feat: Read WIM metadata directly from ISO (#2036)

.github/workflows/check.yml

@@ -26,10 +26,10 @@ jobs:
                 -e SC2317
           -
             name: Lint Dockerfile
-            uses: hadolint/hadolint-action@v3.3.0
+            uses: hadolint/hadolint-action@v3.4.0
             with:
               dockerfile: Dockerfile
-              ignore: DL3006,DL3008
+              ignore: DL3006,DL3008,DL3067
               failure-threshold: warning
           -
             name: Validate XML

.github/workflows/install.yml

@@ -19,10 +19,10 @@ on:
         default: ubuntu-24.04
         type: string
 
-      image:
-        description: Container image to test
+      branch:
+        description: Repository branch to build
         required: false
-        default: ghcr.io/dockur/windows:latest
+        default: dev
         type: string
 
       callback:
@@ -31,12 +31,78 @@ on:
         default: powershell
         type: string
 
+      machine:
+        description: QEMU machine type exposed to Windows
+        required: false
+        default: ""
+        type: string
+
       cpu:
         description: CPU model exposed to Windows
         required: false
-        default: host
+        default: ""
         type: string
 
+      cpu_flags:
+        description: Additional CPU flags exposed to Windows
+        required: false
+        default: ""
+        type: string
+
+      disk_type:
+        description: Disk controller type exposed to Windows
+        required: false
+        default: ""
+        type: string
+
+      network:
+        description: Network backend exposed to Windows
+        required: false
+        default: ""
+        type: string
+
+      adapter:
+        description: Network adapter exposed to Windows
+        required: false
+        default: ""
+        type: string
+
+      enable_tunnel:
+        description: Open a temporary public noVNC tunnel
+        required: false
+        default: false
+        type: boolean
+
+      kill_on_failure:
+        description: Stop the workflow when an installation failure is detected
+        required: false
+        default: true
+        type: boolean
+
+      install_timeout:
+        description: Maximum installation time in seconds
+        required: false
+        default: 9000
+        type: number
+
+      reboot_timeout:
+        description: Maximum time before the first reboot in seconds
+        required: false
+        default: 1800
+        type: number
+
+      minimum_reboots:
+        description: Minimum required reboot count
+        required: false
+        default: 1
+        type: number
+
+      boot_loop_limit:
+        description: Number of repeated boots considered a boot loop
+        required: false
+        default: 10
+        type: number
+
       expected_caption:
         description: Text expected in the Windows caption
         required: true
@@ -69,9 +135,45 @@ jobs:
 
     env:
       CONTAINER: windows-test
-      IMAGE: ${{ inputs.image }}
+      IMAGE: windows-validation:local
+      TUNNEL: windows-test-tunnel
 
     steps:
+      - name: Resolve branch
+        id: branch
+        shell: bash
+        env:
+          REQUESTED_BRANCH: ${{ inputs.branch }}
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          set -Eeuo pipefail
+
+          authorization="$(
+            printf 'x-access-token:%s' "$GITHUB_TOKEN" |
+              base64 -w 0
+          )"
+
+          if git \
+            -c "http.extraheader=Authorization: basic $authorization" \
+            ls-remote \
+            --exit-code \
+            --heads \
+            "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git" \
+            "refs/heads/$REQUESTED_BRANCH" > /dev/null 2>&1; then
+
+            branch="$REQUESTED_BRANCH"
+          else
+            branch="master"
+            echo "Branch '$REQUESTED_BRANCH' does not exist; using '$branch'."
+          fi
+
+          echo "branch=$branch" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout branch
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ steps.branch.outputs.branch }}
+
       - name: Check KVM
         shell: bash
         run: |
@@ -144,28 +246,88 @@ jobs:
             "$RUNNER_TEMP/oem" \
             "$RUNNER_TEMP/storage"
 
-          printf '%s\n' "$token" > "$RUNNER_TEMP/data/readme.txt"
+          printf '%s\n' "$token" > "$RUNNER_TEMP/data/validation.token"
+          printf '%s\n' "$token" > "$RUNNER_TEMP/oem/validation.token"
 
           cat > "$RUNNER_TEMP/oem/sync-log.bat" <<'BATCH'
           @echo off
           setlocal
 
+          set "mode=%~1"
+          set "lock=C:\OEM\sync-log.lock"
+          set /A retries=0 >nul
+
           :sync
-          if exist C:\OEM\install.log (
-            copy /Y C:\OEM\install.log \\host.lan\Data\install.tmp >nul 2>&1
+          call :sync_file
 
-            if not errorlevel 1 (
-              move /Y \\host.lan\Data\install.tmp \\host.lan\Data\install.log >nul 2>&1
-            )
-          )
+          if /I not "%mode%"=="once" goto continuous
+          if not errorlevel 1 exit /B 0
 
-          if /I "%~1"=="once" exit /B
+          set /A retries+=1 >nul
+          if %retries% GEQ 30 exit /B 1
+
+          ping 127.0.0.1 -n 2 >nul
+          goto sync
+
+          :continuous
           if exist C:\OEM\install.done exit /B
 
           ping 127.0.0.1 -n 6 >nul
           goto sync
+
+          :sync_file
+          if not exist C:\OEM\install.log exit /B 1
+
+          2>nul mkdir "%lock%"
+          if errorlevel 1 exit /B 1
+
+          copy /Y C:\OEM\install.log \\host.lan\Data\install.tmp >nul 2>&1
+          if errorlevel 1 goto sync_failed
+
+          move /Y \\host.lan\Data\install.tmp \\host.lan\Data\install.log >nul 2>&1
+          if errorlevel 1 goto sync_failed
+
+          rmdir "%lock%" >nul 2>&1
+          exit /B 0
+
+          :sync_failed
+          rmdir "%lock%" >nul 2>&1
+          exit /B 1
           BATCH
 
+          cat > "$RUNNER_TEMP/oem/watchdog.vbs" <<'VBSCRIPT'
+          Option Explicit
+
+          Dim filesystem
+          Dim file
+          Dim result
+          Dim shell
+
+          WScript.Sleep 180000
+
+          Set filesystem = CreateObject("Scripting.FileSystemObject")
+
+          If filesystem.FileExists("C:\OEM\install.done") Then
+            WScript.Quit 0
+          End If
+
+          On Error Resume Next
+
+          WScript.Echo Now & " - Callback failed for 3 minutes."
+
+          Set shell = CreateObject("WScript.Shell")
+          result = shell.Run("cmd.exe /C C:\OEM\sync-log.bat once", 0, True)
+
+          Set file = filesystem.CreateTextFile("C:\OEM\install.done", True)
+          file.Close
+
+          If result <> 0 Then
+            shell.Run "cmd.exe /C echo VALIDATION_LOG_SYNC_FAILED^>COM1", 0, True
+          End If
+
+          shell.Run "cmd.exe /C echo VALIDATION_CALLBACK_FAILED^>COM1", 0, True
+          VBSCRIPT
+
           case "$CALLBACK" in
             powershell)
               cat > "$RUNNER_TEMP/oem/ready.ps1" <<'POWERSHELL'
@@ -201,36 +363,82 @@ jobs:
 
                   $share = (
                       Get-Content `
-                          -LiteralPath "\\host.lan\Data\readme.txt" `
+                          -LiteralPath "\\host.lan\Data\validation.token" `
                           -Raw
                   ).Trim()
 
+                  $shareTest = "\\host.lan\Data\validation-write-$Token.tmp"
+                  $shareValue = "write-test-$Token"
+                  $encoding = New-Object System.Text.UTF8Encoding($false)
+
+                  try {
+                      [System.IO.File]::WriteAllText(
+                          $shareTest,
+                          $shareValue,
+                          $encoding
+                      )
+
+                      if (
+                          [System.IO.File]::ReadAllText($shareTest) -ne
+                          $shareValue
+                      ) {
+                          throw "Shared-folder readback verification failed."
+                      }
+                  }
+                  finally {
+                      if (Test-Path -LiteralPath $shareTest) {
+                          Remove-Item -LiteralPath $shareTest -Force
+                      }
+                  }
+
+                  $oemFile = (
+                      Get-Content `
+                          -LiteralPath "C:\OEM\validation.token" `
+                          -Raw
+                  ).Trim()
+
+                  $addresses = [System.Net.Dns]::GetHostAddresses(
+                      "www.msftconnecttest.com"
+                  )
+
+                  if ($addresses.Count -eq 0) {
+                      throw "Internet DNS lookup returned no addresses."
+                  }
+
+                  $internet = (
+                      Invoke-WebRequest `
+                          -Uri "http://www.msftconnecttest.com/connecttest.txt" `
+                          -UseBasicParsing `
+                          -TimeoutSec 30
+                  ).Content.Trim()
+
+                  if ($internet -ne "Microsoft Connect Test") {
+                      throw "Internet HTTP test returned unexpected content."
+                  }
+
                   $result = @{
-                      token    = $Token
-                      caption  = [string]$windows.Caption
-                      edition  = [string]$registry.EditionID
-                      version  = [string]$windows.Version
-                      build    = [string]$windows.BuildNumber
-                      platform = $platform
-                      share    = $share
+                      token       = $Token
+                      caption     = [string]$windows.Caption
+                      edition     = [string]$registry.EditionID
+                      version     = [string]$windows.Version
+                      build       = [string]$windows.BuildNumber
+                      platform    = $platform
+                      oem_file    = $oemFile
+                      share       = $share
+                      share_write = "ok"
+                      internet    = "ok"
                   }
 
                   $json = $result | ConvertTo-Json -Compress
-                  $temporary = "\\host.lan\Data\windows.tmp"
-                  $destination = "\\host.lan\Data\windows.json"
-                  $encoding = New-Object System.Text.UTF8Encoding($false)
+                  $serialResult = "C:\OEM\validation.result"
+                  $serialValue = "VALIDATION_RESULT=$json`r`n"
 
                   [System.IO.File]::WriteAllText(
-                      $temporary,
-                      $json,
+                      $serialResult,
+                      $serialValue,
                       $encoding
                   )
 
-                  Move-Item `
-                      -LiteralPath $temporary `
-                      -Destination $destination `
-                      -Force
-
                   break
               }
               catch {
@@ -243,15 +451,42 @@ jobs:
               cat > "$RUNNER_TEMP/oem/install.bat" <<EOF
           @echo off
           del /Q C:\OEM\install.done 2>nul
+          del /Q C:\OEM\validation.result 2>nul
+          rmdir /S /Q C:\OEM\sync-log.lock 2>nul
           start "" /B cmd.exe /C C:\OEM\sync-log.bat
+          start "" /B cscript.exe //B //NoLogo C:\OEM\watchdog.vbs
 
           powershell.exe -NoProfile -ExecutionPolicy Bypass ^
             -File C:\OEM\ready.ps1 ^
             -Token "$token"
 
           set "result=%errorlevel%"
-          type nul > C:\OEM\install.done
+
+          if not "%result%"=="0" (
+            echo %date% %time% - Callback failed.
+            call C:\OEM\sync-log.bat once
+            if errorlevel 1 echo VALIDATION_LOG_SYNC_FAILED>COM1
+            type nul > C:\OEM\install.done
+            echo VALIDATION_CALLBACK_FAILED>COM1
+            exit /B %result%
+          )
+
           call C:\OEM\sync-log.bat once
+
+          if errorlevel 1 (
+            type nul > C:\OEM\install.done
+            echo VALIDATION_LOG_SYNC_FAILED>COM1
+            echo VALIDATION_CALLBACK_FAILED>COM1
+            exit /B 1
+          )
+
+          type C:\OEM\validation.result > COM1
+
+          if errorlevel 1 (
+            exit /B 1
+          )
+
+          type nul > C:\OEM\install.done
           exit /B %result%
           EOF
               ;;
@@ -321,6 +556,57 @@ jobs:
             ReadTextFile = value
           End Function
 
