreventDeviceEncryption>
-    </component>
-    <component name="Microsoft-Windows-EnhancedStorage-Adm" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <TCGSecurityActivationDisabled>1</TCGSecurityActivationDisabled>
-    </component>
-    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <UserAccounts>
-        <LocalAccounts>
-          <LocalAccount wcm:action="add">
-            <Name>Docker</Name>
-            <Group>Administrators</Group>
-            <Password>
-              <Value />
-              <PlainText>true</PlainText>
-            </Password>
-          </LocalAccount>
-        </LocalAccounts>
-        <AdministratorPassword>
-          <Value>password</Value>
-          <PlainText>true</PlainText>
-        </AdministratorPassword>
-      </UserAccounts>
-      <AutoLogon>
-        <Username>Docker</Username>
-        <Enabled>true</Enabled>
-        <LogonCount>65432</LogonCount>
-        <Password>
-          <Value />
-          <PlainText>true</PlainText>
-        </Password>
-      </AutoLogon>
-      <Display>
-        <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
-      </Display>
-      <OOBE>
-        <HideEULAPage>true</HideEULAPage>
-        <HideLocalAccountScreen>true</HideLocalAccountScreen>
-        <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
-        <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
-        <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
-        <NetworkLocation>Home</NetworkLocation>
-        <ProtectYourPC>3</ProtectYourPC>
-        <SkipUserOOBE>true</SkipUserOOBE>
-        <SkipMachineOOBE>true</SkipMachineOOBE>
-      </OOBE>
-      <RegisteredOrganization>Dockur</RegisteredOrganization>
-      <RegisteredOwner>Windows for Docker</RegisteredOwner>
-      <FirstLogonCommands>
-        <SynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
-        </SynchronousCommand>
-      </FirstLogonCommands>
-    </component>
-  </settings>
-</unattend>

assets/win2016.cmd

@@ -0,0 +1,138 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Set Network Location to Home
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Disable Shutdown Event Tracker.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" /v "ShutdownReasonOn" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2016.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -77,7 +77,7 @@
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -155,8 +155,8 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
-          <Description>Set Network Location to Home</Description>
+          <Description>Run the specialize pass of the unattended setup script</Description>
         </RunSynchronousCommand>
       </RunSynchronous>
     </component>
@@ -196,14 +196,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -211,14 +211,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -236,103 +236,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2019-eval.xml

