feat: Improve Windows image detection and unattended setup (#2037)

.github/workflows/check.yml

@@ -26,10 +26,10 @@ jobs:
                 -e SC2317
           -
             name: Lint Dockerfile
-            uses: hadolint/hadolint-action@v3.3.0
+            uses: hadolint/hadolint-action@v3.4.0
             with:
               dockerfile: Dockerfile
-              ignore: DL3006,DL3008
+              ignore: DL3006,DL3008,DL3067
               failure-threshold: warning
           -
             name: Validate XML

.github/workflows/install.yml

@@ -19,10 +19,10 @@ on:
         default: ubuntu-24.04
         type: string
 
-      image:
-        description: Container image to test
+      branch:
+        description: Repository branch to build
         required: false
-        default: ghcr.io/dockur/windows:latest
+        default: dev
         type: string
 
       callback:
@@ -31,12 +31,78 @@ on:
         default: powershell
         type: string
 
+      machine:
+        description: QEMU machine type exposed to Windows
+        required: false
+        default: ""
+        type: string
+
       cpu:
         description: CPU model exposed to Windows
         required: false
-        default: host
+        default: ""
         type: string
 
+      cpu_flags:
+        description: Additional CPU flags exposed to Windows
+        required: false
+        default: ""
+        type: string
+
+      disk_type:
+        description: Disk controller type exposed to Windows
+        required: false
+        default: ""
+        type: string
+
+      network:
+        description: Network backend exposed to Windows
+        required: false
+        default: ""
+        type: string
+
+      adapter:
+        description: Network adapter exposed to Windows
+        required: false
+        default: ""
+        type: string
+
+      enable_tunnel:
+        description: Open a temporary public noVNC tunnel
+        required: false
+        default: false
+        type: boolean
+
+      kill_on_failure:
+        description: Stop the workflow when an installation failure is detected
+        required: false
+        default: true
+        type: boolean
+
+      install_timeout:
+        description: Maximum installation time in seconds
+        required: false
+        default: 9000
+        type: number
+
+      reboot_timeout:
+        description: Maximum time before the first reboot in seconds
+        required: false
+        default: 1800
+        type: number
+
+      minimum_reboots:
+        description: Minimum required reboot count
+        required: false
+        default: 1
+        type: number
+
+      boot_loop_limit:
+        description: Number of repeated boots considered a boot loop
+        required: false
+        default: 10
+        type: number
+
       expected_caption:
         description: Text expected in the Windows caption
         required: true
@@ -69,9 +135,45 @@ jobs:
 
     env:
       CONTAINER: windows-test
-      IMAGE: ${{ inputs.image }}
+      IMAGE: windows-validation:local
+      TUNNEL: windows-test-tunnel
 
     steps:
+      - name: Resolve branch
+        id: branch
+        shell: bash
+        env:
+          REQUESTED_BRANCH: ${{ inputs.branch }}
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          set -Eeuo pipefail
+
+          authorization="$(
+            printf 'x-access-token:%s' "$GITHUB_TOKEN" |
+              base64 -w 0
+          )"
+
+          if git \
+            -c "http.extraheader=Authorization: basic $authorization" \
+            ls-remote \
+            --exit-code \
+            --heads \
+            "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git" \
+            "refs/heads/$REQUESTED_BRANCH" > /dev/null 2>&1; then
+
+            branch="$REQUESTED_BRANCH"
+          else
+            branch="master"
+            echo "Branch '$REQUESTED_BRANCH' does not exist; using '$branch'."
+          fi
+
+          echo "branch=$branch" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout branch
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ steps.branch.outputs.branch }}
+
       - name: Check KVM
         shell: bash
         run: |
@@ -144,28 +246,88 @@ jobs:
             "$RUNNER_TEMP/oem" \
             "$RUNNER_TEMP/storage"
 
-          printf '%s\n' "$token" > "$RUNNER_TEMP/data/readme.txt"
+          printf '%s\n' "$token" > "$RUNNER_TEMP/data/validation.token"
+          printf '%s\n' "$token" > "$RUNNER_TEMP/oem/validation.token"
 
           cat > "$RUNNER_TEMP/oem/sync-log.bat" <<'BATCH'
           @echo off
           setlocal
 
+          set "mode=%~1"
+          set "lock=C:\OEM\sync-log.lock"
+          set /A retries=0 >nul
+
           :sync
-          if exist C:\OEM\install.log (
-            copy /Y C:\OEM\install.log \\host.lan\Data\install.tmp >nul 2>&1
+          call :sync_file
 
-            if not errorlevel 1 (
-              move /Y \\host.lan\Data\install.tmp \\host.lan\Data\install.log >nul 2>&1
-            )
-          )
+          if /I not "%mode%"=="once" goto continuous
+          if not errorlevel 1 exit /B 0
 
-          if /I "%~1"=="once" exit /B
+          set /A retries+=1 >nul
+          if %retries% GEQ 30 exit /B 1
+
+          ping 127.0.0.1 -n 2 >nul
+          goto sync
+
+          :continuous
           if exist C:\OEM\install.done exit /B
 
           ping 127.0.0.1 -n 6 >nul
           goto sync
+
+          :sync_file
+          if not exist C:\OEM\install.log exit /B 1
+
+          2>nul mkdir "%lock%"
+          if errorlevel 1 exit /B 1
+
+          copy /Y C:\OEM\install.log \\host.lan\Data\install.tmp >nul 2>&1
+          if errorlevel 1 goto sync_failed
+
+          move /Y \\host.lan\Data\install.tmp \\host.lan\Data\install.log >nul 2>&1
+          if errorlevel 1 goto sync_failed
+
+          rmdir "%lock%" >nul 2>&1
+          exit /B 0
+
+          :sync_failed
+          rmdir "%lock%" >nul 2>&1
+          exit /B 1
           BATCH
 