+          Function TestSharedFolder(filesystem, token)
+            Dim path
+            Dim expected
+            Dim file
+            Dim actual
+
+            path = "\\host.lan\Data\validation-write-" & token & ".tmp"
+            expected = "write-test-" & token
+
+            Set file = filesystem.CreateTextFile(path, True)
+            file.Write expected
+            file.Close
+
+            Set file = filesystem.OpenTextFile(path, ForReading, False)
+            actual = file.ReadAll
+            file.Close
+
+            If actual <> expected Then
+              Err.Raise vbObjectError + 1, "TestSharedFolder", _
+                "Shared-folder readback verification failed."
+            End If
+
+            filesystem.DeleteFile path, True
+            TestSharedFolder = "ok"
+          End Function
+
+          Function TestInternet()
+            Dim request
+            Dim response
+
+            Set request = CreateObject("WinHttp.WinHttpRequest.5.1")
+            request.SetTimeouts 30000, 30000, 30000, 30000
+            request.Open "GET", "http://www.msftncsi.com/ncsi.txt", False
+            request.Send
+
+            If request.Status <> 200 Then
+              Err.Raise vbObjectError + 2, "TestInternet", _
+                "Internet HTTP test returned status " & CStr(request.Status) & "."
+            End If
+
+            response = Replace(request.ResponseText, vbCr, "")
+            response = Replace(response, vbLf, "")
+
+            If response <> "Microsoft NCSI" Then
+              Err.Raise vbObjectError + 3, "TestInternet", _
+                "Internet HTTP test returned unexpected content."
+            End If
+
+            TestInternet = "ok"
+          End Function
+
           Function GetPlatform(shell)
             Dim architecture
 
@@ -350,17 +636,16 @@ jobs:
           Dim version
           Dim build
           Dim platform
+          Dim oemFile
           Dim share
+          Dim shareWrite
+          Dim internet
 
           Dim json
-          Dim temporary
-          Dim destination
+          Dim errorMessage
           Dim file
           Dim success
 
-          temporary = "\\host.lan\Data\windows.tmp"
-          destination = "\\host.lan\Data\windows.json"
-
           Do
             success = False
 
@@ -389,7 +674,10 @@ jobs:
             If Err.Number = 0 Then
               edition = ReadRegistry(shell, "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionID")
               platform = GetPlatform(shell)
-              share = ReadTextFile(filesystem, "\\host.lan\Data\readme.txt")
+              oemFile = ReadTextFile(filesystem, "C:\OEM\validation.token")
+              share = ReadTextFile(filesystem, "\\host.lan\Data\validation.token")
+              shareWrite = TestSharedFolder(filesystem, token)
+              internet = TestInternet()
             End If
 
             If Err.Number = 0 Then
@@ -401,31 +689,28 @@ jobs:
                 """version"":""" & EscapeJson(version) & """," & _
                 """build"":""" & EscapeJson(build) & """," & _
                 """platform"":""" & EscapeJson(platform) & """," & _
-                """share"":""" & EscapeJson(share) & """" & _
+                """oem_file"":""" & EscapeJson(oemFile) & """," & _
+                """share"":""" & EscapeJson(share) & """," & _
+                """share_write"":""" & EscapeJson(shareWrite) & """," & _
+                """internet"":""" & EscapeJson(internet) & """" & _
                 "}"
 
-              Set file = filesystem.OpenTextFile(temporary, ForWriting, True)
-              file.Write json
+              Set file = filesystem.OpenTextFile("C:\OEM\validation.result", ForWriting, True)
+              file.WriteLine "VALIDATION_RESULT=" & json
               file.Close
             End If
 
-            If Err.Number = 0 Then
-              If filesystem.FileExists(destination) Then
-                filesystem.DeleteFile destination, True
-              End If
-
-              filesystem.MoveFile temporary, destination
-            End If
-
             If Err.Number = 0 Then
               success = True
             Else
-              WScript.Echo _
+              errorMessage = _
                 Now & _
                 " - Callback retry: 0x" & _
                 Hex(Err.Number) & _
                 " - " & _
                 Err.Description
+
+              WScript.Echo errorMessage
             End If
 
             Err.Clear
@@ -442,13 +727,40 @@ jobs:
               cat > "$RUNNER_TEMP/oem/install.bat" <<EOF
           @echo off
           del /Q C:\OEM\install.done 2>nul
+          del /Q C:\OEM\validation.result 2>nul
+          rmdir /S /Q C:\OEM\sync-log.lock 2>nul
           start "" /B cmd.exe /C C:\OEM\sync-log.bat
+          start "" /B cscript.exe //B //NoLogo C:\OEM\watchdog.vbs
 
           cscript.exe //B //NoLogo C:\OEM\ready.vbs "$token"
 
           set "result=%errorlevel%"
-          type nul > C:\OEM\install.done
+
+          if not "%result%"=="0" (
+            echo %date% %time% - Callback failed.
+            call C:\OEM\sync-log.bat once
+            if errorlevel 1 echo VALIDATION_LOG_SYNC_FAILED>COM1
+            type nul > C:\OEM\install.done
+            echo VALIDATION_CALLBACK_FAILED>COM1
+            exit /B %result%
+          )
+
           call C:\OEM\sync-log.bat once
+
+          if errorlevel 1 (
+            type nul > C:\OEM\install.done
+            echo VALIDATION_LOG_SYNC_FAILED>COM1
+            echo VALIDATION_CALLBACK_FAILED>COM1
+            exit /B 1
+          )
+
+          type C:\OEM\validation.result > COM1
+
+          if errorlevel 1 (
+            exit /B 1
+          )
+
+          type nul > C:\OEM\install.done
           exit /B %result%
           EOF
               ;;
@@ -456,27 +768,44 @@ jobs:
 
           echo "token=$token" >> "$GITHUB_OUTPUT"
 
-      - name: Pull image
+      - name: Build image
         shell: bash
         run: |
           set -Eeuo pipefail
 
-          docker pull "$IMAGE"
+          echo "Building branch: ${{ steps.branch.outputs.branch }}"
+          echo "Commit: $(git rev-parse HEAD)"
+
+          for attempt in 1 2 3; do
+            if docker build \
+              --tag "$IMAGE" \
+              . >/dev/null 2>/dev/null; then
+              break
+            fi
+
+            if (( attempt == 3 )); then
+              echo "Image build failed after $attempt attempts."
+              exit 1
+            fi
+
+            delay=$((attempt * 15))
+            echo "Image build failed, retrying in $delay seconds..."
+            sleep "$delay"
+          done
 
           docker image inspect "$IMAGE" \
-            --format 'Digest: {{index .RepoDigests 0}}'
+            --format 'Image ID: {{.Id}}'
 
-      - name: Install and validate Windows
+      - name: Start Windows container
         shell: bash
         env:
+          ADAPTER: ${{ inputs.adapter }}
           CPU: ${{ inputs.cpu }}
-          EXPECTED_TOKEN: ${{ steps.test.outputs.token }}
-          EXPECTED_CAPTION: ${{ inputs.expected_caption }}
-          EXPECTED_EDITION: ${{ inputs.expected_edition }}
-          EXPECTED_PLATFORM: ${{ inputs.platform }}
-          MINIMUM_BUILD: ${{ inputs.minimum_build }}
+          CPU_FLAGS: ${{ inputs.cpu_flags }}
+          DISK_TYPE: ${{ inputs.disk_type }}
+          MACHINE: ${{ inputs.machine }}
+          NETWORK: ${{ inputs.network }}
           VERSION: ${{ inputs.version }}
-          DISPLAY_NAME: ${{ inputs.name }}
         run: |
           set -Eeuo pipefail
 
@@ -486,17 +815,95 @@ jobs:
             --device /dev/net/tun \
             --cap-add NET_ADMIN \
             --stop-timeout 120 \
+            --env "MACHINE=$MACHINE" \
             --env "VERSION=$VERSION" \
             --env "RAM_SIZE=half" \
             --env "CPU_CORES=half" \
-            --env "CPU_MODEL=$CPU" \
-            --env "LOG=Y" \
             --env "DISK_SIZE=64G" \
+            --env "CPU_MODEL=$CPU" \
+            --env "CPU_FLAGS=$CPU_FLAGS" \
+            --env "DISK_TYPE=$DISK_TYPE" \
+            --env "NETWORK=$NETWORK" \
+            --env "ADAPTER=$ADAPTER" \
+            --env "LOG=Y" \
+            --env "DEBUG=Y" \
+            --env "LOSSY=Y" \
             --volume "$RUNNER_TEMP/data:/shared" \
             --volume "$RUNNER_TEMP/oem:/oem:ro" \
             --volume "$RUNNER_TEMP/storage:/storage" \
             "$IMAGE"
 
+          echo
+          echo "Container mounts:"
+          docker inspect "$CONTAINER" \
+            --format '{{range .Mounts}}{{println .Source "->" .Destination}}{{end}}'
+
+      - name: Start noVNC tunnel
+        if: ${{ inputs.enable_tunnel }}
+        id: tunnel
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+
+          if docker run --detach \
+            --name "$TUNNEL" \
+            --network "container:$CONTAINER" \
+            cloudflare/cloudflared:latest \
+            tunnel \
+            --no-autoupdate \
+            --url http://127.0.0.1:8006 > /dev/null 2>/dev/null; then
+            novnc_url=""
+
+            for _ in {1..30}; do
+              novnc_url="$(
+                docker logs "$TUNNEL" 2>&1 |
+                  grep -Eo 'https://[-a-z0-9]+\.trycloudflare\.com' |
+                  tail -n 1 || true
+              )"
+
+              [ -n "$novnc_url" ] && break
+              sleep 2
+            done
+
+            if [ -n "$novnc_url" ]; then
+              echo
+              echo "::notice title=noVNC viewer::$novnc_url"
+              echo "noVNC viewer: $novnc_url"
+              echo "Warning: this temporary URL is publicly accessible."
+              echo "url=$novnc_url" >> "$GITHUB_OUTPUT"
+
+              {
+                echo "### noVNC viewer"
+                echo
+                echo "[$novnc_url]($novnc_url)"
+                echo
+                echo "> This temporary URL is publicly accessible while the job is running."
+              } >> "$GITHUB_STEP_SUMMARY"
+            else
+              echo "::warning::Failed to obtain a noVNC tunnel URL."
+              docker logs "$TUNNEL" 2>&1 || true
+            fi
+          else
+            echo "::warning::Failed to start the noVNC tunnel."
+          fi
+
+      - name: Install and validate Windows
+        shell: bash
+        env:
+          KILL_ON_FAILURE: ${{ inputs.kill_on_failure }}
+          INSTALL_TIMEOUT: ${{ inputs.install_timeout }}
+          REBOOT_TIMEOUT: ${{ inputs.reboot_timeout }}
+          MINIMUM_REBOOTS: ${{ inputs.minimum_reboots }}
+          BOOT_LOOP_LIMIT: ${{ inputs.boot_loop_limit }}
+          EXPECTED_TOKEN: ${{ steps.test.outputs.token }}
+          EXPECTED_CAPTION: ${{ inputs.expected_caption }}
+          EXPECTED_EDITION: ${{ inputs.expected_edition }}
+          EXPECTED_PLATFORM: ${{ inputs.platform }}
+          MINIMUM_BUILD: ${{ inputs.minimum_build }}
+          DISPLAY_NAME: ${{ inputs.name }}
+        run: |
+          set -Eeuo pipefail
+
           echo
           echo "Container log:"
           echo "------------------------------------------------------------"
@@ -508,26 +915,40 @@ jobs:
 
           logs_pid="$!"
           guest_log="$RUNNER_TEMP/data/install.log"
+          guest_log_offset="$RUNNER_TEMP/install-log.offset"
+          guest_log_snapshot="$RUNNER_TEMP/install-log.snapshot"
 