@@ -1,341 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-  <settings pass="windowsPE">
-    <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SetupUILanguage>
-        <UILanguage>en-US</UILanguage>
-      </SetupUILanguage>
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UILanguageFallback>en-US</UILanguageFallback>
-      <UserLocale>en-US</UserLocale>
-    </component>
-    <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DiskConfiguration>
-        <Disk wcm:action="add">
-          <DiskID>0</DiskID>
-          <WillWipeDisk>true</WillWipeDisk>
-          <CreatePartitions>
-            <!-- System partition (ESP) -->
-            <CreatePartition wcm:action="add">
-              <Order>1</Order>
-              <Type>EFI</Type>
-              <Size>128</Size>
-            </CreatePartition>
-            <!-- Microsoft reserved partition (MSR) -->
-            <CreatePartition wcm:action="add">
-              <Order>2</Order>
-              <Type>MSR</Type>
-              <Size>128</Size>
-            </CreatePartition>
-            <!-- Windows partition -->
-            <CreatePartition wcm:action="add">
-              <Order>3</Order>
-              <Type>Primary</Type>
-              <Extend>true</Extend>
-            </CreatePartition>
-          </CreatePartitions>
-          <ModifyPartitions>
-            <!-- System partition (ESP) -->
-            <ModifyPartition wcm:action="add">
-              <Order>1</Order>
-              <PartitionID>1</PartitionID>
-              <Label>System</Label>
-              <Format>FAT32</Format>
-            </ModifyPartition>
-            <!-- MSR partition does not need to be modified -->
-            <ModifyPartition wcm:action="add">
-              <Order>2</Order>
-              <PartitionID>2</PartitionID>
-            </ModifyPartition>
-            <!-- Windows partition -->
-            <ModifyPartition wcm:action="add">
-              <Order>3</Order>
-              <PartitionID>3</PartitionID>
-              <Label>Windows</Label>
-              <Letter>C</Letter>
-              <Format>NTFS</Format>
-            </ModifyPartition>
-          </ModifyPartitions>
-        </Disk>
-      </DiskConfiguration>
-      <ImageInstall>
-        <OSImage>
-          <InstallFrom>
-            <MetaData wcm:action="add">
-              <Key>/IMAGE/NAME</Key>
-              <Value>Windows Server 2019 SERVERSTANDARD</Value>
-            </MetaData>
-          </InstallFrom>
-          <InstallTo>
-            <DiskID>0</DiskID>
-            <PartitionID>3</PartitionID>
-          </InstallTo>
-          <WillShowUI>OnError</WillShowUI>
-          <InstallToAvailablePartition>false</InstallToAvailablePartition>
-        </OSImage>
-      </ImageInstall>
-      <DynamicUpdate>
-        <Enable>true</Enable>
-        <WillShowUI>Never</WillShowUI>
-      </DynamicUpdate>
-      <UpgradeData>
-        <Upgrade>false</Upgrade>
-        <WillShowUI>Never</WillShowUI>
-      </UpgradeData>
-      <UserData>
-        <AcceptEula>true</AcceptEula>
-        <FullName>Docker</FullName>
-        <Organization>Windows for Docker</Organization>
-      </UserData>
-      <EnableFirewall>false</EnableFirewall>
-      <Diagnostics>
-        <OptIn>false</OptIn>
-      </Diagnostics>
-    </component>
-  </settings>
-  <settings pass="offlineServicing">
-    <component name="Microsoft-Windows-LUA-Settings" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <EnableLUA>false</EnableLUA>
-    </component>
-  </settings>
-  <settings pass="generalize">
-    <component name="Microsoft-Windows-PnPSysprep" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <PersistAllDeviceInstalls>true</PersistAllDeviceInstalls>
-    </component>
-    <component name="Microsoft-Windows-Security-SPP" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SkipRearm>1</SkipRearm>
-    </component>
-  </settings>
-  <settings pass="specialize">
-    <component name="Microsoft-Windows-Security-SPP-UX" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SkipAutoActivation>true</SkipAutoActivation>
-    </component>
-    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <ComputerName>*</ComputerName>
-      <OEMInformation>
-        <Manufacturer>Dockur</Manufacturer>
-        <Model>Windows for Docker</Model>
-        <SupportHours>24/7</SupportHours>
-        <SupportPhone />
-        <SupportProvider>Dockur</SupportProvider>
-        <SupportURL>https://github.com/dockur/windows/issues</SupportURL>
-      </OEMInformation>
-      <OEMName>Windows for Docker</OEMName>
-    </component>
-    <component name="Microsoft-Windows-ErrorReportingCore" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableWER>1</DisableWER>
-    </component>
-    <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableAccelerators>true</DisableAccelerators>
-      <DisableFirstRunWizard>true</DisableFirstRunWizard>
-      <Home_Page>https://google.com</Home_Page>
-      <Help_Page>about:blank</Help_Page>
-    </component>
-    <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="wow64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableAccelerators>true</DisableAccelerators>
-      <DisableFirstRunWizard>true</DisableFirstRunWizard>
-      <Home_Page>https://google.com</Home_Page>
-      <Help_Page>about:blank</Help_Page>
-    </component>
-    <component name="Microsoft-Windows-SQMApi" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <CEIPEnabled>0</CEIPEnabled>
-    </component>