+          cat > "$RUNNER_TEMP/oem/watchdog.vbs" <<'VBSCRIPT'
+          Option Explicit
+
+          Dim filesystem
+          Dim file
+          Dim result
+          Dim shell
+
+          WScript.Sleep 180000
+
+          Set filesystem = CreateObject("Scripting.FileSystemObject")
+
+          If filesystem.FileExists("C:\OEM\install.done") Then
+            WScript.Quit 0
+          End If
+
+          On Error Resume Next
+
+          WScript.Echo Now & " - Callback failed for 3 minutes."
+
+          Set shell = CreateObject("WScript.Shell")
+          result = shell.Run("cmd.exe /C C:\OEM\sync-log.bat once", 0, True)
+
+          Set file = filesystem.CreateTextFile("C:\OEM\install.done", True)
+          file.Close
+
+          If result <> 0 Then
+            shell.Run "cmd.exe /C echo VALIDATION_LOG_SYNC_FAILED^>COM1", 0, True
+          End If
+
+          shell.Run "cmd.exe /C echo VALIDATION_CALLBACK_FAILED^>COM1", 0, True
+          VBSCRIPT
+
           case "$CALLBACK" in
             powershell)
               cat > "$RUNNER_TEMP/oem/ready.ps1" <<'POWERSHELL'
@@ -201,10 +363,59 @@ jobs:
 
                   $share = (
                       Get-Content `
-                          -LiteralPath "\\host.lan\Data\readme.txt" `
+                          -LiteralPath "\\host.lan\Data\validation.token" `
                           -Raw
                   ).Trim()
 
+                  $shareTest = "\\host.lan\Data\validation-write-$Token.tmp"
+                  $shareValue = "write-test-$Token"
+                  $encoding = New-Object System.Text.UTF8Encoding($false)
+
+                  try {
+                      [System.IO.File]::WriteAllText(
+                          $shareTest,
+                          $shareValue,
+                          $encoding
+                      )
+
+                      if (
+                          [System.IO.File]::ReadAllText($shareTest) -ne
+                          $shareValue
+                      ) {
+                          throw "Shared-folder readback verification failed."
+                      }
+                  }
+                  finally {
+                      if (Test-Path -LiteralPath $shareTest) {
+                          Remove-Item -LiteralPath $shareTest -Force
+                      }
+                  }
+
+                  $oemFile = (
+                      Get-Content `
+                          -LiteralPath "C:\OEM\validation.token" `
+                          -Raw
+                  ).Trim()
+
+                  $addresses = [System.Net.Dns]::GetHostAddresses(
+                      "www.msftconnecttest.com"
+                  )
+
+                  if ($addresses.Count -eq 0) {
+                      throw "Internet DNS lookup returned no addresses."
+                  }
+
+                  $internet = (
+                      Invoke-WebRequest `
+                          -Uri "http://www.msftconnecttest.com/connecttest.txt" `
+                          -UseBasicParsing `
+                          -TimeoutSec 30
+                  ).Content.Trim()
+
+                  if ($internet -ne "Microsoft Connect Test") {
+                      throw "Internet HTTP test returned unexpected content."
+                  }
+
                   $result = @{
                       token       = $Token
                       caption     = [string]$windows.Caption
@@ -212,25 +423,22 @@ jobs:
                       version     = [string]$windows.Version
                       build       = [string]$windows.BuildNumber
                       platform    = $platform
+                      oem_file    = $oemFile
                       share       = $share
+                      share_write = "ok"
+                      internet    = "ok"
                   }
 
                   $json = $result | ConvertTo-Json -Compress
-                  $temporary = "\\host.lan\Data\windows.tmp"
-                  $destination = "\\host.lan\Data\windows.json"
-                  $encoding = New-Object System.Text.UTF8Encoding($false)
+                  $serialResult = "C:\OEM\validation.result"
+                  $serialValue = "VALIDATION_RESULT=$json`r`n"
 
                   [System.IO.File]::WriteAllText(
-                      $temporary,
-                      $json,
+                      $serialResult,
+                      $serialValue,
                       $encoding
                   )
 
-                  Move-Item `
-                      -LiteralPath $temporary `
-                      -Destination $destination `
-                      -Force
-
                   break
               }
               catch {
@@ -243,15 +451,42 @@ jobs:
               cat > "$RUNNER_TEMP/oem/install.bat" <<EOF
           @echo off
           del /Q C:\OEM\install.done 2>nul
+          del /Q C:\OEM\validation.result 2>nul
+          rmdir /S /Q C:\OEM\sync-log.lock 2>nul
           start "" /B cmd.exe /C C:\OEM\sync-log.bat
+          start "" /B cscript.exe //B //NoLogo C:\OEM\watchdog.vbs
 
           powershell.exe -NoProfile -ExecutionPolicy Bypass ^
             -File C:\OEM\ready.ps1 ^
             -Token "$token"
 
           set "result=%errorlevel%"
-          type nul > C:\OEM\install.done
+
+          if not "%result%"=="0" (
+            echo %date% %time% - Callback failed.
             call C:\OEM\sync-log.bat once
+            if errorlevel 1 echo VALIDATION_LOG_SYNC_FAILED>COM1
+            type nul > C:\OEM\install.done
+            echo VALIDATION_CALLBACK_FAILED>COM1
+            exit /B %result%
+          )
+
+          call C:\OEM\sync-log.bat once
+
+          if errorlevel 1 (
+            type nul > C:\OEM\install.done
+            echo VALIDATION_LOG_SYNC_FAILED>COM1
+            echo VALIDATION_CALLBACK_FAILED>COM1
+            exit /B 1
+          )
+
+          type C:\OEM\validation.result > COM1
+
+          if errorlevel 1 (
+            exit /B 1
+          )
+
+          type nul > C:\OEM\install.done
           exit /B %result%
           EOF
               ;;
@@ -321,6 +556,57 @@ jobs:
             ReadTextFile = value
           End Function
 