-          (
-            offset=0
-            snapshot="$RUNNER_TEMP/install-log.snapshot"
+          printf '0\n' > "$guest_log_offset"
 
-            while true; do
-              if cp "$guest_log" "$snapshot" 2>/dev/null; then
-                size="$(stat -c %s "$snapshot" 2>/dev/null || echo 0)"
+          print_guest_log() {
+            local offset
+            local size
 
-                if (( size < offset )); then
-                  offset=0
-                fi
+            offset="$(cat "$guest_log_offset" 2>/dev/null || echo 0)"
 
-                if (( size > offset )); then
-                  tail -c "+$((offset + 1))" "$snapshot" 2>/dev/null |
-                    sed -u 's/^/[install.bat] /' || true
-                  offset="$size"
-                fi
+            if ! [[ "$offset" =~ ^[0-9]+$ ]]; then
+              offset=0
+            fi
+
+            if cp "$guest_log" "$guest_log_snapshot" 2>/dev/null; then
+              size="$(stat -c %s "$guest_log_snapshot" 2>/dev/null || echo 0)"
+
+              if (( size < offset )); then
+                offset=0
               fi
 
+              if (( size > offset )); then
+                tail -c "+$((offset + 1))" "$guest_log_snapshot" 2>/dev/null |
+                  sed -u 's/^/[install.bat] /' || true
+              fi
+
+              printf '%s\n' "$size" > "$guest_log_offset"
+            fi
+          }
+
+          (
+            while true; do
+              print_guest_log
               sleep 2
             done
           ) &
@@ -537,14 +958,33 @@ jobs:
           stop_logs() {
             kill "$logs_pid" "$guest_logs_pid" 2>/dev/null || true
             wait "$logs_pid" "$guest_logs_pid" 2>/dev/null || true
+            print_guest_log
           }
 
           trap stop_logs EXIT
 
-          deadline=$((SECONDS + 9000))
-          reboot_timeout=1800
-          minimum_reboots=1
-          boot_loop_limit=5
+          failure_checks_disabled=0
+          callback_failure_detected=0
+
+          handle_failure() {
+            local message="$1"
+
+            if [[ "$KILL_ON_FAILURE" == "true" ]]; then
+              return 1
+            fi
+
+            echo
+            echo "Automatic termination is disabled by kill_on_failure."
+            echo "The container and noVNC tunnel will remain available."
+            echo "::warning title=Failure detected::$message"
+            failure_checks_disabled=1
+            return 0
+          }
+
+          deadline=$((SECONDS + INSTALL_TIMEOUT))
+          reboot_timeout="$REBOOT_TIMEOUT"
+          minimum_reboots="$MINIMUM_REBOOTS"
+          boot_loop_limit="$BOOT_LOOP_LIMIT"
           first_bios_start=-1
 
           while (( SECONDS < deadline )); do
@@ -564,22 +1004,54 @@ jobs:
 
             container_log="$(docker logs "$CONTAINER" 2>&1 || true)"
 
-            if grep -Eqi \
-              'KVM internal error|KVM: entry failed|hardware error 0x[0-9a-f]+|Triple fault' \
-              <<< "$container_log"; then
+            if (( callback_failure_detected == 0 )) &&
+               grep -Fq 'VALIDATION_CALLBACK_FAILED' <<< "$container_log"; then
+              callback_failure_detected=1
+
+              echo
+              echo "------------------------------------------------------------"
+              echo "The guest validation callback failed."
+
+              if grep -Fq 'VALIDATION_LOG_SYNC_FAILED' <<< "$container_log"; then
+                echo "The final install.log synchronization also failed."
+              fi
+
+              if [[ "$KILL_ON_FAILURE" == "true" ]]; then
+                echo "Stopping the Windows container..."
+                docker stop "$CONTAINER" > /dev/null
+                exit 1
+              fi
+
+              echo "Automatic termination is disabled by kill_on_failure."
+              echo "The container and noVNC tunnel will remain available."
+              echo "::warning title=Failure detected::The guest validation callback failed."
+              failure_checks_disabled=1
+            fi
+
+            if (( failure_checks_disabled == 0 )) &&
+               grep -Eqi \
+                 'KVM internal error|KVM: entry failed|hardware error 0x[0-9a-f]+|Triple fault' \
+                 <<< "$container_log"; then
               echo
               echo "------------------------------------------------------------"
               echo "Detected a fatal QEMU or KVM error."
-              exit 1
+
+              if ! handle_failure "Detected a fatal QEMU or KVM error."; then
+                exit 1
+              fi
             fi
 
-            if grep -Eqi \
-              'CDBOOT: Cannot boot from CD.*Code: 5' \
-              <<< "$container_log"; then
+            if (( failure_checks_disabled == 0 )) &&
+               grep -Eqi \
+                 'CDBOOT: Cannot boot from CD.*Code: 5' \
+                 <<< "$container_log"; then
               echo
               echo "------------------------------------------------------------"
               echo "The installation media could not be booted."
-              exit 1
+
+              if ! handle_failure "The installation media could not be booted."; then
+                exit 1
+              fi
             fi
 
             bios_starts="$(
@@ -620,7 +1092,8 @@ jobs:
               first_bios_start=$SECONDS
             fi
 
-            if (( first_bios_start >= 0 &&
+            if (( failure_checks_disabled == 0 &&
+                  first_bios_start >= 0 &&
                   SECONDS - first_bios_start >= reboot_timeout &&
                   reboots < minimum_reboots )); then
               echo
@@ -629,7 +1102,10 @@ jobs:
                 "$((reboot_timeout / 60)) minutes after the first BIOS start."
               echo "Observed reboots: $reboots"
               echo "Required reboots: $minimum_reboots"
-              exit 1
+
+              if ! handle_failure "The installation did not reboot in time."; then
+                exit 1
+              fi
             fi
 
             if (( bios_starts >= boot_loop_limit )) &&
@@ -642,6 +1118,7 @@ jobs:
               echo
               echo "------------------------------------------------------------"
               echo "Detected a repeated BIOS boot loop."
+              echo
               echo "SeaBIOS starts: $bios_starts"
               echo "Hard disk boots: $hard_disk_boots"
               echo "DVD boots: $dvd_boots"
@@ -649,14 +1126,16 @@ jobs:
               echo "Unreadable boot-disk failures: $unreadable_boot_disk"
               echo "No-bootable-device failures: $no_bootable_device"
               echo "BOOTMGR failures: $bootmgr_missing"
+
               exit 1
             fi
 
-            response=""
-
-            if [[ -s "$RUNNER_TEMP/data/windows.json" ]]; then
-              response="$(cat "$RUNNER_TEMP/data/windows.json")"
-            fi
+            response="$(
+              grep -F 'VALIDATION_RESULT=' <<< "$container_log" |
+                tail -n 1 |
+                sed 's/^.*VALIDATION_RESULT=//' |
+                tr -d '\r' || true
+            )"
 
             if [[ -n "$response" ]]; then
               stop_logs
@@ -678,15 +1157,27 @@ jobs:
               version="$(jq -r '.version // empty' <<< "$response")"
               build="$(jq -r '.build // empty' <<< "$response")"
               platform="$(jq -r '.platform // empty' <<< "$response")"
+              oem_file="$(jq -r '.oem_file // empty' <<< "$response")"
               share="$(jq -r '.share // empty' <<< "$response")"
+              share_write="$(jq -r '.share_write // empty' <<< "$response")"
+              internet="$(jq -r '.internet // empty' <<< "$response")"
 
               if [[ "$token" != "$EXPECTED_TOKEN" ]]; then
                 echo "The response token does not match."
                 exit 1
               fi
 
+              if [[ "$oem_file" != "$EXPECTED_TOKEN" ]]; then
+                echo "Failed to read C:\\OEM\\validation.token."
+                echo "Expected contents:"
+                echo "  $EXPECTED_TOKEN"
+                echo "Received:"
+                echo "  ${oem_file:-empty}"
+                exit 1
+              fi
+
               if [[ "$share" != "$EXPECTED_TOKEN" ]]; then
-                echo "Failed to read \\\\host.lan\\Data\\readme.txt."
+                echo "Failed to read \\\\host.lan\\Data\\validation.token."
                 echo "Expected contents:"
                 echo "  $EXPECTED_TOKEN"
                 echo "Received:"
@@ -694,6 +1185,16 @@ jobs:
                 exit 1
               fi
 
+              if [[ "$share_write" != "ok" ]]; then
+                echo "The shared folder write test did not succeed."
+                exit 1
+              fi
+
+              if [[ "$internet" != "ok" ]]; then
+                echo "The guest internet connection test did not succeed."
+                exit 1
+              fi
+
               normalized_caption="${caption//\(R\)/}"
               normalized_expected_caption="${EXPECTED_CAPTION//\(R\)/}"
 
@@ -744,7 +1245,9 @@ jobs:
               echo "Version: $version"
               echo "Build: $build"
               echo "Platform: $platform"
-              echo "Shared file: accessible"
+              echo "OEM files: copied successfully"
+              echo "Shared folder: readable and writable"
+              echo "Internet connection: accessible"
               exit 0
             fi
 
@@ -760,4 +1263,5 @@ jobs:
         if: always()
         shell: bash
         run: |
+          docker rm --force "$TUNNEL" 2>/dev/null || true
           docker rm --force "$CONTAINER" 2>/dev/null || true

.github/workflows/links.yml

@@ -48,81 +48,101 @@ jobs:
           check() {
             local url="$1"
             local agent="Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0"
-            local tmp output pid blocks bytes rc
-            local start=$SECONDS
+            local tmp output pid blocks bytes rc status delay
+            local attempt=1
+            local attempts=3
+            local start
 
             tmp=$(mktemp -d)
-            output="$tmp/aria2.log"
 
-            aria2c \
-              --no-conf=true \
-              --connect-timeout=30 \
-              --timeout=30 \
-              --max-tries=2 \
-              --retry-wait=2 \
-              --async-dns=false \
-              --follow-metalink=false \
-              --follow-torrent=false \
-              --user-agent="$agent" \
-              --split=4 \
-              --max-connection-per-server=4 \
-              --file-allocation=none \
-              --allow-overwrite=true \
-              --auto-file-renaming=false \
-              --continue=false \
-              --dir="$tmp" \
-              --out=probe \
-              --console-log-level=error \
-              --summary-interval=0 \
-              --download-result=hide \
-              --show-console-readout=false \
-              --enable-color=false \
-              -- "$url" > "$output" 2>&1 &
-            pid=$!
+            while (( attempt <= attempts )); do
+              output="$tmp/aria2.log"
+              rm -f -- "$tmp/probe" "$tmp/probe.aria2" "$output"
+              start=$SECONDS
+
+              aria2c \
+                --no-conf=true \
+                --connect-timeout=30 \
+                --timeout=30 \
+                --max-tries=2 \
+                --retry-wait=2 \
+                --async-dns=false \
+                --follow-metalink=false \
+                --follow-torrent=false \
+                --user-agent="$agent" \
+                --split=4 \
+                --max-connection-per-server=4 \
+                --file-allocation=none \
+                --allow-overwrite=true \
+                --auto-file-renaming=false \
+                --continue=false \
+                --dir="$tmp" \
+                --out=probe \
+                --console-log-level=error \
+                --summary-interval=0 \
+                --download-result=hide \
+                --show-console-readout=false \
+                --enable-color=false \
+                -- "$url" > "$output" 2>&1 &
+              pid=$!
+
+              while kill -0 "$pid" 2>/dev/null; do
+                if [[ -f "$tmp/probe" ]]; then
+                  blocks=$(stat -c '%b' "$tmp/probe" 2>/dev/null || echo 0)
+                  bytes=$((blocks * 512))
+
+                  if (( bytes >= 1048576 )); then
+                    kill "$pid" 2>/dev/null || true
+                    wait "$pid" 2>/dev/null || true
+                    rm -rf -- "$tmp"
+                    return 0
+                  fi
+                fi
+
+                if (( SECONDS - start >= 60 )); then
+                  kill "$pid" 2>/dev/null || true
+                  break
+                fi
+
+                sleep 0.2
+              done
+
+              if wait "$pid"; then
+                rc=0
+              else
+                rc=$?
+              fi
+
+              blocks=0
 