-    <component name="Microsoft-Windows-SystemRestore-Main" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableSR>1</DisableSR>
-    </component>
-    <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UILanguageFallback>en-US</UILanguageFallback>
-      <UserLocale>en-US</UserLocale>
-    </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
-          <Description>Set Network Location to Home</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
-    <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DoNotOpenServerManagerAtLogon>true</DoNotOpenServerManagerAtLogon>
-    </component>
-    <component name="Microsoft-Windows-OutOfBoxExperience" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DoNotOpenInitialConfigurationTasksAtLogon>true</DoNotOpenInitialConfigurationTasksAtLogon>
-    </component>
-    <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <fDenyTSConnections>false</fDenyTSConnections>
-    </component>
-    <component name="Microsoft-Windows-TerminalServices-RDP-WinStationExtensions" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <UserAuthentication>0</UserAuthentication>
-    </component>
-    <component name="Networking-MPSSVC-Svc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <FirewallGroups>
-        <FirewallGroup wcm:action="add" wcm:keyValue="RemoteDesktop">
-          <Active>true</Active>
-          <Profile>all</Profile>
-          <Group>@FirewallAPI.dll,-28752</Group>
-        </FirewallGroup>
-      </FirewallGroups>
-    </component>
-  </settings>
-  <settings pass="oobeSystem">
-    <component name="Microsoft-Windows-SecureStartup-FilterDriver" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <PreventDeviceEncryption>true</PreventDeviceEncryption>
-    </component>
-    <component name="Microsoft-Windows-EnhancedStorage-Adm" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <TCGSecurityActivationDisabled>1</TCGSecurityActivationDisabled>
-    </component>
-    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <UserAccounts>
-        <LocalAccounts>
-          <LocalAccount wcm:action="add">
-            <Name>Docker</Name>
-            <Group>Administrators</Group>
-            <Password>
-              <Value />
-              <PlainText>true</PlainText>
-            </Password>
-          </LocalAccount>
-        </LocalAccounts>
-        <AdministratorPassword>
-          <Value>password</Value>
-          <PlainText>true</PlainText>
-        </AdministratorPassword>
-      </UserAccounts>
-      <AutoLogon>
-        <Username>Docker</Username>
-        <Enabled>true</Enabled>
-        <LogonCount>65432</LogonCount>
-        <Password>
-          <Value />
-          <PlainText>true</PlainText>
-        </Password>
-      </AutoLogon>
-      <Display>
-        <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
-      </Display>
-      <OOBE>
-        <HideEULAPage>true</HideEULAPage>
-        <HideLocalAccountScreen>true</HideLocalAccountScreen>
-        <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
-        <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
-        <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
-        <NetworkLocation>Home</NetworkLocation>
-        <ProtectYourPC>3</ProtectYourPC>
-        <SkipUserOOBE>true</SkipUserOOBE>
-        <SkipMachineOOBE>true</SkipMachineOOBE>
-      </OOBE>
-      <RegisteredOrganization>Dockur</RegisteredOrganization>
-      <RegisteredOwner>Windows for Docker</RegisteredOwner>
-      <FirstLogonCommands>
-        <SynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
-        </SynchronousCommand>
-      </FirstLogonCommands>
-    </component>
-  </settings>
-</unattend>

assets/win2019-hv.cmd

@@ -0,0 +1,138 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Set Network Location to Home
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f
+
+rem Disable Hyper-V role
+dism.exe /online /Disable-Feature /FeatureName:Microsoft-Hyper-V /NoRestart
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Disable Shutdown Event Tracker.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" /v "ShutdownReasonOn" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2019-hv.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -64,12 +64,12 @@
         <OSImage>
           <InstallFrom>
             <MetaData wcm:action="add">
-              <Key>/image/index</Key>
+              <Key>/IMAGE/NAME</Key>
-              <Value>2</Value>
+              <Value>Hyper-V Server 2019 SERVERHYPERCORE</Value>
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -77,7 +77,7 @@
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -117,6 +117,10 @@
       <OEMInformation>
         <Manufacturer>Dockur</Manufacturer>
         <Model>Windows for Docker</Model>
+        <SupportHours>24/7</SupportHours>
+        <SupportPhone />
+        <SupportProvider>Dockur</SupportProvider>
+        <SupportURL>https://github.com/dockur/windows/issues</SupportURL>
       </OEMInformation>
       <OEMName>Windows for Docker</OEMName>
     </component>
@@ -152,8 +156,8 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
-          <Description>Set Network Location to Home</Description>
+          <Description>Run the specialize pass of the unattended setup script</Description>
         </RunSynchronousCommand>
       </RunSynchronous>
     </component>
@@ -193,14 +197,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -208,14 +212,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -233,83 +237,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2019.cmd