+          Function TestSharedFolder(filesystem, token)
+            Dim path
+            Dim expected
+            Dim file
+            Dim actual
+
+            path = "\\host.lan\Data\validation-write-" & token & ".tmp"
+            expected = "write-test-" & token
+
+            Set file = filesystem.CreateTextFile(path, True)
+            file.Write expected
+            file.Close
+
+            Set file = filesystem.OpenTextFile(path, ForReading, False)
+            actual = file.ReadAll
+            file.Close
+
+            If actual <> expected Then
+              Err.Raise vbObjectError + 1, "TestSharedFolder", _
+                "Shared-folder readback verification failed."
+            End If
+
+            filesystem.DeleteFile path, True
+            TestSharedFolder = "ok"
+          End Function
+
+          Function TestInternet()
+            Dim request
+            Dim response
+
+            Set request = CreateObject("WinHttp.WinHttpRequest.5.1")
+            request.SetTimeouts 30000, 30000, 30000, 30000
+            request.Open "GET", "http://www.msftncsi.com/ncsi.txt", False
+            request.Send
+
+            If request.Status <> 200 Then
+              Err.Raise vbObjectError + 2, "TestInternet", _
+                "Internet HTTP test returned status " & CStr(request.Status) & "."
+            End If
+
+            response = Replace(request.ResponseText, vbCr, "")
+            response = Replace(response, vbLf, "")
+
+            If response <> "Microsoft NCSI" Then
+              Err.Raise vbObjectError + 3, "TestInternet", _
+                "Internet HTTP test returned unexpected content."
+            End If
+
+            TestInternet = "ok"
+          End Function
+
           Function GetPlatform(shell)
             Dim architecture
 
@@ -350,17 +636,16 @@ jobs:
           Dim version
           Dim build
           Dim platform
+          Dim oemFile
           Dim share
+          Dim shareWrite
+          Dim internet
 
           Dim json
-          Dim temporary
-          Dim destination
+          Dim errorMessage
           Dim file
           Dim success
 
-          temporary = "\\host.lan\Data\windows.tmp"
-          destination = "\\host.lan\Data\windows.json"
-
           Do
             success = False
 
@@ -389,7 +674,10 @@ jobs:
             If Err.Number = 0 Then
               edition = ReadRegistry(shell, "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionID")
               platform = GetPlatform(shell)
-              share = ReadTextFile(filesystem, "\\host.lan\Data\readme.txt")
+              oemFile = ReadTextFile(filesystem, "C:\OEM\validation.token")
+              share = ReadTextFile(filesystem, "\\host.lan\Data\validation.token")
+              shareWrite = TestSharedFolder(filesystem, token)
+              internet = TestInternet()
             End If
 
             If Err.Number = 0 Then
@@ -401,31 +689,28 @@ jobs:
                 """version"":""" & EscapeJson(version) & """," & _
                 """build"":""" & EscapeJson(build) & """," & _
                 """platform"":""" & EscapeJson(platform) & """," & _
-                """share"":""" & EscapeJson(share) & """" & _
+                """oem_file"":""" & EscapeJson(oemFile) & """," & _
+                """share"":""" & EscapeJson(share) & """," & _
+                """share_write"":""" & EscapeJson(shareWrite) & """," & _
+                """internet"":""" & EscapeJson(internet) & """" & _
                 "}"
 
-              Set file = filesystem.OpenTextFile(temporary, ForWriting, True)
-              file.Write json
+              Set file = filesystem.OpenTextFile("C:\OEM\validation.result", ForWriting, True)
+              file.WriteLine "VALIDATION_RESULT=" & json
               file.Close
             End If
 
-            If Err.Number = 0 Then
-              If filesystem.FileExists(destination) Then
-                filesystem.DeleteFile destination, True
-              End If
-
-              filesystem.MoveFile temporary, destination
-            End If
-
             If Err.Number = 0 Then
               success = True
             Else
-              WScript.Echo _
+              errorMessage = _
                 Now & _
                 " - Callback retry: 0x" & _
                 Hex(Err.Number) & _
                 " - " & _
                 Err.Description
+
+              WScript.Echo errorMessage
             End If
 
             Err.Clear
@@ -442,13 +727,40 @@ jobs:
               cat > "$RUNNER_TEMP/oem/install.bat" <<EOF
           @echo off
           del /Q C:\OEM\install.done 2>nul
+          del /Q C:\OEM\validation.result 2>nul
+          rmdir /S /Q C:\OEM\sync-log.lock 2>nul
           start "" /B cmd.exe /C C:\OEM\sync-log.bat
+          start "" /B cscript.exe //B //NoLogo C:\OEM\watchdog.vbs
 
           cscript.exe //B //NoLogo C:\OEM\ready.vbs "$token"
 
           set "result=%errorlevel%"
-          type nul > C:\OEM\install.done
+
+          if not "%result%"=="0" (
+            echo %date% %time% - Callback failed.
             call C:\OEM\sync-log.bat once
+            if errorlevel 1 echo VALIDATION_LOG_SYNC_FAILED>COM1
+            type nul > C:\OEM\install.done
+            echo VALIDATION_CALLBACK_FAILED>COM1
+            exit /B %result%
+          )
+
+          call C:\OEM\sync-log.bat once
+
+          if errorlevel 1 (
+            type nul > C:\OEM\install.done
+            echo VALIDATION_LOG_SYNC_FAILED>COM1
+            echo VALIDATION_CALLBACK_FAILED>COM1
+            exit /B 1
+          )
+
+          type C:\OEM\validation.result > COM1
+
+          if errorlevel 1 (
+            exit /B 1
+          )
+
+          type nul > C:\OEM\install.done
           exit /B %result%
           EOF
               ;;
@@ -456,27 +768,44 @@ jobs:
 
           echo "token=$token" >> "$GITHUB_OUTPUT"
 
-      - name: Pull image
+      - name: Build image
         shell: bash
         run: |
           set -Eeuo pipefail
 
-          docker pull "$IMAGE"
+          echo "Building branch: ${{ steps.branch.outputs.branch }}"
+          echo "Commit: $(git rev-parse HEAD)"
+
+          for attempt in 1 2 3; do
+            if docker build \
+              --tag "$IMAGE" \
+              . >/dev/null 2>/dev/null; then
+              break
+            fi
+
+            if (( attempt == 3 )); then
+              echo "Image build failed after $attempt attempts."
+              exit 1
+            fi
+
+            delay=$((attempt * 15))
+            echo "Image build failed, retrying in $delay seconds..."
+            sleep "$delay"
+          done
 
           docker image inspect "$IMAGE" \
-            --format 'Digest: {{index .RepoDigests 0}}'
+            --format 'Image ID: {{.Id}}'
 