-            while kill -0 "$pid" 2>/dev/null; do
               if [[ -f "$tmp/probe" ]]; then
                 blocks=$(stat -c '%b' "$tmp/probe" 2>/dev/null || echo 0)
-                bytes=$((blocks * 512))
-
-                if (( bytes >= 1048576 )); then
-                  kill "$pid" 2>/dev/null || true
-                  wait "$pid" 2>/dev/null || true
-                  rm -rf -- "$tmp"
-                  return 0
-                fi
               fi
 
-              if (( SECONDS - start >= 60 )); then
-                kill "$pid" 2>/dev/null || true
-                break
+              bytes=$((blocks * 512))
+
+              if (( bytes >= 1048576 || (rc == 0 && bytes > 0) )); then
+                rm -rf -- "$tmp"
+                return 0
               fi
 
-              sleep 0.2
+              status=$(sed -n 's/.*status=\([0-9][0-9][0-9]\).*/\1/p' "$output" | tail -n 1)
+
+              if (( attempt < attempts )) && [[ "$status" == "429" || "$status" == 5?? ]]; then
+                delay=$((attempt * 15))
+                echo "      HTTP ${status}, retrying in ${delay} seconds..." >&2
+                sleep "$delay"
+                attempt=$((attempt + 1))
+                continue
+              fi
+
+              sed 's/^/      /' "$output" >&2
+              echo "      Downloaded bytes: $bytes" >&2
+              echo "      aria2c exit status: $rc" >&2
+              rm -rf -- "$tmp"
+              return 1
             done
 
-            if wait "$pid"; then
-              rc=0
-            else
-              rc=$?
-            fi
-
-            blocks=0
-
-            if [[ -f "$tmp/probe" ]]; then
-              blocks=$(stat -c '%b' "$tmp/probe" 2>/dev/null || echo 0)
-            fi
-
-            bytes=$((blocks * 512))
-
-            if (( bytes >= 1048576 || (rc == 0 && bytes > 0) )); then
-              rm -rf -- "$tmp"
-              return 0
-            fi
-
-            sed 's/^/      /' "$output" >&2
-            echo "      Downloaded bytes: $bytes" >&2
-            echo "      aria2c exit status: $rc" >&2
             rm -rf -- "$tmp"
             return 1
           }
@@ -180,6 +200,8 @@ jobs:
               failed_links+="$url"$'\n'
               failed_links_html+="<li><a href=\"$url\">$url</a></li>"$'\n'
             fi
+
+            sleep 2
           done < "src/define.sh"
 
           echo ""

.github/workflows/settings.yml

@@ -0,0 +1,63 @@
+name: Settings
+
+on:
+  workflow_call:
+    inputs:
+      name:
+        description: Display name for the Windows version
+        required: true
+        type: string
+
+      version:
+        description: VERSION value passed to the container
+        required: true
+        type: string
+
+      callback:
+        description: Guest script type
+        required: false
+        default: powershell
+        type: string
+
+      expected_caption:
+        description: Text expected in the Windows caption
+        required: true
+        type: string
+
+      expected_edition:
+        description: Expected Windows EditionID
+        required: false
+        default: ""
+        type: string
+
+      minimum_build:
+        description: Minimum acceptable Windows build number
+        required: true
+        type: number
+
+      platform:
+        description: Expected Windows platform
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  install:
+    name: ${{ inputs.name }}
+    uses: ./.github/workflows/install.yml
+    with:
+      name: ${{ inputs.name }}
+      version: ${{ inputs.version }}
+      callback: ${{ inputs.callback }}
+      enable_tunnel: false
+      kill_on_failure: true
+      install_timeout: 9000
+      reboot_timeout: 1800
+      minimum_reboots: 1
+      boot_loop_limit: 10
+      expected_caption: ${{ inputs.expected_caption }}
+      expected_edition: ${{ inputs.expected_edition }}
+      minimum_build: ${{ inputs.minimum_build }}
+      platform: ${{ inputs.platform }}

.github/workflows/validate.yml

@@ -84,7 +84,7 @@ jobs:
             platform: x64
 
     name: ${{ matrix.name }}
-    uses: ./.github/workflows/install.yml
+    uses: ./.github/workflows/settings.yml
     with:
       name: ${{ matrix.name }}
       version: ${{ matrix.version }}
@@ -129,7 +129,7 @@ jobs:
             platform: x64
 
     name: ${{ matrix.name }}
-    uses: ./.github/workflows/install.yml
+    uses: ./.github/workflows/settings.yml
     with:
       name: ${{ matrix.name }}
       version: ${{ matrix.version }}
@@ -197,7 +197,7 @@ jobs:
             platform: x64
 
     name: ${{ matrix.name }}
-    uses: ./.github/workflows/install.yml
+    uses: ./.github/workflows/settings.yml
     with:
       name: ${{ matrix.name }}
       version: ${{ matrix.version }}
@@ -230,7 +230,7 @@ jobs:
             platform: x64
 
     name: ${{ matrix.name }}
-    uses: ./.github/workflows/install.yml
+    uses: ./.github/workflows/settings.yml
     with:
       name: ${{ matrix.name }}
       version: ${{ matrix.version }}

Dockerfile

@@ -3,9 +3,11 @@
 ARG VERSION_ARG="latest"
 FROM scratch AS build-amd64
 
-COPY --from=qemux/qemu:7.40 / /
+COPY --from=qemux/qemu:7.43 / /
 
 ARG TARGETARCH
+
+ARG VERSION_UDF="1.2.0"
 ARG VERSION_WSDD="1.26"
 ARG VERSION_VIRTIO="1.9.58"
 ARG VERSION_BLINTER="1.0.112"
@@ -20,9 +22,11 @@ RUN <<EOF
   apt-get update
   apt-get --no-install-recommends -y install \
     samba \
+    mtools \
     wimtools \
     dos2unix \
     cabextract \
+    xmlstarlet \
     icu-devtools \
     libxml2-utils \
     libarchive-tools
@@ -33,10 +37,14 @@ RUN <<EOF
     --no-cache-dir \
     "Blinter==${VERSION_BLINTER}"
 
-  # Install wsdd
+  # Install wsddn package
   wget "https://github.com/gershnik/wsdd-native/releases/download/v${VERSION_WSDD}/wsddn_${VERSION_WSDD}_${TARGETARCH}.deb" -O /tmp/wsddn.deb -q --timeout=10
   dpkg -i /tmp/wsddn.deb
 
+  # Install UDFread package
+  wget "https://github.com/qemus/udfread/releases/download/v${VERSION_UDF}/udfread_${VERSION_UDF}_${TARGETARCH}.deb" -O /tmp/udfread.deb -q --timeout=10
+  dpkg -i /tmp/udfread.deb
+
   apt-get clean
   rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 EOF

assets/win10x64-enterprise.cmd

@@ -0,0 +1,113 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win10x64-enterprise.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,7 +62,7 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -249,11 +249,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -328,123 +323,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win10x64-iot.cmd

@@ -0,0 +1,113 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win10x64-iot.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -68,7 +68,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -255,11 +255,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -334,123 +329,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win10x64-ltsc.cmd

@@ -0,0 +1,113 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win10x64-ltsc.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -68,7 +68,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -252,11 +252,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -331,123 +326,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win10x64.cmd

@@ -0,0 +1,113 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win10x64.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,7 +62,7 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -249,11 +249,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -328,123 +323,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win11x64-enterprise.cmd

@@ -0,0 +1,119 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Disable the SMB signing requirement.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Remove the empty Windows.old folder.
+if exist "%SystemDrive%\Windows.old" rd /q "%SystemDrive%\Windows.old"
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win11x64-enterprise.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,7 +62,7 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -267,16 +267,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <Path>cmd.exe /c start "" /b /wait pnputil -i -a "C:\Windows\Drivers\viogpudo\viogpudo.inf"</Path>
-          <Description>Install VirtIO display driver</Description>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>27</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -351,133 +341,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable SMB signing requirement</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C rd /q C:\Windows.old</CommandLine>
-          <Description>Remove empty Windows.old folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>27</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win11x64-iot.cmd

@@ -0,0 +1,119 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Disable the SMB signing requirement.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Remove the empty Windows.old folder.
+if exist "%SystemDrive%\Windows.old" rd /q "%SystemDrive%\Windows.old"
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win11x64-iot.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,7 +62,7 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -267,16 +267,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <Path>cmd.exe /c start "" /b /wait pnputil -i -a "C:\Windows\Drivers\viogpudo\viogpudo.inf"</Path>
-          <Description>Install VirtIO display driver</Description>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>27</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -351,133 +341,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable SMB signing requirement</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C rd /q C:\Windows.old</CommandLine>
-          <Description>Remove empty Windows.old folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>27</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win11x64-ltsc.cmd

@@ -0,0 +1,119 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Disable the SMB signing requirement.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Remove the empty Windows.old folder.
+if exist "%SystemDrive%\Windows.old" rd /q "%SystemDrive%\Windows.old"
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win11x64-ltsc.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,7 +62,7 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -267,16 +267,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <Path>cmd.exe /c start "" /b /wait pnputil -i -a "C:\Windows\Drivers\viogpudo\viogpudo.inf"</Path>
-          <Description>Install VirtIO display driver</Description>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>27</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -351,133 +341,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable SMB signing requirement</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C rd /q C:\Windows.old</CommandLine>
-          <Description>Remove empty Windows.old folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>27</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win11x64.cmd

@@ -0,0 +1,119 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Disable the SMB signing requirement.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Remove the empty Windows.old folder.
+if exist "%SystemDrive%\Windows.old" rd /q "%SystemDrive%\Windows.old"
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win11x64.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,7 +62,7 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -267,16 +267,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <Path>cmd.exe /c start "" /b /wait pnputil -i -a "C:\Windows\Drivers\viogpudo\viogpudo.inf"</Path>
-          <Description>Install VirtIO display driver</Description>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>27</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -351,133 +341,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable SMB signing requirement</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C rd /q C:\Windows.old</CommandLine>
-          <Description>Remove empty Windows.old folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>27</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2008r2.cmd

@@ -0,0 +1,101 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2008r2.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,7 +57,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -157,15 +157,6 @@
         </FirewallGroup>
       </FirewallGroups>
     </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -212,108 +203,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2012r2.cmd

@@ -0,0 +1,98 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2012r2.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -158,11 +158,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -241,98 +236,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2016.cmd

@@ -0,0 +1,110 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2016.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -158,11 +158,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -241,118 +236,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2019-hv.cmd