@@ -0,0 +1,144 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Set Network Location to Home
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Disable Shutdown Event Tracker.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" /v "ShutdownReasonOn" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2019.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -77,7 +77,7 @@
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -159,8 +159,8 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
-          <Description>Set Network Location to Home</Description>
+          <Description>Run the specialize pass of the unattended setup script</Description>
         </RunSynchronousCommand>
       </RunSynchronous>
     </component>
@@ -200,14 +200,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -215,14 +215,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -240,103 +240,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2022-eval.xml

@@ -1,341 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-  <settings pass="windowsPE">
-    <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SetupUILanguage>
-        <UILanguage>en-US</UILanguage>
-      </SetupUILanguage>
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UILanguageFallback>en-US</UILanguageFallback>
-      <UserLocale>en-US</UserLocale>
-    </component>
-    <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DiskConfiguration>
-        <Disk wcm:action="add">
-          <DiskID>0</DiskID>
-          <WillWipeDisk>true</WillWipeDisk>
-          <CreatePartitions>
-            <!-- System partition (ESP) -->
-            <CreatePartition wcm:action="add">
-              <Order>1</Order>
-              <Type>EFI</Type>
-              <Size>128</Size>
-            </CreatePartition>
-            <!-- Microsoft reserved partition (MSR) -->
-            <CreatePartition wcm:action="add">
-              <Order>2</Order>
-              <Type>MSR</Type>
-              <Size>128</Size>
-            </CreatePartition>
-            <!-- Windows partition -->
-            <CreatePartition wcm:action="add">
-              <Order>3</Order>
-              <Type>Primary</Type>
-              <Extend>true</Extend>
-            </CreatePartition>
-          </CreatePartitions>
-          <ModifyPartitions>
-            <!-- System partition (ESP) -->
-            <ModifyPartition wcm:action="add">
-              <Order>1</Order>
-              <PartitionID>1</PartitionID>
-              <Label>System</Label>
-              <Format>FAT32</Format>
-            </ModifyPartition>
-            <!-- MSR partition does not need to be modified -->
-            <ModifyPartition wcm:action="add">
-              <Order>2</Order>
-              <PartitionID>2</PartitionID>
-            </ModifyPartition>
-            <!-- Windows partition -->
-            <ModifyPartition wcm:action="add">
-              <Order>3</Order>
-              <PartitionID>3</PartitionID>
-              <Label>Windows</Label>
-              <Letter>C</Letter>
-              <Format>NTFS</Format>
-            </ModifyPartition>
-          </ModifyPartitions>
-        </Disk>
-      </DiskConfiguration>
-      <ImageInstall>
-        <OSImage>
-          <InstallFrom>
-            <MetaData wcm:action="add">
-              <Key>/IMAGE/NAME</Key>
-              <Value>Windows Server 2022 SERVERSTANDARD</Value>
-            </MetaData>
-          </InstallFrom>
-          <InstallTo>
-            <DiskID>0</DiskID>
-            <PartitionID>3</PartitionID>
-          </InstallTo>
-          <WillShowUI>OnError</WillShowUI>
-          <InstallToAvailablePartition>false</InstallToAvailablePartition>
-        </OSImage>
-      </ImageInstall>
-      <DynamicUpdate>
-        <Enable>true</Enable>
-        <WillShowUI>Never</WillShowUI>
-      </DynamicUpdate>
-      <UpgradeData>
-        <Upgrade>false</Upgrade>
-        <WillShowUI>Never</WillShowUI>
-      </UpgradeData>
-      <UserData>
-        <AcceptEula>true</AcceptEula>
-        <FullName>Docker</FullName>
-        <Organization>Windows for Docker</Organization>
-      </UserData>
-      <EnableFirewall>false</EnableFirewall>
-      <Diagnostics>
-        <OptIn>false</OptIn>
-      </Diagnostics>
-    </component>
-  </settings>
-  <settings pass="offlineServicing">
-    <component name="Microsoft-Windows-LUA-Settings" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <EnableLUA>false</EnableLUA>
-    </component>
-  </settings>
-  <settings pass="generalize">
-    <component name="Microsoft-Windows-PnPSysprep" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <PersistAllDeviceInstalls>true</PersistAllDeviceInstalls>
-    </component>
-    <component name="Microsoft-Windows-Security-SPP" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SkipRearm>1</SkipRearm>
-    </component>
-  </settings>
-  <settings pass="specialize">
-    <component name="Microsoft-Windows-Security-SPP-UX" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SkipAutoActivation>true</SkipAutoActivation>
-    </component>
-    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <ComputerName>*</ComputerName>
-      <OEMInformation>
-        <Manufacturer>Dockur</Manufacturer>
-        <Model>Windows for Docker</Model>
-        <SupportHours>24/7</SupportHours>
-        <SupportPhone />
-        <SupportProvider>Dockur</SupportProvider>
-        <SupportURL>https://github.com/dockur/windows/issues</SupportURL>
-      </OEMInformation>
-      <OEMName>Windows for Docker</OEMName>
-    </component>
-    <component name="Microsoft-Windows-ErrorReportingCore" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableWER>1</DisableWER>
-    </component>
-    <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableAccelerators>true</DisableAccelerators>
-      <DisableFirstRunWizard>true</DisableFirstRunWizard>
-      <Home_Page>https://google.com</Home_Page>
-      <Help_Page>about:blank</Help_Page>
-    </component>
-    <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="wow64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableAccelerators>true</DisableAccelerators>
-      <DisableFirstRunWizard>true</DisableFirstRunWizard>
-      <Home_Page>https://google.com</Home_Page>
-      <Help_Page>about:blank</Help_Page>
-    </component>
-    <component name="Microsoft-Windows-SQMApi" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <CEIPEnabled>0</CEIPEnabled>
-    </component>
-    <component name="Microsoft-Windows-SystemRestore-Main" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableSR>1</DisableSR>
-    </component>
-    <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UILanguageFallback>en-US</UILanguageFallback>
-      <UserLocale>en-US</UserLocale>
-    </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
-          <Description>Set Network Location to Home</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
-    <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DoNotOpenServerManagerAtLogon>true</DoNotOpenServerManagerAtLogon>
-    </component>
-    <component name="Microsoft-Windows-OutOfBoxExperience" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DoNotOpenInitialConfigurationTasksAtLogon>true</DoNotOpenInitialConfigurationTasksAtLogon>
-    </component>
-    <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <fDenyTSConnections>false</fDenyTSConnections>
-    </component>
-    <component name="Microsoft-Windows-TerminalServices-RDP-WinStationExtensions" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <UserAuthentication>0</UserAuthentication>
-    </component>
-    <component name="Networking-MPSSVC-Svc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <FirewallGroups>
-        <FirewallGroup wcm:action="add" wcm:keyValue="RemoteDesktop">
-          <Active>true</Active>
-          <Profile>all</Profile>
-          <Group>@FirewallAPI.dll,-28752</Group>
-        </FirewallGroup>
-      </FirewallGroups>
-    </component>
-  </settings>
-  <settings pass="oobeSystem">
-    <component name="Microsoft-Windows-SecureStartup-FilterDriver" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <PreventDeviceEncryption>true</PreventDeviceEncryption>
-    </component>
-    <component name="Microsoft-Windows-EnhancedStorage-Adm" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <TCGSecurityActivationDisabled>1</TCGSecurityActivationDisabled>
-    </component>
-    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <UserAccounts>
-        <LocalAccounts>
-          <LocalAccount wcm:action="add">
-            <Name>Docker</Name>
-            <Group>Administrators</Group>
-            <Password>
-              <Value />
-              <PlainText>true</PlainText>
-            </Password>
-          </LocalAccount>
-        </LocalAccounts>
-        <AdministratorPassword>
-          <Value>password</Value>
-          <PlainText>true</PlainText>
-        </AdministratorPassword>
-      </UserAccounts>
-      <AutoLogon>
-        <Username>Docker</Username>
-        <Enabled>true</Enabled>
-        <LogonCount>65432</LogonCount>
-        <Password>
-          <Value />
-          <PlainText>true</PlainText>
-        </Password>
-      </AutoLogon>
-      <Display>
-        <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
-      </Display>
-      <OOBE>
-        <HideEULAPage>true</HideEULAPage>
-        <HideLocalAccountScreen>true</HideLocalAccountScreen>
-        <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
-        <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
-        <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
-        <NetworkLocation>Home</NetworkLocation>
-        <ProtectYourPC>3</ProtectYourPC>
-        <SkipUserOOBE>true</SkipUserOOBE>
-        <SkipMachineOOBE>true</SkipMachineOOBE>
-      </OOBE>
-      <RegisteredOrganization>Dockur</RegisteredOrganization>
-      <RegisteredOwner>Windows for Docker</RegisteredOwner>
-      <FirstLogonCommands>
-        <SynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
-        </SynchronousCommand>
-      </FirstLogonCommands>
-    </component>
-  </settings>
-</unattend>