-      - name: Install and validate Windows
+      - name: Start Windows container
         shell: bash
         env:
+          ADAPTER: ${{ inputs.adapter }}
           CPU: ${{ inputs.cpu }}
-          EXPECTED_TOKEN: ${{ steps.test.outputs.token }}
-          EXPECTED_CAPTION: ${{ inputs.expected_caption }}
-          EXPECTED_EDITION: ${{ inputs.expected_edition }}
-          EXPECTED_PLATFORM: ${{ inputs.platform }}
-          MINIMUM_BUILD: ${{ inputs.minimum_build }}
+          CPU_FLAGS: ${{ inputs.cpu_flags }}
+          DISK_TYPE: ${{ inputs.disk_type }}
+          MACHINE: ${{ inputs.machine }}
+          NETWORK: ${{ inputs.network }}
           VERSION: ${{ inputs.version }}
-          DISPLAY_NAME: ${{ inputs.name }}
         run: |
           set -Eeuo pipefail
 
@@ -486,17 +815,95 @@ jobs:
             --device /dev/net/tun \
             --cap-add NET_ADMIN \
             --stop-timeout 120 \
+            --env "MACHINE=$MACHINE" \
             --env "VERSION=$VERSION" \
             --env "RAM_SIZE=half" \
             --env "CPU_CORES=half" \
-            --env "CPU_MODEL=$CPU" \
-            --env "LOG=Y" \
             --env "DISK_SIZE=64G" \
+            --env "CPU_MODEL=$CPU" \
+            --env "CPU_FLAGS=$CPU_FLAGS" \
+            --env "DISK_TYPE=$DISK_TYPE" \
+            --env "NETWORK=$NETWORK" \
+            --env "ADAPTER=$ADAPTER" \
+            --env "LOG=Y" \
+            --env "DEBUG=Y" \
+            --env "LOSSY=Y" \
             --volume "$RUNNER_TEMP/data:/shared" \
             --volume "$RUNNER_TEMP/oem:/oem:ro" \
             --volume "$RUNNER_TEMP/storage:/storage" \
             "$IMAGE"
 
+          echo
+          echo "Container mounts:"
+          docker inspect "$CONTAINER" \
+            --format '{{range .Mounts}}{{println .Source "->" .Destination}}{{end}}'
+
+      - name: Start noVNC tunnel
+        if: ${{ inputs.enable_tunnel }}
+        id: tunnel
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+
+          if docker run --detach \
+            --name "$TUNNEL" \
+            --network "container:$CONTAINER" \
+            cloudflare/cloudflared:latest \
+            tunnel \
+            --no-autoupdate \
+            --url http://127.0.0.1:8006 > /dev/null 2>/dev/null; then
+            novnc_url=""
+
+            for _ in {1..30}; do
+              novnc_url="$(
+                docker logs "$TUNNEL" 2>&1 |
+                  grep -Eo 'https://[-a-z0-9]+\.trycloudflare\.com' |
+                  tail -n 1 || true
+              )"
+
+              [ -n "$novnc_url" ] && break
+              sleep 2
+            done
+
+            if [ -n "$novnc_url" ]; then
+              echo
+              echo "::notice title=noVNC viewer::$novnc_url"
+              echo "noVNC viewer: $novnc_url"
+              echo "Warning: this temporary URL is publicly accessible."
+              echo "url=$novnc_url" >> "$GITHUB_OUTPUT"
+
+              {
+                echo "### noVNC viewer"
+                echo
+                echo "[$novnc_url]($novnc_url)"
+                echo
+                echo "> This temporary URL is publicly accessible while the job is running."
+              } >> "$GITHUB_STEP_SUMMARY"
+            else
+              echo "::warning::Failed to obtain a noVNC tunnel URL."
+              docker logs "$TUNNEL" 2>&1 || true
+            fi
+          else
+            echo "::warning::Failed to start the noVNC tunnel."
+          fi
+
+      - name: Install and validate Windows
+        shell: bash
+        env:
+          KILL_ON_FAILURE: ${{ inputs.kill_on_failure }}
+          INSTALL_TIMEOUT: ${{ inputs.install_timeout }}
+          REBOOT_TIMEOUT: ${{ inputs.reboot_timeout }}
+          MINIMUM_REBOOTS: ${{ inputs.minimum_reboots }}
+          BOOT_LOOP_LIMIT: ${{ inputs.boot_loop_limit }}
+          EXPECTED_TOKEN: ${{ steps.test.outputs.token }}
+          EXPECTED_CAPTION: ${{ inputs.expected_caption }}
+          EXPECTED_EDITION: ${{ inputs.expected_edition }}
+          EXPECTED_PLATFORM: ${{ inputs.platform }}
+          MINIMUM_BUILD: ${{ inputs.minimum_build }}
+          DISPLAY_NAME: ${{ inputs.name }}
+        run: |
+          set -Eeuo pipefail
+
           echo
           echo "Container log:"
           echo "------------------------------------------------------------"
@@ -508,26 +915,40 @@ jobs:
 
           logs_pid="$!"
           guest_log="$RUNNER_TEMP/data/install.log"
+          guest_log_offset="$RUNNER_TEMP/install-log.offset"
+          guest_log_snapshot="$RUNNER_TEMP/install-log.snapshot"
 
-          (
+          printf '0\n' > "$guest_log_offset"
+
+          print_guest_log() {
+            local offset
+            local size
+
+            offset="$(cat "$guest_log_offset" 2>/dev/null || echo 0)"
+
+            if ! [[ "$offset" =~ ^[0-9]+$ ]]; then
               offset=0
-            snapshot="$RUNNER_TEMP/install-log.snapshot"
+            fi
 
-            while true; do
-              if cp "$guest_log" "$snapshot" 2>/dev/null; then
-                size="$(stat -c %s "$snapshot" 2>/dev/null || echo 0)"
+            if cp "$guest_log" "$guest_log_snapshot" 2>/dev/null; then
+              size="$(stat -c %s "$guest_log_snapshot" 2>/dev/null || echo 0)"
 
               if (( size < offset )); then
                 offset=0
               fi
 
               if (( size > offset )); then
-                  tail -c "+$((offset + 1))" "$snapshot" 2>/dev/null |
+                tail -c "+$((offset + 1))" "$guest_log_snapshot" 2>/dev/null |
                   sed -u 's/^/[install.bat] /' || true
-                  offset="$size"
-                fi
               fi
 