@@ -0,0 +1,110 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2019-hv.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -164,11 +164,6 @@
           <Path>dism.exe /online /Disable-Feature /FeatureName:Microsoft-Hyper-V /NoRestart</Path>
           <Description>Disable Hyper-V role</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -247,118 +242,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2019.cmd

@@ -0,0 +1,110 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2019.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -162,11 +162,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -245,118 +240,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2022.cmd

@@ -0,0 +1,110 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2022.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -162,11 +162,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -245,118 +240,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2025.cmd

@@ -0,0 +1,97 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Disable the SMB signing requirement.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation and monitor blanking.
+POWERCFG -H OFF
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable the first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Allow RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery and File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Remove the empty Windows.old folder.
+if exist "%SystemDrive%\Windows.old" rd /q "%SystemDrive%\Windows.old"
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Set initial Explorer and taskbar preferences for the logged-in user.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2025.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -162,16 +162,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>cmd.exe /c start "" /b /wait pnputil -i -a "C:\Windows\Drivers\viogpudo\viogpudo.inf"</Path>
-          <Description>Install VirtIO display driver</Description>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -250,123 +240,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable SMB signing requirement</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>cmd /C rd /q C:\Windows.old</CommandLine>
-          <Description>Remove empty Windows.old folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x64-enterprise.cmd

@@ -0,0 +1,92 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x64-enterprise.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,7 +57,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -152,15 +152,6 @@
         </FirewallGroup>
       </FirewallGroups>
     </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -207,93 +198,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x64-ultimate.cmd

@@ -0,0 +1,92 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x64-ultimate.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,7 +57,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -152,15 +152,6 @@
         </FirewallGroup>
       </FirewallGroups>
     </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -207,93 +198,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x64.cmd

@@ -0,0 +1,92 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x64.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,7 +57,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -152,15 +152,6 @@
         </FirewallGroup>
       </FirewallGroups>
     </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -207,93 +198,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x86-enterprise.cmd

@@ -0,0 +1,88 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x86-enterprise.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,7 +57,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -198,93 +198,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x86-ultimate.cmd

@@ -0,0 +1,88 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x86-ultimate.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,7 +57,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -198,93 +198,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x86.cmd

@@ -0,0 +1,88 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x86.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,7 +57,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -198,93 +198,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win81x64-enterprise.cmd

@@ -0,0 +1,98 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win81x64-enterprise.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,7 +62,7 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -149,11 +149,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -226,98 +221,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win81x64.cmd

@@ -0,0 +1,98 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win81x64.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -68,7 +68,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -156,11 +156,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -233,98 +228,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/winvistax64-enterprise.cmd

@@ -0,0 +1,110 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Add RDP in firewall.
+netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
+
+rem Enable RDP.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
+
+rem Turn off sidebar.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/winvistax64-enterprise.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -44,7 +44,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>1</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -90,15 +90,6 @@
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <fDenyTSConnections>false</fDenyTSConnections>
     </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -156,123 +147,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</CommandLine>
-          <Description>Add RDP in firewall</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable RDP</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off sidebar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/winvistax64-ultimate.cmd

@@ -0,0 +1,110 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Add RDP in firewall.
+netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
+
+rem Enable RDP.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
+
+rem Turn off sidebar.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/winvistax64-ultimate.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -44,7 +44,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>1</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -90,15 +90,6 @@
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <fDenyTSConnections>false</fDenyTSConnections>
     </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -156,123 +147,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</CommandLine>
-          <Description>Add RDP in firewall</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable RDP</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off sidebar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/winvistax64.cmd

@@ -0,0 +1,110 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Add RDP in firewall.
+netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
+
+rem Enable RDP.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
+
+rem Turn off sidebar.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/winvistax64.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -44,7 +44,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>1</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -90,15 +90,6 @@
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <fDenyTSConnections>false</fDenyTSConnections>
     </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -156,123 +147,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</CommandLine>
-          <Description>Add RDP in firewall</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable RDP</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off sidebar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/winvistax86-enterprise.cmd

@@ -0,0 +1,106 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Add RDP in firewall.
+netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
+
+rem Enable RDP.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
+
+rem Turn off sidebar.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/winvistax86-enterprise.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -44,7 +44,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>1</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -147,123 +147,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</CommandLine>
-          <Description>Add RDP in firewall</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable RDP</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off sidebar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/winvistax86-ultimate.cmd

@@ -0,0 +1,106 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Add RDP in firewall.
+netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
+
+rem Enable RDP.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
+
+rem Turn off sidebar.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/winvistax86-ultimate.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -44,7 +44,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>1</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -147,123 +147,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</CommandLine>
-          <Description>Add RDP in firewall</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable RDP</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off sidebar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/winvistax86.cmd

@@ -0,0 +1,106 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Add RDP in firewall.
+netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
+
+rem Enable RDP.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
+
+rem Turn off sidebar.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/winvistax86.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -44,7 +44,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>1</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -147,123 +147,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</CommandLine>
-          <Description>Add RDP in firewall</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable RDP</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off sidebar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

docs/environment.md

@@ -47,6 +47,7 @@ An empty default means the variable is unset and its value is determined automat
 | `DISK_DISCARD` | `unmap` | Discard/TRIM mode for the primary disk. |
 | `DISK_ROTATION` | `1` | Rotation rate reported to the guest. Use `1` to identify the disk as an SSD. |
 | `DISK_FLAGS` |  | Additional options used when creating `qcow2` disks. |
+| `DISK_OPTIONS` |  | Additional options appended to QEMU disk devices. |
 | `ALLOCATE` | `N` | Preallocates space for the primary disk. |
 | `STORAGE` | `/storage` | Storage directory used for disks, firmware variables, and downloads. |
 
@@ -105,6 +106,7 @@ An empty default means the variable is unset and its value is determined automat
 |---|---|---|
 | `SAMBA` | `Y` | Enables the Samba shared folder. |
 | `SAMBA_DEBUG` | `N` | Enables Samba debug output. |
+| `SAMBA_READONLY` | `N` | Enables read-only mode for the shared folder. |
 | `SHORTCUT` | `Y` | Creates desktop and drive shortcuts to the shared folder. |
 
 ## ⚙️ System
@@ -126,12 +128,12 @@ An empty default means the variable is unset and its value is determined automat
 | `BOOT_MODE` | `windows` | Boot configuration, such as `windows`, `windows_secure`, or `windows_legacy`. |
 | `BOOT_INDEX` | `9` | Boot priority index for the installation media. |
 | `MEDIA_TYPE` |  | Device type used for installation media. |
+| `USB` | `qemu-xhci,id=xhci` | QEMU USB controller configuration. |
 | `BIOS` |  | Custom firmware file. |
 | `TPM` | `N` | Enables the TPM emulator, usually set by `BOOT_MODE`. |
 | `SMM` | `N` | Enables System Management Mode, usually set by `BOOT_MODE`. |
 | `LOGO` | `Y` | Enables the custom boot logo. |
 | `CLEAR` | `N` | Resets the NVRAM variables on the next boot. |
-| `USB` | `qemu-xhci,id=xhci` | QEMU USB controller configuration. |
 
 ## 🎈 Memory Ballooning
 
@@ -161,7 +163,6 @@ Also see [Dynamic memory allocation](https://github.com/qemus/qemu/blob/master/d
 | `VERIFY` | `N` | Verifies downloaded installation media against predefined checksums. |
 | `REMOVE` | `Y` | Deletes the downloaded Windows ISO after installation to save space. |
 | `MANUAL` | `N` | Enables manual installation instead of unattended installation. |
-| `REBUILD` | `Y` | Skips rebuilding the Windows ISO and uses the original image unchanged. |
 | `COMMAND` |  | Command to be executed during the final step of automatic installation. |
 
 ## 🔌 Shutdown
@@ -180,4 +181,4 @@ Also see [Dynamic memory allocation](https://github.com/qemus/qemu/blob/master/d
 | `LOG`   | `N` | Saves all output from `install.bat` to `C:\OEM\install.log` for troubleshooting. |
 | `DETECTED` |  | Overrides the automatically detected Windows image identifier. |
 | `SERIAL` | `mon:stdio` | QEMU serial device configuration. |
-| `MONITOR` | `unix:$QEMU_DIR/monitor.sock,server,wait=off,nodelay` | QEMU monitor configuration. |
+| `MONITOR` | `unix:/run/shm/monitor.sock` | QEMU monitor configuration. |