assets/win2022.cmd

@@ -0,0 +1,144 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Set Network Location to Home
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Disable Shutdown Event Tracker.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" /v "ShutdownReasonOn" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2022.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -77,7 +77,7 @@
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -159,8 +159,8 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
-          <Description>Set Network Location to Home</Description>
+          <Description>Run the specialize pass of the unattended setup script</Description>
         </RunSynchronousCommand>
       </RunSynchronous>
     </component>
@@ -200,14 +200,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -215,14 +215,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -240,103 +240,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2025-eval.xml

@@ -1,341 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-  <settings pass="windowsPE">
-    <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SetupUILanguage>
-        <UILanguage>en-US</UILanguage>
-      </SetupUILanguage>
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UILanguageFallback>en-US</UILanguageFallback>
-      <UserLocale>en-US</UserLocale>
-    </component>
-    <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DiskConfiguration>
-        <Disk wcm:action="add">
-          <DiskID>0</DiskID>
-          <WillWipeDisk>true</WillWipeDisk>
-          <CreatePartitions>
-            <!-- System partition (ESP) -->
-            <CreatePartition wcm:action="add">
-              <Order>1</Order>
-              <Type>EFI</Type>
-              <Size>128</Size>
-            </CreatePartition>
-            <!-- Microsoft reserved partition (MSR) -->
-            <CreatePartition wcm:action="add">
-              <Order>2</Order>
-              <Type>MSR</Type>
-              <Size>128</Size>
-            </CreatePartition>
-            <!-- Windows partition -->
-            <CreatePartition wcm:action="add">
-              <Order>3</Order>
-              <Type>Primary</Type>
-              <Extend>true</Extend>
-            </CreatePartition>
-          </CreatePartitions>
-          <ModifyPartitions>
-            <!-- System partition (ESP) -->
-            <ModifyPartition wcm:action="add">
-              <Order>1</Order>
-              <PartitionID>1</PartitionID>
-              <Label>System</Label>
-              <Format>FAT32</Format>
-            </ModifyPartition>
-            <!-- MSR partition does not need to be modified -->
-            <ModifyPartition wcm:action="add">
-              <Order>2</Order>
-              <PartitionID>2</PartitionID>
-            </ModifyPartition>
-            <!-- Windows partition -->
-            <ModifyPartition wcm:action="add">
-              <Order>3</Order>
-              <PartitionID>3</PartitionID>
-              <Label>Windows</Label>
-              <Letter>C</Letter>
-              <Format>NTFS</Format>
-            </ModifyPartition>
-          </ModifyPartitions>
-        </Disk>
-      </DiskConfiguration>
-      <ImageInstall>
-        <OSImage>
-          <InstallFrom>
-            <MetaData wcm:action="add">
-              <Key>/IMAGE/NAME</Key>
-              <Value>Windows Server 2025 SERVERSTANDARD</Value>
-            </MetaData>
-          </InstallFrom>
-          <InstallTo>
-            <DiskID>0</DiskID>
-            <PartitionID>3</PartitionID>
-          </InstallTo>
-          <WillShowUI>OnError</WillShowUI>
-          <InstallToAvailablePartition>false</InstallToAvailablePartition>
-        </OSImage>
-      </ImageInstall>
-      <DynamicUpdate>
-        <Enable>true</Enable>
-        <WillShowUI>Never</WillShowUI>
-      </DynamicUpdate>
-      <UpgradeData>
-        <Upgrade>false</Upgrade>
-        <WillShowUI>Never</WillShowUI>
-      </UpgradeData>
-      <UserData>
-        <AcceptEula>true</AcceptEula>
-        <FullName>Docker</FullName>
-        <Organization>Windows for Docker</Organization>
-      </UserData>
-      <EnableFirewall>false</EnableFirewall>
-      <Diagnostics>
-        <OptIn>false</OptIn>
-      </Diagnostics>
-    </component>
-  </settings>
-  <settings pass="offlineServicing">
-    <component name="Microsoft-Windows-LUA-Settings" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <EnableLUA>false</EnableLUA>
-    </component>
-  </settings>
-  <settings pass="generalize">
-    <component name="Microsoft-Windows-PnPSysprep" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <PersistAllDeviceInstalls>true</PersistAllDeviceInstalls>
-    </component>
-    <component name="Microsoft-Windows-Security-SPP" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SkipRearm>1</SkipRearm>
-    </component>
-  </settings>
-  <settings pass="specialize">
-    <component name="Microsoft-Windows-Security-SPP-UX" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SkipAutoActivation>true</SkipAutoActivation>
-    </component>
-    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <ComputerName>*</ComputerName>
-      <OEMInformation>
-        <Manufacturer>Dockur</Manufacturer>
-        <Model>Windows for Docker</Model>
-        <SupportHours>24/7</SupportHours>
-        <SupportPhone />
-        <SupportProvider>Dockur</SupportProvider>
-        <SupportURL>https://github.com/dockur/windows/issues</SupportURL>
-      </OEMInformation>
-      <OEMName>Windows for Docker</OEMName>
-    </component>
-    <component name="Microsoft-Windows-ErrorReportingCore" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableWER>1</DisableWER>
-    </component>
-    <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableAccelerators>true</DisableAccelerators>
-      <DisableFirstRunWizard>true</DisableFirstRunWizard>
-      <Home_Page>https://google.com</Home_Page>
-      <Help_Page>about:blank</Help_Page>
-    </component>
-    <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="wow64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableAccelerators>true</DisableAccelerators>
-      <DisableFirstRunWizard>true</DisableFirstRunWizard>
-      <Home_Page>https://google.com</Home_Page>
-      <Help_Page>about:blank</Help_Page>
-    </component>
-    <component name="Microsoft-Windows-SQMApi" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <CEIPEnabled>0</CEIPEnabled>
-    </component>
-    <component name="Microsoft-Windows-SystemRestore-Main" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableSR>1</DisableSR>
-    </component>
-    <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UILanguageFallback>en-US</UILanguageFallback>
-      <UserLocale>en-US</UserLocale>
-    </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
-          <Description>Set Network Location to Home</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
-    <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DoNotOpenServerManagerAtLogon>true</DoNotOpenServerManagerAtLogon>
-    </component>
-    <component name="Microsoft-Windows-OutOfBoxExperience" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DoNotOpenInitialConfigurationTasksAtLogon>true</DoNotOpenInitialConfigurationTasksAtLogon>
-    </component>
-    <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <fDenyTSConnections>false</fDenyTSConnections>
-    </component>
-    <component name="Microsoft-Windows-TerminalServices-RDP-WinStationExtensions" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <UserAuthentication>0</UserAuthentication>
-    </component>
-    <component name="Networking-MPSSVC-Svc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <FirewallGroups>
-        <FirewallGroup wcm:action="add" wcm:keyValue="RemoteDesktop">
-          <Active>true</Active>
-          <Profile>all</Profile>
-          <Group>@FirewallAPI.dll,-28752</Group>
-        </FirewallGroup>
-      </FirewallGroups>
-    </component>
-  </settings>
-  <settings pass="oobeSystem">
-    <component name="Microsoft-Windows-SecureStartup-FilterDriver" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <PreventDeviceEncryption>true</PreventDeviceEncryption>
-    </component>
-    <component name="Microsoft-Windows-EnhancedStorage-Adm" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <TCGSecurityActivationDisabled>1</TCGSecurityActivationDisabled>
-    </component>
-    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <UserAccounts>
-        <LocalAccounts>
-          <LocalAccount wcm:action="add">
-            <Name>Docker</Name>
-            <Group>Administrators</Group>
-            <Password>
-              <Value />
-              <PlainText>true</PlainText>
-            </Password>
-          </LocalAccount>
-        </LocalAccounts>
-        <AdministratorPassword>
-          <Value>password</Value>
-          <PlainText>true</PlainText>
-        </AdministratorPassword>
-      </UserAccounts>
-      <AutoLogon>
-        <Username>Docker</Username>
-        <Enabled>true</Enabled>
-        <LogonCount>65432</LogonCount>
-        <Password>
-          <Value />
-          <PlainText>true</PlainText>
-        </Password>
-      </AutoLogon>
-      <Display>
-        <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
-      </Display>
-      <OOBE>
-        <HideEULAPage>true</HideEULAPage>
-        <HideLocalAccountScreen>true</HideLocalAccountScreen>
-        <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
-        <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
-        <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
-        <NetworkLocation>Home</NetworkLocation>
-        <ProtectYourPC>3</ProtectYourPC>
-        <SkipUserOOBE>true</SkipUserOOBE>
-        <SkipMachineOOBE>true</SkipMachineOOBE>
-      </OOBE>
-      <RegisteredOrganization>Dockur</RegisteredOrganization>
-      <RegisteredOwner>Windows for Docker</RegisteredOwner>
-      <FirstLogonCommands>
-        <SynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
-        </SynchronousCommand>
-      </FirstLogonCommands>
-    </component>
-  </settings>
-</unattend>