+              printf '%s\n' "$size" > "$guest_log_offset"
+            fi
+          }
+
+          (
+            while true; do
+              print_guest_log
               sleep 2
             done
           ) &
@@ -537,14 +958,33 @@ jobs:
           stop_logs() {
             kill "$logs_pid" "$guest_logs_pid" 2>/dev/null || true
             wait "$logs_pid" "$guest_logs_pid" 2>/dev/null || true
+            print_guest_log
           }
 
           trap stop_logs EXIT
 
-          deadline=$((SECONDS + 9000))
-          reboot_timeout=1800
-          minimum_reboots=1
-          boot_loop_limit=5
+          failure_checks_disabled=0
+          callback_failure_detected=0
+
+          handle_failure() {
+            local message="$1"
+
+            if [[ "$KILL_ON_FAILURE" == "true" ]]; then
+              return 1
+            fi
+
+            echo
+            echo "Automatic termination is disabled by kill_on_failure."
+            echo "The container and noVNC tunnel will remain available."
+            echo "::warning title=Failure detected::$message"
+            failure_checks_disabled=1
+            return 0
+          }
+
+          deadline=$((SECONDS + INSTALL_TIMEOUT))
+          reboot_timeout="$REBOOT_TIMEOUT"
+          minimum_reboots="$MINIMUM_REBOOTS"
+          boot_loop_limit="$BOOT_LOOP_LIMIT"
           first_bios_start=-1
 
           while (( SECONDS < deadline )); do
@@ -564,23 +1004,55 @@ jobs:
 
             container_log="$(docker logs "$CONTAINER" 2>&1 || true)"
 
-            if grep -Eqi \
+            if (( callback_failure_detected == 0 )) &&
+               grep -Fq 'VALIDATION_CALLBACK_FAILED' <<< "$container_log"; then
+              callback_failure_detected=1
+
+              echo
+              echo "------------------------------------------------------------"
+              echo "The guest validation callback failed."
+
+              if grep -Fq 'VALIDATION_LOG_SYNC_FAILED' <<< "$container_log"; then
+                echo "The final install.log synchronization also failed."
+              fi
+
+              if [[ "$KILL_ON_FAILURE" == "true" ]]; then
+                echo "Stopping the Windows container..."
+                docker stop "$CONTAINER" > /dev/null
+                exit 1
+              fi
+
+              echo "Automatic termination is disabled by kill_on_failure."
+              echo "The container and noVNC tunnel will remain available."
+              echo "::warning title=Failure detected::The guest validation callback failed."
+              failure_checks_disabled=1
+            fi
+
+            if (( failure_checks_disabled == 0 )) &&
+               grep -Eqi \
                  'KVM internal error|KVM: entry failed|hardware error 0x[0-9a-f]+|Triple fault' \
                  <<< "$container_log"; then
               echo
               echo "------------------------------------------------------------"
               echo "Detected a fatal QEMU or KVM error."
+
+              if ! handle_failure "Detected a fatal QEMU or KVM error."; then
                 exit 1
               fi
+            fi
 
-            if grep -Eqi \
+            if (( failure_checks_disabled == 0 )) &&
+               grep -Eqi \
                  'CDBOOT: Cannot boot from CD.*Code: 5' \
                  <<< "$container_log"; then
               echo
               echo "------------------------------------------------------------"
               echo "The installation media could not be booted."
+
+              if ! handle_failure "The installation media could not be booted."; then
                 exit 1
               fi
+            fi
 
             bios_starts="$(
               grep -Fci 'SeaBIOS (version ' <<< "$container_log" || true
@@ -620,7 +1092,8 @@ jobs:
               first_bios_start=$SECONDS
             fi
 
-            if (( first_bios_start >= 0 &&
+            if (( failure_checks_disabled == 0 &&
+                  first_bios_start >= 0 &&
                   SECONDS - first_bios_start >= reboot_timeout &&
                   reboots < minimum_reboots )); then
               echo
@@ -629,8 +1102,11 @@ jobs:
                 "$((reboot_timeout / 60)) minutes after the first BIOS start."
               echo "Observed reboots: $reboots"
               echo "Required reboots: $minimum_reboots"
+
+              if ! handle_failure "The installation did not reboot in time."; then
                 exit 1
               fi
+            fi
 
             if (( bios_starts >= boot_loop_limit )) &&
                (( hard_disk_boots >= boot_loop_limit ||
@@ -642,6 +1118,7 @@ jobs:
               echo
               echo "------------------------------------------------------------"
               echo "Detected a repeated BIOS boot loop."
+              echo
               echo "SeaBIOS starts: $bios_starts"
               echo "Hard disk boots: $hard_disk_boots"
               echo "DVD boots: $dvd_boots"
@@ -649,14 +1126,16 @@ jobs:
               echo "Unreadable boot-disk failures: $unreadable_boot_disk"
               echo "No-bootable-device failures: $no_bootable_device"
               echo "BOOTMGR failures: $bootmgr_missing"
+
               exit 1
             fi
 
-            response=""
-
-            if [[ -s "$RUNNER_TEMP/data/windows.json" ]]; then
-              response="$(cat "$RUNNER_TEMP/data/windows.json")"
-            fi
+            response="$(
+              grep -F 'VALIDATION_RESULT=' <<< "$container_log" |
+                tail -n 1 |
+                sed 's/^.*VALIDATION_RESULT=//' |
+                tr -d '\r' || true
+            )"
 
             if [[ -n "$response" ]]; then
               stop_logs
@@ -678,15 +1157,27 @@ jobs:
               version="$(jq -r '.version // empty' <<< "$response")"
               build="$(jq -r '.build // empty' <<< "$response")"
               platform="$(jq -r '.platform // empty' <<< "$response")"
+              oem_file="$(jq -r '.oem_file // empty' <<< "$response")"
               share="$(jq -r '.share // empty' <<< "$response")"
+              share_write="$(jq -r '.share_write // empty' <<< "$response")"
+              internet="$(jq -r '.internet // empty' <<< "$response")"
 
               if [[ "$token" != "$EXPECTED_TOKEN" ]]; then
                 echo "The response token does not match."
                 exit 1
               fi
 