readme.md

@@ -67,14 +67,14 @@ docker run -it --rm --name windows -e "VERSION=11" -p 8006:8006 --device=/dev/kv
 kubectl apply -f https://raw.githubusercontent.com/dockur/windows/refs/heads/master/kubernetes.yml
 ```
 
+##### Desktop applications
+
+For a complete graphical desktop experience, see [WinBoat](https://winboat.app), [WinPodX](https://www.winpodx.org), or [WinApps](https://github.com/winapps-org/winapps). Each of these projects uses this container as its backend.
+
 ##### GitHub Codespaces:
 
 [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/dockur/windows)
 
-##### Graphical installer:
-
-[![Download WinBoat](https://github.com/dockur/windows/raw/master/.github/winboat.png)](https://winboat.app)
-
 ## Requirements ⚙️
 
 - Docker or Podman on a Linux host with KVM support.
@@ -134,9 +134,10 @@ kubectl apply -f https://raw.githubusercontent.com/dockur/windows/refs/heads/mas
   | `2008` | Windows Server 2008       | 3.0 GB   |
   | `2003` | Windows Server 2003       | 0.6 GB   |
   ||||  
-  | `core11` | Tiny11 Core      | 3.0 GB   |
-  | `tiny11` | Tiny11           | 5.3 GB   |
-  | `tiny10` | Tiny10           | 3.6 GB   |
+  | `core11`  | Tiny11 Core      | 3.0 GB   |
+  | `tiny11`  | Tiny11           | 5.3 GB   |
+  | `tiny10`  | Tiny10           | 3.6 GB   |
+  | `reactos` | ReactOS          | 0.1 GB   |
 
 > [!TIP]
 > To install ARM64 versions of Windows use [dockur/windows-arm](https://github.com/dockur/windows-arm/).

src/define.sh

@@ -11,7 +11,6 @@ set -Eeuo pipefail
 : "${EDITION:=""}"
 : "${MANUAL:=""}"
 : "${REMOVE:=""}"
-: "${REBUILD:=""}"
 : "${VERSION:=""}"
 : "${COMMAND:=""}"
 : "${DETECTED:=""}"
@@ -38,36 +37,7 @@ USERNAME=$(strip "$USERNAME")
 DOMAIN_OU=$(strip "$DOMAIN_OU")
 WORKGROUP=$(strip "$WORKGROUP")
 
-EDITION_ORDER=(
-  "-enterprise|enterprise|enterprise enterprise-*"
-  "-ultimate|ultimate|ultimate ultimate-*"
-  "|default|@default n pro pro-* professional professional-* business business-*"
-  "-iot|iot|iot iot-* enterprise-iot enterprise-iot-*"
-  "-ltsc|ltsc|ltsc ltsc-* enterprise-ltsc enterprise-ltsc-*"
-  "-education|education|education education-* pro-education pro-education-*"
-  "-home|home|home home-*"
-  "-home-premium|home|home-premium home-premium-*"
-  "-home-basic|home|home-basic home-basic-*"
-  "-starter|starter|starter starter-*"
-)
-
-SERVER_EDITION_ORDER=(
-  "|default|@default"
-  "-datacenter|datacenter|datacenter datacenter-*"
-  "-datacenter-azure|datacenter|datacenter-azure"
-  "-enterprise|enterprise|enterprise enterprise-*"
-  "-web|web|web web-*"
-  "-foundation|foundation|foundation foundation-*"
-  "-essentials|essentials|essentials essentials-*"
-  "-standard-core|standard-core|standard-core standard-core-*"
-  "-datacenter-core|datacenter-core|datacenter-core datacenter-core-*"
-  "-datacenter-azure-core|datacenter-core|datacenter-azure-core"
-  "-enterprise-core|enterprise-core|enterprise-core enterprise-core-*"
-  "-web-core|web-core|web-core web-core-*"
-  "-hv|hv|hv hv-*"
-)
-
-MIRRORS=3
+MIRRORS=4
 
 parseVersion() {
 
@@ -184,6 +154,9 @@ parseVersion() {
     "tiny10" | "tiny 10" )
       VERSION="tiny10"
       ;;
+    "reactos" | "react os" )
+      VERSION="reactos"
+      ;;
   esac
 
   SUGGEST=$(getSuggestedVersion "$VERSION")
@@ -483,6 +456,7 @@ printVersion() {
     "tiny11"* ) desc="Tiny 11" ;;
     "tiny10"* ) desc="Tiny 10" ;;
     "core11"* ) desc="Core 11" ;;
+    "reactos"* ) desc="ReactOS" ;;
     "win7"* ) desc="Windows 7" ;;
     "win8"* ) desc="Windows 8" ;;
     "win10"* ) desc="Windows 10" ;;
@@ -690,6 +664,8 @@ fromFile() {
       id="tiny11" ;;
     "tiny10"* | "tiny_10"* )
       id="tiny10" ;;
+    "reactos"* )
+      id="reactos" ;;
     *"_serverhypercore_"* )
       id="win2019${add}-hv" ;;
     *"server2025"* | *"server_2025"* )
@@ -922,6 +898,51 @@ getServerEditionID() {
   return 0
 }
 
+getEditionOrder() {
+
+  local id="${1,,}"
+  local result_name="$2"
+  local -n result="$result_name"
+
+  result=()
+
+  case "$id" in
+    "win20"* )
+      result=(
+        "|default|@default"
+        "-datacenter|datacenter|datacenter datacenter-*"
+        "-datacenter-azure|datacenter|datacenter-azure"
+        "-enterprise|enterprise|enterprise enterprise-*"
+        "-web|web|web web-*"
+        "-foundation|foundation|foundation foundation-*"
+        "-essentials|essentials|essentials essentials-*"
+        "-standard-core|standard-core|standard-core standard-core-*"
+        "-datacenter-core|datacenter-core|datacenter-core datacenter-core-*"
+        "-datacenter-azure-core|datacenter-core|datacenter-azure-core"
+        "-enterprise-core|enterprise-core|enterprise-core enterprise-core-*"
+        "-web-core|web-core|web-core web-core-*"
+        "-hv|hv|hv hv-*"
+      )
+      ;;
+    * )
+      result=(
+        "-enterprise|enterprise|enterprise enterprise-*"
+        "-ultimate|ultimate|ultimate ultimate-*"
+        "|default|@default n pro pro-* professional professional-* business business-*"
+        "-iot|iot|iot iot-* enterprise-iot enterprise-iot-*"
+        "-ltsc|ltsc|ltsc ltsc-* enterprise-ltsc enterprise-ltsc-*"
+        "-education|education|education education-* pro-education pro-education-*"
+        "-home|home|home home-*"
+        "-home-premium|home|home-premium home-premium-*"
+        "-home-basic|home|home-basic home-basic-*"
+        "-starter|starter|starter starter-*"
+      )
+      ;;
+  esac
+
+  return 0
+}
+
 getVersion() {
 
   local id edition
@@ -954,6 +975,31 @@ getVersion() {
   return 0
 }
 
+skipVersion() {
+
+  local id="$1"
+
+  case "${id,,}" in
+    "win9"* | "winxp"* | "win2k"* | "win2003"* | "reactos" )
+      return 0 ;;
+  esac
+
+  return 1
+}
+
+isLegacy() {
+
+  local id="$1"
+
+  case "${id,,}" in
+    "win9"* | "win2k"* | "winxp"* | "win2003"* | \
+    "winvista"* | "win7"* | "win2008"* | "reactos" )
+      return 0 ;;
+  esac
+
+  return 1
+}
+
 switchEdition() {
 
   local -n id="$1"
@@ -1001,6 +1047,10 @@ getMido() {
       sum="2cee70bd183df42b92a2e0da08cc2bb7a2a9ce3a3841955a012c0f77aeb3cb29"
       url="https://software-static.download.prss.microsoft.com/dbazure/998969d5-f34g-4e03-ac9d-1f9786c66749/26100.1742.240906-0331.ge_release_svc_refresh_CLIENT_IOT_LTSC_EVAL_x64FRE_en-us.iso"
       ;;
+    "win10x64" )
+      size=6140975104
+      sum="a6f470ca6d331eb353b815c043e327a347f594f37ff525f17764738fe812852e"
+      ;;
     "win10x64-enterprise-eval" )
       size=5550497792
       sum="ef7312733a9f5d7d51cfa04ac497671995674ca5e1058d5164d6028f0938d668"
@@ -1299,6 +1349,35 @@ getLink2() {
 
 getLink3() {
 
+  local id="$1"
+  local lang="$2"
+  local ret="$3"
+  local url=""
+  local sum=""
+  local size=""
+  local host="https://iso.reactos.org"
+
+  [[ "${lang,,}" != "en" && "${lang,,}" != "en-us" ]] && return 0
+
+  case "${id,,}" in
+    "reactos" )
+      size=0
+      sum=""
+      url="livecd/latest-x86-gcc-lin-rel"
+      ;;
+  esac
+
+  case "${ret,,}" in
+    "sum" ) echo "$sum" ;;
+    "size" ) echo "$size" ;;
+    *) [ -n "$url" ] && echo "$host/$url";;
+  esac
+
+  return 0
+}
+
+getLink4() {
+
   local id="$1"
   local lang="$2"
   local ret="$3"

src/entry.sh

@@ -63,7 +63,7 @@ else
 fi
 
 pid=$!
-( sleep 30; boot ) &
+waitForBoot "$pid" 30 &
 
 rc=0
 wait "$pid" || rc=$?

src/mido.sh

@@ -83,32 +83,22 @@ curlRequest() {
   return 0
 }
 
-downloadWindows() {
+downloadWindowsLink() {
 
-  local id="$1"
-  local lang="$2"
-  local desc="$3"
+  local productId="$1"
+  local url="$2"
+  local agent="$3"
+  local language="$4"
+  local lang="$5"
+  local desc="$6"
+  local type="$7"
 
-  local ovToken="" ovTicks="" ovTime
   local skuId skuJson
   local linkJson link
-  local language ovData
-  local session agent
-  local type winVer
-  local page productId
+  local ovData ovTime session
+  local ovToken="" ovTicks=""
   local profile="606624d44113"
 
-  agent=$(getAgent)
-  language=$(getLanguage "$lang" "name")
-
-  case "${id,,}" in
-    "win11x64" ) winVer="11" && type="1" ;;
-    "win11arm64" ) winVer="11arm64" && type="2" ;;
-    * ) error "Invalid VERSION specified, value \"$id\" is not recognized!" && return 1 ;;
-  esac
-
-  local url="https://www.microsoft.com/en-us/software-download/windows$winVer"
-
   # uuidgen: For MacOS (installed by default) and other systems (e.g. with no /proc) that don't have a kernel interface for generating random UUIDs
   if ! session=$(cat /proc/sys/kernel/random/uuid 2> /dev/null || uuidgen --random); then
     error "Failed to generate session ID!"
@@ -122,23 +112,6 @@ downloadWindows() {
     return 1
   fi
 
-  # Get product edition ID for latest release of given Windows version
-  enabled "$DEBUG" && echo "Parsing download page: ${url}"
-
-  curlRequest page "Microsoft" "$agent" \
-    --header "Accept:" \
-    --max-filesize 1M \
-    -- "$url" || return 1
-
-  enabled "$DEBUG" && echo -n "Getting Product edition ID: "
-  productId=$(echo "$page" | grep -Eo '<option value="[0-9]+">Windows' | cut -d '"' -f 2 | head -n 1 | tr -cd '0-9' | head -c 16)
-  enabled "$DEBUG" && echo "$productId"
-
-  if [ -z "$productId" ]; then
-    error "Product edition ID not found!"
-    return 1
-  fi
-
   # Microsoft download "protection" requires the sessionId to be whitelisted through vlscppe.microsoft.com/tags
 
   local orgId="y6jn8c31"
@@ -206,7 +179,7 @@ downloadWindows() {
     --max-filesize 100K \
     -- "$skuUrl" || return 1
 
-  { skuId=$(echo "$skuJson" | jq --arg LANG "$language" -r '.Skus[] | select(.Language==$LANG).Id') 2>/dev/null; local rc=$?; } || :
+  { skuId=$(printf '%s\n' "$skuJson" | jq --arg LANG "$language" -r 'first(.Skus[]? | select(.Language == $LANG) | .Id) // empty') 2>/dev/null; local rc=$?; } || :
 
   if [ -z "$skuId" ] || [[ "${skuId,,}" == "null" ]] || (( rc != 0 )); then
     language=$(getLanguage "$lang" "desc")
@@ -234,17 +207,17 @@ downloadWindows() {
     return 1
   fi
 