assets/win2025.cmd

@@ -0,0 +1,141 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Set Network Location to Home
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Disable Shutdown Event Tracker.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" /v "ShutdownReasonOn" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Disable the SMB signing requirement.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable per-CPU clock tick scheduling.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "EnablePerCpuClockTickScheduling" /t REG_DWORD /d 2 /f
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "FlightSettingsMaxPauseDays" /t REG_DWORD /d 3650 /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseFeatureUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseQualityUpdatesEndTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesStartTime" /t REG_SZ /d "2026-01-01T00:00:00Z" /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "PauseUpdatesExpiryTime" /t REG_SZ /d "2035-12-29T00:00:00Z" /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Remove the empty Windows.old folder.
+if exist "%SystemDrive%\Windows.old" rd /q "%SystemDrive%\Windows.old"
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2025.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -77,7 +77,7 @@
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -159,8 +159,8 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
-          <Description>Set Network Location to Home</Description>
+          <Description>Run the specialize pass of the unattended setup script</Description>
         </RunSynchronousCommand>
       </RunSynchronous>
     </component>
@@ -200,14 +200,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -215,14 +215,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -240,103 +240,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x64-enterprise.cmd

@@ -0,0 +1,120 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable AutoPlay for all drives.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /t REG_DWORD /d 255 /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x64-enterprise.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,14 +57,14 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -152,6 +152,15 @@
         </FirewallGroup>
       </FirewallGroups>
     </component>
+    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+      <RunSynchronous>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
+          <Description>Run the specialize pass of the unattended setup script</Description>
+        </RunSynchronousCommand>
+      </RunSynchronous>
+    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -161,14 +170,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -176,14 +185,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -198,88 +207,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x64-ultimate.cmd

@@ -0,0 +1,120 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable AutoPlay for all drives.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /t REG_DWORD /d 255 /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x64-ultimate.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,14 +57,14 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -152,6 +152,15 @@
         </FirewallGroup>
       </FirewallGroups>
     </component>
+    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+      <RunSynchronous>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
+          <Description>Run the specialize pass of the unattended setup script</Description>
+        </RunSynchronousCommand>
+      </RunSynchronous>
+    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -161,14 +170,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -176,14 +185,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -198,88 +207,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x64.cmd

@@ -0,0 +1,120 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable AutoPlay for all drives.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /t REG_DWORD /d 255 /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x64.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,14 +57,14 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -152,6 +152,15 @@
         </FirewallGroup>
       </FirewallGroups>
     </component>
+    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+      <RunSynchronous>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
+          <Description>Run the specialize pass of the unattended setup script</Description>
+        </RunSynchronousCommand>
+      </RunSynchronous>
+    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -161,14 +170,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -176,14 +185,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -198,88 +207,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x86-enterprise.cmd

@@ -0,0 +1,123 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable AutoPlay for all drives.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /t REG_DWORD /d 255 /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable AutoPlay for all drives.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /t REG_DWORD /d 255 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x86-enterprise.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,14 +57,14 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -152,6 +152,15 @@
         </FirewallGroup>
       </FirewallGroups>
     </component>
+    <component name="Microsoft-Windows-Deployment" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+      <RunSynchronous>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
+          <Description>Run the specialize pass of the unattended setup script</Description>
+        </RunSynchronousCommand>
+      </RunSynchronous>
+    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -161,14 +170,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -176,14 +185,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -198,88 +207,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x86-ultimate.cmd

@@ -0,0 +1,120 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable AutoPlay for all drives.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /t REG_DWORD /d 255 /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x86-ultimate.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,14 +57,14 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -152,6 +152,15 @@
         </FirewallGroup>
       </FirewallGroups>
     </component>
+    <component name="Microsoft-Windows-Deployment" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+      <RunSynchronous>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
+          <Description>Run the specialize pass of the unattended setup script</Description>
+        </RunSynchronousCommand>
+      </RunSynchronous>
+    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -161,14 +170,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -176,14 +185,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -198,88 +207,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x86.cmd

@@ -0,0 +1,120 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable AutoPlay for all drives.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /t REG_DWORD /d 255 /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x86.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,14 +57,14 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -152,6 +152,15 @@
         </FirewallGroup>
       </FirewallGroups>
     </component>
+    <component name="Microsoft-Windows-Deployment" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+      <RunSynchronous>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
+          <Description>Run the specialize pass of the unattended setup script</Description>
+        </RunSynchronousCommand>
+      </RunSynchronous>
+    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -161,14 +170,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -176,14 +185,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -198,88 +207,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win81x64-enterprise-eval.xml