+              if [[ "$oem_file" != "$EXPECTED_TOKEN" ]]; then
+                echo "Failed to read C:\\OEM\\validation.token."
+                echo "Expected contents:"
+                echo "  $EXPECTED_TOKEN"
+                echo "Received:"
+                echo "  ${oem_file:-empty}"
+                exit 1
+              fi
+
               if [[ "$share" != "$EXPECTED_TOKEN" ]]; then
-                echo "Failed to read \\\\host.lan\\Data\\readme.txt."
+                echo "Failed to read \\\\host.lan\\Data\\validation.token."
                 echo "Expected contents:"
                 echo "  $EXPECTED_TOKEN"
                 echo "Received:"
@@ -694,6 +1185,16 @@ jobs:
                 exit 1
               fi
 
+              if [[ "$share_write" != "ok" ]]; then
+                echo "The shared folder write test did not succeed."
+                exit 1
+              fi
+
+              if [[ "$internet" != "ok" ]]; then
+                echo "The guest internet connection test did not succeed."
+                exit 1
+              fi
+
               normalized_caption="${caption//\(R\)/}"
               normalized_expected_caption="${EXPECTED_CAPTION//\(R\)/}"
 
@@ -744,7 +1245,9 @@ jobs:
               echo "Version: $version"
               echo "Build: $build"
               echo "Platform: $platform"
-              echo "Shared file: accessible"
+              echo "OEM files: copied successfully"
+              echo "Shared folder: readable and writable"
+              echo "Internet connection: accessible"
               exit 0
             fi
 
@@ -760,4 +1263,5 @@ jobs:
         if: always()
         shell: bash
         run: |
+          docker rm --force "$TUNNEL" 2>/dev/null || true
           docker rm --force "$CONTAINER" 2>/dev/null || true

.github/workflows/links.yml

@@ -48,11 +48,17 @@ jobs:
           check() {
             local url="$1"
             local agent="Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0"
-            local tmp output pid blocks bytes rc
-            local start=$SECONDS
+            local tmp output pid blocks bytes rc status delay
+            local attempt=1
+            local attempts=3
+            local start
 
             tmp=$(mktemp -d)
+
+            while (( attempt <= attempts )); do
               output="$tmp/aria2.log"
+              rm -f -- "$tmp/probe" "$tmp/probe.aria2" "$output"
+              start=$SECONDS
 
               aria2c \
                 --no-conf=true \
@@ -120,9 +126,23 @@ jobs:
                 return 0
               fi
 
+              status=$(sed -n 's/.*status=\([0-9][0-9][0-9]\).*/\1/p' "$output" | tail -n 1)
+
+              if (( attempt < attempts )) && [[ "$status" == "429" || "$status" == 5?? ]]; then
+                delay=$((attempt * 15))
+                echo "      HTTP ${status}, retrying in ${delay} seconds..." >&2
+                sleep "$delay"
+                attempt=$((attempt + 1))
+                continue
+              fi
+
               sed 's/^/      /' "$output" >&2
               echo "      Downloaded bytes: $bytes" >&2
               echo "      aria2c exit status: $rc" >&2
+              rm -rf -- "$tmp"
+              return 1
+            done
+
             rm -rf -- "$tmp"
             return 1
           }
@@ -180,6 +200,8 @@ jobs:
               failed_links+="$url"$'\n'
               failed_links_html+="<li><a href=\"$url\">$url</a></li>"$'\n'
             fi
+
+            sleep 2
           done < "src/define.sh"
 
           echo ""

.github/workflows/settings.yml

@@ -0,0 +1,63 @@
+name: Settings
+
+on:
+  workflow_call:
+    inputs:
+      name:
+        description: Display name for the Windows version
+        required: true
+        type: string
+
+      version:
+        description: VERSION value passed to the container
+        required: true
+        type: string
+
+      callback:
+        description: Guest script type
+        required: false
+        default: powershell
+        type: string
+
+      expected_caption:
+        description: Text expected in the Windows caption
+        required: true
+        type: string
+
+      expected_edition:
+        description: Expected Windows EditionID
+        required: false
+        default: ""
+        type: string
+
+      minimum_build:
+        description: Minimum acceptable Windows build number
+        required: true
+        type: number
+
+      platform:
+        description: Expected Windows platform
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  install:
+    name: ${{ inputs.name }}
+    uses: ./.github/workflows/install.yml
+    with:
+      name: ${{ inputs.name }}
+      version: ${{ inputs.version }}
+      callback: ${{ inputs.callback }}
+      enable_tunnel: false
+      kill_on_failure: true
+      install_timeout: 9000
+      reboot_timeout: 1800
+      minimum_reboots: 1
+      boot_loop_limit: 10
+      expected_caption: ${{ inputs.expected_caption }}
+      expected_edition: ${{ inputs.expected_edition }}
+      minimum_build: ${{ inputs.minimum_build }}
+      platform: ${{ inputs.platform }}

.github/workflows/validate.yml

@@ -84,7 +84,7 @@ jobs:
             platform: x64
 
     name: ${{ matrix.name }}
-    uses: ./.github/workflows/install.yml
+    uses: ./.github/workflows/settings.yml
     with:
       name: ${{ matrix.name }}
       version: ${{ matrix.version }}
@@ -129,7 +129,7 @@ jobs:
             platform: x64
 
     name: ${{ matrix.name }}
-    uses: ./.github/workflows/install.yml
+    uses: ./.github/workflows/settings.yml
     with:
       name: ${{ matrix.name }}
       version: ${{ matrix.version }}
@@ -197,7 +197,7 @@ jobs:
             platform: x64
 
     name: ${{ matrix.name }}
-    uses: ./.github/workflows/install.yml
+    uses: ./.github/workflows/settings.yml
     with:
       name: ${{ matrix.name }}
       version: ${{ matrix.version }}
@@ -230,7 +230,7 @@ jobs:
             platform: x64
 
     name: ${{ matrix.name }}
-    uses: ./.github/workflows/install.yml
+    uses: ./.github/workflows/settings.yml
     with:
       name: ${{ matrix.name }}
       version: ${{ matrix.version }}