-  if echo "$linkJson" | grep -q "Sentinel marked this request as rejected."; then
+  if grep -Fq "Sentinel marked this request as rejected." <<< "$linkJson"; then
     error "Microsoft blocked the automated download request based on your IP address."
     return 1
   fi
 
-  if echo "$linkJson" | grep -q "We are unable to complete your request at this time."; then
+  if grep -Fq "We are unable to complete your request at this time." <<< "$linkJson"; then
     error "Microsoft blocked the automated download request."
     return 1
   fi
 
-  { link=$(echo "$linkJson" | jq --argjson TYPE "$type" -r '.ProductDownloadOptions[] | select(.DownloadType==$TYPE).Uri') 2>/dev/null; rc=$?; } || :
+  { link=$(printf '%s\n' "$linkJson" | jq --argjson TYPE "$type" -r 'first(.ProductDownloadOptions[]? | select(.DownloadType == $TYPE) | .Uri) // empty') 2>/dev/null; rc=$?; } || :
 
   if [ -z "$link" ] || [[ "${link,,}" == "null" ]] || (( rc != 0 )); then
     error "Microsoft server gave us no download link to our request for an automated download!"
@@ -256,6 +229,82 @@ downloadWindows() {
   return 0
 }
 
+downloadWindows() {
+
+  local id="$1"
+  local lang="$2"
+  local desc="$3"
+
+  local agent language
+  local page productId
+  local type winVer
+
+  agent=$(getAgent)
+  language=$(getLanguage "$lang" "name")
+
+  case "${id,,}" in
+    "win10x64" )
+      productId="2618"
+      winVer="10"
+      type="1"
+      ;;
+    "win11x64" )
+      productId="3321"
+      winVer="11"
+      type="1"
+      ;;
+    "win11arm64" )
+      productId="3324"
+      winVer="11arm64"
+      type="2"
+      ;;
+    * )
+      error "Invalid VERSION specified, value \"$id\" is not recognized!"
+      return 1
+      ;;
+  esac
+
+  local url="https://www.microsoft.com/en-us/software-download/windows$winVer"
+  [[ "${id,,}" == "win10"* ]] && url+="ISO"
+
+  enabled "$DEBUG" && echo "Using Product edition ID: $productId"
+
+  if downloadWindowsLink "$productId" "$url" "$agent" "$language" "$lang" "$desc" "$type"; then
+    return 0
+  fi
+
+  sleep 1
+
+  local msg="retrying using a different method..."
+  info "Microsoft download request failed, $msg"
+  enabled "$DEBUG" && echo "Parsing download page: ${url}"
+
+  curlRequest page "Microsoft" "$agent" \
+    --header "Accept:" \
+    --max-filesize 1M \
+    -- "$url" || return 1
+
+  enabled "$DEBUG" && echo -n "Getting Product edition ID: "
+  productId=$(printf '%s' "$page" |
+    tr '\r\n' '  ' |
+    grep -Eio "<option[^>]*value=[\"'][0-9]+[\"'][^>]*>[[:space:]]*Windows[^<]*" |
+    sed -nE "s/.*value=[\"']([0-9]+)[\"'].*/\1/p" |
+    sed -n '1p' |
+    cut -c 1-16 || true)
+  enabled "$DEBUG" && echo "$productId"
+
+  if [ -z "$productId" ]; then
+    info "Failed to fetch the Product edition ID from the download page, $msg"
+    return 1
+  fi
+
+  if ! downloadWindowsLink "$productId" "$url" "$agent" "$language" "$lang" "$desc" "$type"; then
+    return 1
+  fi
+
+  return 0
+}
+
 downloadWindowsEval() {
 
   local id="$1"
@@ -318,13 +367,14 @@ downloadWindowsEval() {
 
   enabled "$DEBUG" && echo "Getting download link.."
 
-  local filter="https://go.microsoft.com/fwlink/?linkid=[0-9]\+&clcid=0x[0-9a-z]\+&culture=${culture,,}&country=${country,,}"
+  # Normalize HTML-encoded query separators before extracting fwlinks.
+  page=${page//&amp;/&}
+  page=${page//&#38;/&}
 
-  if ! echo "$page" | grep -io "$filter" > /dev/null; then
-    filter="https://go.microsoft.com/fwlink/p/?linkid=[0-9]\+&clcid=0x[0-9a-z]\+&culture=${culture,,}&country=${country,,}"
-  fi
-
-  links=$(echo "$page" | grep -io "$filter") || {
+  links=$(printf '%s\n' "$page" |
+    grep -Eio "https://go\.microsoft\.com/fwlink(/p)?/\?[^\"'<>[:space:]]+" |
+    grep -Ei '(^|[?&])culture='"${culture,,}"'(&|$)' |
+    grep -Ei '(^|[?&])country='"${country,,}"'(&|$)') || {
     # This should only happen if there's been some change to the download endpoint web address
     if [[ "${lang,,}" == "en" || "${lang,,}" == "en-"* ]]; then
       error "Windows server download page gave us no download link!"
@@ -339,30 +389,30 @@ downloadWindowsEval() {
     "iot" )
       case "${PLATFORM,,}" in
         "x64" )
-          link=$(echo "$links" | head -n 1) ;;
+          link=$(printf '%s\n' "$links" | head -n 1) ;;
         "arm64" )
-          link=$(echo "$links" | head -n 2 | tail -n 1) ;;
+          link=$(printf '%s\n' "$links" | head -n 2 | tail -n 1) ;;
       esac ;;
     "ltsc" )
       case "${PLATFORM,,}" in
         "x64" )
-          link=$(echo "$links" | head -n 2 | tail -n 1) ;;
+          link=$(printf '%s\n' "$links" | head -n 2 | tail -n 1) ;;
       esac ;;
     "enterprise" )
       case "${PLATFORM,,}" in
         "x64" )
           if [[ "$winVer" != "windows-10"* ]]; then
-            link=$(echo "$links" | head -n 1)
+            link=$(printf '%s\n' "$links" | head -n 1)
           else
-            link=$(echo "$links" | head -n 2 | tail -n 1)
+            link=$(printf '%s\n' "$links" | head -n 2 | tail -n 1)
           fi ;;
         "arm64" )
-          link=$(echo "$links" | head -n 2 | tail -n 1) ;;
+          link=$(printf '%s\n' "$links" | head -n 2 | tail -n 1) ;;
       esac ;;
     "server" )
       case "${PLATFORM,,}" in
         "x64" )
-          link=$(echo "$links" | head -n 1) ;;
+          link=$(printf '%s\n' "$links" | head -n 1) ;;
       esac ;;
     * )
       error "Invalid type specified, value \"$type\" is not recognized!" && return 1 ;;
@@ -527,6 +577,8 @@ getWindows() {
   local language edition
 
   MIDO_SOURCE=""
+  MIDO_STATIC="N"
+
   language=$(getLanguage "$lang" "desc")
   edition=$(printEdition "$version" "$desc" "Y")
 
@@ -547,6 +599,7 @@ getWindows() {
   esac
 
   case "${version,,}" in
+    "win10x64" ) ;;
     "win11${PLATFORM,,}" ) ;;
     "win11${PLATFORM,,}-enterprise"* ) ;;
     * )
@@ -558,7 +611,7 @@ getWindows() {
   esac
 
   case "${version,,}" in
-    "win11${PLATFORM,,}" )
+    "win10x64" | "win11${PLATFORM,,}" )
 
       if downloadWindows "$version" "$lang" "$edition"; then
         MIDO_SOURCE="$version"
@@ -597,6 +650,8 @@ getWindows() {
   MIDO_URL=$(getMido "$version" "$lang" "")
   [ -z "$MIDO_URL" ] && return 1
 
+  MIDO_STATIC="Y"
+
   if [[ "${version,,}" == "win2008r2"* ]]; then
     MIDO_SOURCE="win2008r2-eval"
     return 0
@@ -841,11 +896,13 @@ getESD() {
 
 isCompressed() {
 
-  local file="$1"
+  local url="${1%%\?*}"
 
-  case "${file,,}" in
-    *".7z" | *".zip" | *".rar" | *".lzma" | *".bz" | *".bz2" )
-      return 0 ;;
+  case "${url,,}" in
+    *.7z | *.zip | *.rar | *.tar | *.cab | *.cpio | \
+    *.lzh | *.lha | *.xar | */latest-x86-gcc-lin-rel )
+      return 0
+      ;;
   esac
 
   return 1
@@ -868,7 +925,7 @@ verifyFile() {
   local hash
 
   [ -z "$check" ] && return 0
-  ! enabled "$VERIFY" && return 0
+  enabled "$VERIFY" || return 0
   [[ "${#check}" == "40" ]] && algo="SHA1"
 
   local msg="Verifying downloaded ISO..."
@@ -950,14 +1007,18 @@ tryDownload() {
   local desc="$6"
   local seconds="$7"
   local web_desc="$8"
-  local total
+  local total minimum="104857600"
+
+  if isCompressed "$url"; then
+    minimum="10485760"
+  fi
 
   if downloadRetry \
       "$iso" \
       "${CONNECTIONS:-1}" \
       "$seconds" \
       "$desc" \
-      "100000000" \
+      "$minimum" \
       "$iso" \
       "$url" \
       "$size" \
@@ -1086,13 +1147,18 @@ downloadImage() {
       sum=""
       size=""
 
-      # Skip verification if the retrieved URL differs from the static URL.
+      # Apply the metadata belonging to the configured static URL.
       if [[ "${MIDO_URL%%\?*}" == "${url%%\?*}" ]]; then
         size=$(getMido "$version" "$lang" "size")
         sum=$(getMido "$version" "$lang" "sum")
       fi
 
-      if tryDownload "$iso" "$MIDO_URL" "$sum" "$size" "$lang" "$desc" "$seconds" "$web_desc"; then
+      local download_desc="$desc"
+      if enabled "$MIDO_STATIC"; then
+        download_desc+=" using a static link"
+      fi
+
+      if tryDownload "$iso" "$MIDO_URL" "$sum" "$size" "$lang" "$download_desc" "$seconds" "$web_desc"; then
         # Commit the candidate only after the image was downloaded and verified.
         DETECTED="$detected"
         return 0

src/power.sh

@@ -11,40 +11,189 @@ SHUTDOWN_SIGNAL=0
 
 QEMU_PTY="$QEMU_DIR/qemu.pty"
 QEMU_END="$QEMU_DIR/qemu.end"
+ACPI_SOCKET="$QEMU_DIR/acpi.sock"
 CONSOLE_PID="$QEMU_DIR/console.pid"
 CONSOLE_SOCKET="$QEMU_DIR/console.sock"
 QEMU_START_PID="$QEMU_DIR/qemu.start.pid"
 
-bootFailed() {
+bootStatus() {
 
-  local fail=""
+  [ ! -s "$QEMU_PTY" ] && return 1
 
   if [[ "${BOOT_MODE,,}" == "windows_legacy" ]]; then
-    grep -Fq "No bootable device." "$QEMU_PTY" && fail="y"
-    grep -Fq "BOOTMGR is missing" "$QEMU_PTY" && fail="y"
+    local line last recent
+
+    line=$(grep -nE '^Booting from (Hard Disk|DVD/CD)' "$QEMU_PTY" | tail -1)
+    [ -z "$line" ] && return 1
+
+    last="${line#*:}"
+    recent=$(tail -n +"${line%%:*}" "$QEMU_PTY")
+
+    grep -Fq "Loading FreeLoader..." <<< "$recent" && return 0
+
+    if grep -Fq \
+      -e "No bootable device." \
+      -e "BOOTMGR is missing" \
+      <<< "$recent"; then
+      return 2
+    fi
+
+    if grep -Fq \
+      -e "Boot failed: not a bootable disk" \
+      -e "Boot failed: Could not read from CDROM" \
+      -e "Boot failed: could not read the boot disk" \
+      <<< "$recent"; then
+      return 5
+    fi
+
+    if [[ "$last" == "Booting from Hard Disk"* ]]; then
+      return 3
+    fi
+
+    if [[ "$last" == "Booting from DVD/CD"* ]]; then
+      return 4
+    fi
+
+    return 1
   fi
 
-  [ -n "$fail" ]
+  local line last recent
+
+  line=$(grep -nE \
+    'BdsDxe: starting Boot[[:xdigit:]]{4} ' \
+    "$QEMU_PTY" | tail -1)
+
+  [ -z "$line" ] && return 1
+
+  last="${line#*:}"
+  recent=$(tail -n +"${line%%:*}" "$QEMU_PTY")
+
+  if [[ "$last" == *'"Windows Boot Manager"'* ]]; then
+    return 0
+  fi
+
+  grep -Eq \