@@ -1,302 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-  <settings pass="windowsPE">
-    <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SetupUILanguage>
-        <UILanguage>en-US</UILanguage>
-      </SetupUILanguage>
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UserLocale>en-US</UserLocale>
-    </component>
-    <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DiskConfiguration>
-        <Disk wcm:action="add">
-          <DiskID>0</DiskID>
-          <WillWipeDisk>true</WillWipeDisk>
-          <CreatePartitions>
-            <!-- System partition (ESP) -->
-            <CreatePartition wcm:action="add">
-              <Order>1</Order>
-              <Type>EFI</Type>
-              <Size>128</Size>
-            </CreatePartition>
-            <!-- Microsoft reserved partition (MSR) -->
-            <CreatePartition wcm:action="add">
-              <Order>2</Order>
-              <Type>MSR</Type>
-              <Size>128</Size>
-            </CreatePartition>
-            <!-- Windows partition -->
-            <CreatePartition wcm:action="add">
-              <Order>3</Order>
-              <Type>Primary</Type>
-              <Extend>true</Extend>
-            </CreatePartition>
-          </CreatePartitions>
-          <ModifyPartitions>
-            <!-- System partition (ESP) -->
-            <ModifyPartition wcm:action="add">
-              <Order>1</Order>
-              <PartitionID>1</PartitionID>
-              <Label>System</Label>
-              <Format>FAT32</Format>
-            </ModifyPartition>
-            <!-- MSR partition does not need to be modified -->
-            <ModifyPartition wcm:action="add">
-              <Order>2</Order>
-              <PartitionID>2</PartitionID>
-            </ModifyPartition>
-            <!-- Windows partition -->
-            <ModifyPartition wcm:action="add">
-              <Order>3</Order>
-              <PartitionID>3</PartitionID>
-              <Label>Windows</Label>
-              <Letter>C</Letter>
-              <Format>NTFS</Format>
-            </ModifyPartition>
-          </ModifyPartitions>
-        </Disk>
-      </DiskConfiguration>
-      <ImageInstall>
-        <OSImage>
-          <InstallTo>
-            <DiskID>0</DiskID>
-            <PartitionID>3</PartitionID>
-          </InstallTo>
-          <InstallToAvailablePartition>false</InstallToAvailablePartition>
-        </OSImage>
-      </ImageInstall>
-      <DynamicUpdate>
-        <Enable>true</Enable>
-        <WillShowUI>Never</WillShowUI>
-      </DynamicUpdate>
-      <UpgradeData>
-        <Upgrade>false</Upgrade>
-        <WillShowUI>Never</WillShowUI>
-      </UpgradeData>
-      <UserData>
-        <AcceptEula>true</AcceptEula>
-        <FullName>Docker</FullName>
-        <Organization>Windows for Docker</Organization>
-      </UserData>
-      <EnableFirewall>false</EnableFirewall>
-      <Diagnostics>
-        <OptIn>false</OptIn>
-      </Diagnostics>
-    </component>
-  </settings>
-  <settings pass="offlineServicing">
-    <component name="Microsoft-Windows-LUA-Settings" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <EnableLUA>false</EnableLUA>
-    </component>
-  </settings>
-  <settings pass="generalize">
-    <component name="Microsoft-Windows-PnPSysprep" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <PersistAllDeviceInstalls>true</PersistAllDeviceInstalls>
-    </component>
-    <component name="Microsoft-Windows-Security-SPP" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SkipRearm>1</SkipRearm>
-    </component>
-  </settings>
-  <settings pass="specialize">
-    <component name="Microsoft-Windows-Security-SPP-UX" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <SkipAutoActivation>true</SkipAutoActivation>
-    </component>
-    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <ComputerName>*</ComputerName>
-      <OEMInformation>
-        <Manufacturer>Dockur</Manufacturer>
-        <Model>Windows for Docker</Model>
-      </OEMInformation>
-      <OEMName>Windows for Docker</OEMName>
-    </component>
-    <component name="Microsoft-Windows-ErrorReportingCore" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableWER>1</DisableWER>
-    </component>
-    <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableAccelerators>true</DisableAccelerators>
-      <DisableFirstRunWizard>true</DisableFirstRunWizard>
-      <Home_Page>https://google.com</Home_Page>
-      <Help_Page>about:blank</Help_Page>
-    </component>
-    <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="wow64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableAccelerators>true</DisableAccelerators>
-      <DisableFirstRunWizard>true</DisableFirstRunWizard>
-      <Home_Page>https://google.com</Home_Page>
-      <Help_Page>about:blank</Help_Page>
-    </component>
-    <component name="Microsoft-Windows-SQMApi" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <CEIPEnabled>0</CEIPEnabled>
-    </component>
-    <component name="Microsoft-Windows-SystemRestore-Main" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <DisableSR>1</DisableSR>
-    </component>
-    <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UserLocale>en-US</UserLocale>
-    </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
-          <Description>Set Network Location to Home</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
-    <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <fDenyTSConnections>false</fDenyTSConnections>
-    </component>
-    <component name="Microsoft-Windows-TerminalServices-RDP-WinStationExtensions" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <UserAuthentication>0</UserAuthentication>
-    </component>
-    <component name="Networking-MPSSVC-Svc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <FirewallGroups>
-        <FirewallGroup wcm:action="add" wcm:keyValue="RemoteDesktop">
-          <Active>true</Active>
-          <Profile>all</Profile>
-          <Group>@FirewallAPI.dll,-28752</Group>
-        </FirewallGroup>
-      </FirewallGroups>
-    </component>
-  </settings>
-  <settings pass="oobeSystem">
-    <component name="Microsoft-Windows-SecureStartup-FilterDriver" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <PreventDeviceEncryption>true</PreventDeviceEncryption>
-    </component>
-    <component name="Microsoft-Windows-EnhancedStorage-Adm" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <TCGSecurityActivationDisabled>1</TCGSecurityActivationDisabled>
-    </component>
-    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <UserAccounts>
-        <LocalAccounts>
-          <LocalAccount wcm:action="add">
-            <Name>Docker</Name>
-            <Group>Administrators</Group>
-            <Password>
-              <Value />
-              <PlainText>true</PlainText>
-            </Password>
-          </LocalAccount>
-        </LocalAccounts>
-        <AdministratorPassword>
-          <Value>password</Value>
-          <PlainText>true</PlainText>
-        </AdministratorPassword>
-      </UserAccounts>
-      <AutoLogon>
-        <Username>Docker</Username>
-        <Enabled>true</Enabled>
-        <LogonCount>65432</LogonCount>
-        <Password>
-          <Value />
-          <PlainText>true</PlainText>
-        </Password>
-      </AutoLogon>
-      <Display>
-        <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
-      </Display>
-      <OOBE>
-        <HideEULAPage>true</HideEULAPage>
-        <HideLocalAccountScreen>true</HideLocalAccountScreen>
-        <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
-        <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
-        <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
-        <NetworkLocation>Home</NetworkLocation>
-        <ProtectYourPC>3</ProtectYourPC>
-        <SkipUserOOBE>true</SkipUserOOBE>
-        <SkipMachineOOBE>true</SkipMachineOOBE>
-      </OOBE>
-      <RegisteredOrganization>Dockur</RegisteredOrganization>
-      <RegisteredOwner>Windows for Docker</RegisteredOwner>
-      <FirstLogonCommands>
-        <SynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
-        </SynchronousCommand>
-      </FirstLogonCommands>
-    </component>
-  </settings>
-</unattend>