Dockerfile

@@ -3,9 +3,11 @@
 ARG VERSION_ARG="latest"
 FROM scratch AS build-amd64
 
-COPY --from=qemux/qemu:7.40 / /
+COPY --from=qemux/qemu:7.43 / /
 
 ARG TARGETARCH
+
+ARG VERSION_UDF="1.2.0"
 ARG VERSION_WSDD="1.26"
 ARG VERSION_VIRTIO="1.9.58"
 ARG VERSION_BLINTER="1.0.112"
@@ -20,9 +22,11 @@ RUN <<EOF
   apt-get update
   apt-get --no-install-recommends -y install \
     samba \
+    mtools \
     wimtools \
     dos2unix \
     cabextract \
+    xmlstarlet \
     icu-devtools \
     libxml2-utils \
     libarchive-tools
@@ -33,10 +37,14 @@ RUN <<EOF
     --no-cache-dir \
     "Blinter==${VERSION_BLINTER}"
 
-  # Install wsdd
+  # Install wsddn package
   wget "https://github.com/gershnik/wsdd-native/releases/download/v${VERSION_WSDD}/wsddn_${VERSION_WSDD}_${TARGETARCH}.deb" -O /tmp/wsddn.deb -q --timeout=10
   dpkg -i /tmp/wsddn.deb
 
+  # Install UDFread package
+  wget "https://github.com/qemus/udfread/releases/download/v${VERSION_UDF}/udfread_${VERSION_UDF}_${TARGETARCH}.deb" -O /tmp/udfread.deb -q --timeout=10
+  dpkg -i /tmp/udfread.deb
+
   apt-get clean
   rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 EOF

assets/win10x64-enterprise.cmd

@@ -0,0 +1,113 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win10x64-enterprise.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,7 +62,7 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -249,11 +249,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -328,123 +323,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win10x64-iot.cmd

@@ -0,0 +1,113 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win10x64-iot.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -68,7 +68,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -255,11 +255,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -334,123 +329,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win10x64-ltsc.cmd

@@ -0,0 +1,113 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win10x64-ltsc.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -68,7 +68,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -252,11 +252,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -331,123 +326,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win10x64.cmd

@@ -0,0 +1,113 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win10x64.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,7 +62,7 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -249,11 +249,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -328,123 +323,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win11x64-enterprise.cmd

@@ -0,0 +1,119 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Disable the SMB signing requirement.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Remove the empty Windows.old folder.
+if exist "%SystemDrive%\Windows.old" rd /q "%SystemDrive%\Windows.old"
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win11x64-enterprise.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,7 +62,7 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -267,16 +267,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <Path>cmd.exe /c start "" /b /wait pnputil -i -a "C:\Windows\Drivers\viogpudo\viogpudo.inf"</Path>
-          <Description>Install VirtIO display driver</Description>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>27</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -351,133 +341,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable SMB signing requirement</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C rd /q C:\Windows.old</CommandLine>
-          <Description>Remove empty Windows.old folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>27</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win11x64-iot.cmd

@@ -0,0 +1,119 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Disable the SMB signing requirement.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Remove the empty Windows.old folder.
+if exist "%SystemDrive%\Windows.old" rd /q "%SystemDrive%\Windows.old"
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win11x64-iot.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,7 +62,7 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -267,16 +267,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <Path>cmd.exe /c start "" /b /wait pnputil -i -a "C:\Windows\Drivers\viogpudo\viogpudo.inf"</Path>
-          <Description>Install VirtIO display driver</Description>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>27</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -351,133 +341,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable SMB signing requirement</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C rd /q C:\Windows.old</CommandLine>
-          <Description>Remove empty Windows.old folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>27</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win11x64-ltsc.cmd

@@ -0,0 +1,119 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Disable the SMB signing requirement.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Remove the empty Windows.old folder.
+if exist "%SystemDrive%\Windows.old" rd /q "%SystemDrive%\Windows.old"
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win11x64-ltsc.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,7 +62,7 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -267,16 +267,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <Path>cmd.exe /c start "" /b /wait pnputil -i -a "C:\Windows\Drivers\viogpudo\viogpudo.inf"</Path>
-          <Description>Install VirtIO display driver</Description>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>27</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -351,133 +341,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable SMB signing requirement</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C rd /q C:\Windows.old</CommandLine>
-          <Description>Remove empty Windows.old folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>27</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win11x64.cmd

@@ -0,0 +1,119 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Disable the SMB signing requirement.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Remove the empty Windows.old folder.
+if exist "%SystemDrive%\Windows.old" rd /q "%SystemDrive%\Windows.old"
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Hide Copilot button.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f
+
+rem Disable unsupported hardware notifications.
+reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win11x64.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,7 +62,7 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -267,16 +267,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <Path>cmd.exe /c start "" /b /wait pnputil -i -a "C:\Windows\Drivers\viogpudo\viogpudo.inf"</Path>
-          <Description>Install VirtIO display driver</Description>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>27</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -351,133 +341,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable SMB signing requirement</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV1 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\UnsupportedHardwareNotificationCache" /v SV2 /d 0 /t REG_DWORD /f</CommandLine>
-          <Description>Disable unsupported hardware notifications</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C rd /q C:\Windows.old</CommandLine>
-          <Description>Remove empty Windows.old folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>26</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>27</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2008r2.cmd

@@ -0,0 +1,101 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2008r2.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,7 +57,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -157,15 +157,6 @@
         </FirewallGroup>
       </FirewallGroups>
     </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -212,108 +203,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2012r2.cmd

@@ -0,0 +1,98 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2012r2.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -158,11 +158,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -241,98 +236,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2016.cmd

@@ -0,0 +1,110 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2016.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -158,11 +158,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -241,118 +236,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2019-hv.cmd