+    'BdsDxe: failed to start Boot[[:xdigit:]]{4} "UEFI QEMU .*DVD-ROM.*: Time out' \
+    <<< "$recent" && return 2
+
+  grep -Fq \
+    "BdsDxe: No bootable option or device was found." \
+    <<< "$recent" && return 2
+
+  grep -Fq "UEFI Interactive Shell" <<< "$recent" && return 2
+
+  grep -Eq \
+    -e '"UEFI QEMU .*DVD-ROM' \
+    -e 'CDROM\(' \
+    -e 'USB\(' \
+    <<< "$last" && return 4
+
+  return 1
 }
 
-boot() {
+waitForBoot() {
 
-  [ -f "$QEMU_END" ] && return 0
+  local pid="$1"
+  local timeout="${2:-30}"
+  local keySent=0
+  local pendingType=0
+  local pendingLine=""
+  local pendingDeadline=0
+  local keyDelay status marker
+  local deadline=$((SECONDS + timeout))
+  local screen="visit http://127.0.0.1:$WEB_PORT/ to view the screen..."
 
-  if [ -s "$QEMU_PTY" ]; then
-    if [ "$(stat -c%s "$QEMU_PTY")" -gt 7 ]; then
-      if ! bootFailed; then
+  while isAlive "$pid"; do
+
+    if (( ! keySent )) && needsBootKey; then
+
+      if keyDelay=$(bootKeyDelay); then
+
+        if [[ "$keyDelay" == "0" ]]; then
+          if sendKey spc 0 500; then
+            keySent=1
+          fi
+        else
+          if sendKey spc "$keyDelay" 250 4 0.75; then
+            keySent=1
+          fi
+        fi
+
+      fi
+
+    fi
+
+    if bootStatus; then
+      status=0
+    else
+      status=$?
+    fi
+
+    case "$status" in
+
+      0) echo
 
         if [[ "${DISPLAY,,}" == "web" ]] && ! disabled "${WEB:-Y}"; then
-          info "$(app) started successfully, visit http://127.0.0.1:$WEB_PORT/ to view the screen..."
+          info "$(app) started successfully, $screen"
         else
           info "$(app) started successfully."
         fi
 
-        return 0
-      fi
-    fi
-  fi
+        echo && return 0 ;;
+
+      2) echo
+
+        error "$(app) could not boot, aborting..."
+        terminateQemu
+        return 0 ;;
+
+      3 | 4)
+
+        marker=$(getBootMarker)
+
+        if [[ "$marker" != "$pendingLine" ]] || (( status != pendingType )); then
+          pendingLine="$marker"
+          pendingType=$status
+
+          pendingDeadline=$((SECONDS + 6))
+        fi
+
+        if (( pendingDeadline > 0 && SECONDS >= pendingDeadline )); then
+          echo
+
+          if [[ "${DISPLAY,,}" == "web" ]] && ! disabled "${WEB:-Y}"; then
+            info "$(app) started successfully, $screen"
+          else
+            info "$(app) started successfully."
+          fi
+
+          echo && return 0
+        fi
+        ;;
+
+      5)
+
+        pendingType=0
+        pendingLine=""
+        pendingDeadline=0
+        ;;
+
+      *)
+
+        pendingType=0
+        pendingLine=""
+        pendingDeadline=0
+        ;;
+
+    esac
+
+    (( SECONDS >= deadline )) && break
+
+    sleep 0.25
+  done
+
+  isAlive "$pid" || return 0
+  [ -f "$QEMU_END" ] && return 0
 
   error "Timeout while waiting for QEMU to boot the machine, aborting..."
   terminateQemu
@@ -54,13 +203,23 @@ boot() {
 
 legacyBootReady() {
 
-  local last
-  local bios="Booting from Hard"
+  local line last recent
+  local hard="Booting from Hard"
+  local cdrom="Booting from DVD/CD"
 
-  last=$(grep "^Booting.*" "$QEMU_PTY" | tail -1)
-  [[ "${last,,}" != "${bios,,}"* ]] && return 1
-  grep -Fq "No bootable device." "$QEMU_PTY" && return 1
-  grep -Fq "BOOTMGR is missing" "$QEMU_PTY" && return 1
+  line=$(grep -n "^Booting.*" "$QEMU_PTY" | tail -1)
+  [ -z "$line" ] && return 1
+
+  last="${line#*:}"
+  recent=$(tail -n +"${line%%:*}" "$QEMU_PTY")
+
+  [[ "${last,,}" != "${hard,,}"* ]] && return 1
+
+  grep -Fq "Loading FreeLoader..." <<< "$recent" && return 0
+  grep -Fq "No bootable device." <<< "$recent" && return 1
+  grep -Fq "BOOTMGR is missing" <<< "$recent" && return 1
+  grep -Fq "Boot failed: not a bootable disk" <<< "$recent" && return 1
+  grep -Fq "Boot failed: could not read the boot disk" <<< "$recent" && return 1
 
   return 0
 }
@@ -75,12 +234,115 @@ ready() {
     return 1
   fi
 
-  local line="\"Windows Boot Manager\""
-  grep -Fq "$line" "$QEMU_PTY" && return 0
+  local last
+  last=$(grep -E \
+    'BdsDxe: starting Boot[[:xdigit:]]{4} ' \
+    "$QEMU_PTY" | tail -1)
+
+  grep -Eq \
+    'BdsDxe: starting Boot[[:xdigit:]]{4} "Windows Boot Manager" from .*HD\(' \
+    <<< "$last" && return 0
 
   return 1
 }
 
+sendKey() {
+
+  local key="$1"
+  local delay="${2:-0}"
+  local hold="${3:-100}"
+  local repeat="${4:-1}"
+  local interval="${5:-0}"
+  local i output
+
+  [ ! -S "$ACPI_SOCKET" ] && return 1
+  [[ "$delay" != "0" ]] && sleep "$delay"
+
+  if ! output=$(
+    {
+      for ((i = 1; i <= repeat; i++)); do
+        printf 'sendkey %s %s\n' "$key" "$hold"
+
+        if (( i < repeat )); then
+          sleep "$interval"
+        fi
+      done
+    } | nc -q 1 -w 1 -U "$ACPI_SOCKET" 2>&1
+  ); then
+    return 1
+  fi
+
+  if grep -Eqi \
+    -e 'unknown command' \
+    -e 'unknown key' \
+    -e 'invalid parameter' \
+    -e 'invalid key' \
+    -e '^error:' \
+    <<< "$output"; then
+
+    warn "failed to send boot key through QEMU monitor!"
+
+    if enabled "${DEBUG:-}"; then
+      echo "$output"
+    fi
+
+    return 1
+  fi
+
+  return 0
+}
+
+supportsBootKey() {
+
+  local id="$1"
+
+  [[ "${id,,}" == "win"* ]]
+}
+
+needsBootKey() {
+
+  [ ! -s "$BOOT" ] && return 1
+  [[ "${BOOT,,}" != *".iso" ]] && return 1
+  [ -f "$STORAGE/windows.boot" ] && return 1
+
+  supportsBootKey "$DETECTED"
+}
+
+bootKeyDelay() {
+
+  [ ! -s "$QEMU_PTY" ] && return 1
+
+  if grep -Fq "Press any key to" "$QEMU_PTY"; then
+    echo 0
+    return 0
+  fi
+
+  if [[ "${BOOT_MODE,,}" == "windows_legacy" ]]; then
+    grep -Fq "Booting from DVD/CD" "$QEMU_PTY" || return 1
+  else
+    grep -Eq \
+      'BdsDxe: starting Boot[[:xdigit:]]{4} "UEFI QEMU .*DVD-ROM' \
+      "$QEMU_PTY" || return 1
+  fi
+
+  echo 0.5
+  return 0
+}
+
+getBootMarker() {
+
+  if [[ "${BOOT_MODE,,}" == "windows_legacy" ]]; then
+    grep -nE '^Booting from (Hard Disk|DVD/CD)' "$QEMU_PTY" | tail -1
+    return 0
+  fi
+
+  grep -nE \
+    'BdsDxe: starting Boot[[:xdigit:]]{4} ' \
+    "$QEMU_PTY" | tail -1
+
+  return 0
+}
+
 markWindowsBooted() {
 
   local file="$STORAGE/windows.boot"
@@ -90,7 +352,7 @@ markWindowsBooted() {
   fi
 
   # Remove CD-ROM ISO after install
-  ! ready && return 0
+  ready || return 0
 
   if ! touch "$file"; then
     warn "failed to create Windows installation marker!"
@@ -150,7 +412,11 @@ abortDuringSetup() {
 
   local code="$1"
 
-  info "Cannot send ACPI signal during $(app) setup, aborting..."
+  if [[ "${DETECTED,,}" != "reactos" ]] || [ -n "${CUSTOM:-}" ]; then
+    info "Cannot send ACPI signal during $(app) setup, aborting..."
+  else
+    info "ReactOS LiveCD does not support ACPI shutdown, terminating..."
+  fi
 
   terminateQemu
 
@@ -210,7 +476,7 @@ gracefulShutdown() {
   finish "$code"
 }
 
-! enabled "$SHUTDOWN" && return 0
+enabled "$SHUTDOWN" || return 0
 [ -n "${QEMU_TIMEOUT:-}" ] && TIMEOUT="$QEMU_TIMEOUT"
 
 if interactive; then

src/samba.sh

@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
-: "${SAMBA:="Y"}"         # Enable Samba
-: "${SAMBA_DEBUG:="N"}"   # Disable debug
+: "${SAMBA:="Y"}"            # Enable Samba
+: "${SAMBA_DEBUG:="N"}"      # Disable debug
+: "${SAMBA_READONLY:="N"}"   # Disable writes
 : "${SAMBA_CONFIG:="/etc/samba/smb.conf"}"
 
 DDN_PID="/var/run/wsdd.pid"
@@ -87,7 +88,10 @@ addShare() {
   local name="$3"
   local comment="$4"
   local cfg="$5"
-  local owner
+  local owner probe
+  local empty="N"
+  local writable="N"
+  local readonly="N"
   local tmp="/tmp/smb"
 
   if [ ! -d "$dir" ]; then
@@ -102,30 +106,69 @@ addShare() {
     error "$msg" && return 1
   fi
 
-  if [ ! -w "$dir" ]; then
-    local msg="shared folder ($dir) is not writeable!"
-    warn "$msg"
+  if [ -z "$(ls -A "$dir")" ]; then
+    empty="Y"
   fi
 
-  if [ -z "$(ls -A "$dir")" ]; then
+  if [[ "$dir" == "$tmp" ]]; then
 
-    if ! chmod 2777 "$dir"; then
-      error "Failed to set permissions for directory $dir" && return 1
-    fi
+    readonly="Y"
 
-    if ! owner=$(stat -c %u "$dir"); then
-      error "Failed to determine ownership for directory $dir"
+  elif enabled "$SAMBA_READONLY"; then
+
+    readonly="Y"
+
+  elif probe=$(mktemp "$dir/.samba-write-test.XXXXXX" 2>/dev/null); then
+
+    writable="Y"
+
+    if ! rm -f "$probe"; then
+      error "Failed to remove write test file ($probe)."
       return 1
     fi
 
-    if [[ "$owner" == "0" ]]; then
-      if ! chown "1000:1000" "$dir"; then
-        error "Failed to set ownership for directory $dir" && return 1
+  elif [[ "$empty" == "Y" ]] && chmod 2777 "$dir" 2>/dev/null; then
+
+    if probe=$(mktemp "$dir/.samba-write-test.XXXXXX" 2>/dev/null); then
+
+      writable="Y"
+
+      if ! rm -f "$probe"; then
+        error "Failed to remove write test file ($probe)."
+        return 1
       fi
+
     fi
 
   fi
 
+  if [[ "$writable" == "Y" ]]; then
+
+    if [[ "$empty" == "Y" ]]; then
+
+      if ! chmod 2777 "$dir"; then
+        error "Failed to set permissions for directory $dir" && return 1
+      fi
+
+      if ! owner=$(stat -c %u "$dir"); then
+        error "Failed to determine ownership for directory $dir"
+        return 1
+      fi
+
+      if [[ "$owner" == "0" ]]; then
+        if ! chown "1000:1000" "$dir"; then
+          error "Failed to set ownership for directory $dir" && return 1
+        fi
+      fi
+
+    fi
+
+  elif [[ "$readonly" != "Y" ]]; then
+
+    readonly="Y"
+
+  fi
+
   if [[ "$dir" == "$tmp" ]]; then
     writeReadme "$dir" "$ref" || return 1
   fi
@@ -135,7 +178,13 @@ addShare() {
     echo "[$name]"
     echo "    path = $dir"
     echo "    comment = $comment"
-    echo "    writable = yes"
+
+    if [[ "$readonly" == "Y" ]]; then
+      echo "    read only = yes"
+    else
+      echo "    read only = no"
+    fi
+
     echo "    guest ok = yes"
     echo "    guest only = yes"
   } >> "$cfg"; then