assets/win81x64-enterprise.cmd

@@ -0,0 +1,120 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Set Network Location to Home
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win81x64-enterprise.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,14 +62,14 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -146,8 +146,8 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
-          <Description>Set Network Location to Home</Description>
+          <Description>Run the specialize pass of the unattended setup script</Description>
         </RunSynchronousCommand>
       </RunSynchronous>
     </component>
@@ -181,14 +181,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -196,14 +196,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -221,83 +221,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win81x64.cmd

@@ -0,0 +1,120 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Set Network Location to Home
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win81x64.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -68,14 +68,14 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
         </OSImage>
       </ImageInstall>
       <DynamicUpdate>
-        <Enable>true</Enable>
+        <Enable>false</Enable>
         <WillShowUI>Never</WillShowUI>
       </DynamicUpdate>
       <UpgradeData>
@@ -153,8 +153,8 @@
       <RunSynchronous>
           <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
-          <Description>Set Network Location to Home</Description>
+          <Description>Run the specialize pass of the unattended setup script</Description>
         </RunSynchronousCommand>
       </RunSynchronous>
     </component>
@@ -188,14 +188,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -203,14 +203,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -228,83 +228,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/winvistax64-enterprise.cmd

@@ -0,0 +1,138 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable AutoPlay for all drives.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /t REG_DWORD /d 255 /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Add RDP in firewall.
+netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
+
+rem Enable RDP.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
+
+rem Turn off sidebar.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/winvistax64-enterprise.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -44,7 +44,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>1</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -90,6 +90,15 @@
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <fDenyTSConnections>false</fDenyTSConnections>
     </component>
+    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+      <RunSynchronous>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
+          <Description>Run the specialize pass of the unattended setup script</Description>
+        </RunSynchronousCommand>
+      </RunSynchronous>
+    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -111,14 +120,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -126,14 +135,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -147,113 +156,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</CommandLine>
-          <Description>Add RDP in firewall</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable RDP</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off sidebar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/winvistax64-ultimate.cmd

@@ -0,0 +1,138 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+if /i "%~1"=="specialize" goto specialize
+exit /b 2
+
+:specialize
+
+rem Install the VMWare display driver before Windows Setup's final reboot.
+certutil.exe -addstore -f Root "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+certutil.exe -addstore -f TrustedPublisher "%SystemRoot%\Drivers\vmsvga\vm3d.cer" >nul 2>&1
+start "" /wait /b pnputil.exe -i -a "%SystemRoot%\Drivers\vmsvga\vm3d.inf" >nul 2>&1
+
+exit /b 0
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Ignore unclean shutdowns when deciding whether to enter recovery.
+bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
+
+rem Keep the blue screen visible after a system crash.
+bcdedit.exe /set {current} nocrashautoreboot on
+
+rem Boot the default entry immediately without waiting at the boot menu.
+bcdedit.exe /timeout 0
+
+rem Disable automatic reboot after BSOD
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable AutoPlay for all drives.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /t REG_DWORD /d 255 /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Add RDP in firewall.
+netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
+
+rem Enable RDP.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
+
+rem Turn off sidebar.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when the SetupComplete hook was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/winvistax64-ultimate.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -44,7 +44,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>1</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -90,6 +90,15 @@
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <fDenyTSConnections>false</fDenyTSConnections>
     </component>
+    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+      <RunSynchronous>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Path>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs specialize</Path>
+          <Description>Run the specialize pass of the unattended setup script</Description>
+        </RunSynchronousCommand>
+      </RunSynchronous>
+    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -111,14 +120,14 @@
             <Name>Docker</Name>
             <Group>Administrators</Group>
             <Password>
-              <Value />
+              <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-              <PlainText>true</PlainText>
+              <PlainText>false</PlainText>
             </Password>
           </LocalAccount>
         </LocalAccounts>
         <AdministratorPassword>
-          <Value>password</Value>
+          <Value>YQBkAG0AaQBuAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </AdministratorPassword>
       </UserAccounts>
       <AutoLogon>
@@ -126,14 +135,14 @@
         <Enabled>true</Enabled>
         <LogonCount>65432</LogonCount>
         <Password>
-          <Value />
+          <Value>YQBkAG0AaQBuAFAAYQBzAHMAdwBvAHIAZAA=</Value>
-          <PlainText>true</PlainText>
+          <PlainText>false</PlainText>
         </Password>
       </AutoLogon>
       <Display>
         <ColorDepth>32</ColorDepth>
-        <HorizontalResolution>1920</HorizontalResolution>
+        <HorizontalResolution>1280</HorizontalResolution>
-        <VerticalResolution>1080</VerticalResolution>
+        <VerticalResolution>720</VerticalResolution>
       </Display>
       <OOBE>
         <HideEULAPage>true</HideEULAPage>
@@ -147,113 +156,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
+          <CommandLine>wscript.exe //B //NoLogo %WINDIR%\Setup\Scripts\Unattend.vbs logon</CommandLine>
-          <Description>Allow guest access to network shares</Description>
+          <Description>Configure Windows after logon</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Allow RDP login with blank password</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</CommandLine>
-          <Description>Add RDP in firewall</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable RDP</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off sidebar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>