@@ -0,0 +1,110 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2019-hv.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -164,11 +164,6 @@
           <Path>dism.exe /online /Disable-Feature /FeatureName:Microsoft-Hyper-V /NoRestart</Path>
           <Description>Disable Hyper-V role</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -247,118 +242,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2019.cmd

@@ -0,0 +1,110 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2019.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -162,11 +162,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -245,118 +240,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2022.cmd

@@ -0,0 +1,110 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Remove Search from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
+
+rem Remove Task View from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+
+rem Remove Widgets from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+
+rem Remove Chat from the Taskbar.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2022.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -162,11 +162,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -245,118 +240,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Search from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win2025.cmd

@@ -0,0 +1,97 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Disable the SMB signing requirement.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation and monitor blanking.
+POWERCFG -H OFF
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable the first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Allow RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery and File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Remove the empty Windows.old folder.
+if exist "%SystemDrive%\Windows.old" rd /q "%SystemDrive%\Windows.old"
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Set initial Explorer and taskbar preferences for the logged-in user.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win2025.xml

@@ -14,7 +14,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -69,7 +69,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -162,16 +162,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>cmd.exe /c start "" /b /wait pnputil -i -a "C:\Windows\Drivers\viogpudo\viogpudo.inf"</Path>
-          <Description>Install VirtIO display driver</Description>
-        </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-ServerManager-SvrMgrNc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -250,123 +240,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable SMB signing requirement</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>powershell.exe -ExecutionPolicy Unrestricted -NoLogo -NoProfile -NonInteractive set-localuser -name "Docker" -passwordneverexpires 1</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Hide Copilot button</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Task View from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Widgets from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Remove Chat from the Taskbar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>cmd /C rd /q C:\Windows.old</CommandLine>
-          <Description>Remove empty Windows.old folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x64-enterprise.cmd

@@ -0,0 +1,92 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x64-enterprise.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,7 +57,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -152,15 +152,6 @@
         </FirewallGroup>
       </FirewallGroups>
     </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -207,93 +198,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x64-ultimate.cmd

@@ -0,0 +1,92 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x64-ultimate.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,7 +57,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -152,15 +152,6 @@
         </FirewallGroup>
       </FirewallGroups>
     </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -207,93 +198,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x64.cmd

@@ -0,0 +1,92 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x64.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,7 +57,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -152,15 +152,6 @@
         </FirewallGroup>
       </FirewallGroups>
     </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -207,93 +198,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x86-enterprise.cmd

@@ -0,0 +1,88 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x86-enterprise.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,7 +57,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -198,93 +198,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x86-ultimate.cmd

@@ -0,0 +1,88 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x86-ultimate.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,7 +57,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -198,93 +198,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win7x86.cmd

@@ -0,0 +1,88 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteAPP to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win7x86.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -57,7 +57,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>2</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -198,93 +198,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteAPP to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win81x64-enterprise.cmd

@@ -0,0 +1,98 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win81x64-enterprise.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -62,7 +62,7 @@
       <ImageInstall>
         <OSImage>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -149,11 +149,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -226,98 +221,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/win81x64.cmd

@@ -0,0 +1,98 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem Enable the option for passwordless sign-in.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Turn off automatic Windows Update downloads.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+rem Install the VirtIO display driver last to avoid disrupting earlier setup work.
+pnputil.exe -i -a "%SystemRoot%\Drivers\viogpudo\viogpudo.inf"
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/win81x64.xml

@@ -13,7 +13,7 @@
     <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <DiskConfiguration>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <!-- System partition (ESP) -->
@@ -68,7 +68,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>3</PartitionID>
           </InstallTo>
           <InstallToAvailablePartition>false</InstallToAvailablePartition>
@@ -156,11 +156,6 @@
           <Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 1 /f</Path>
           <Description>Set Network Location to Home</Description>
         </RunSynchronousCommand>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
       </RunSynchronous>
     </component>
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -233,98 +228,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device" /v "DevicePasswordLessBuildVersion" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable option for passwordless sign-in</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off Windows Update auto download</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/winvistax64-enterprise.cmd

@@ -0,0 +1,110 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Add RDP in firewall.
+netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
+
+rem Enable RDP.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
+
+rem Turn off sidebar.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/winvistax64-enterprise.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -44,7 +44,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>1</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -90,15 +90,6 @@
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <fDenyTSConnections>false</fDenyTSConnections>
     </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -156,123 +147,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</CommandLine>
-          <Description>Add RDP in firewall</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable RDP</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off sidebar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/winvistax64-ultimate.cmd

@@ -0,0 +1,110 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Add RDP in firewall.
+netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
+
+rem Enable RDP.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
+
+rem Turn off sidebar.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/winvistax64-ultimate.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -44,7 +44,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>1</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -90,15 +90,6 @@
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <fDenyTSConnections>false</fDenyTSConnections>
     </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -156,123 +147,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</CommandLine>
-          <Description>Add RDP in firewall</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable RDP</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off sidebar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/winvistax64.cmd

@@ -0,0 +1,110 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Add RDP in firewall.
+netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
+
+rem Enable RDP.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
+
+rem Turn off sidebar.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem Install the VirtIO Balloon service once.
+sc.exe query BalloonService >nul 2>&1
+if errorlevel 1 "%SystemRoot%\Drivers\Balloon\blnsvr.exe" -i
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/winvistax64.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -44,7 +44,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>1</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -90,15 +90,6 @@
     <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
       <fDenyTSConnections>false</fDenyTSConnections>
     </component>
-    <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
-      <RunSynchronous>
-        <RunSynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Path>cmd.exe /c start "" /b /wait "C:\Windows\Drivers\Balloon\blnsvr.exe" -i</Path>
-          <Description>Install VirtIO Balloon service</Description>
-        </RunSynchronousCommand>
-      </RunSynchronous>
-    </component>
   </settings>
   <settings pass="oobeSystem">
     <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
@@ -156,123 +147,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</CommandLine>
-          <Description>Add RDP in firewall</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable RDP</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off sidebar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/winvistax86-enterprise.cmd

@@ -0,0 +1,106 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Add RDP in firewall.
+netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
+
+rem Enable RDP.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
+
+rem Turn off sidebar.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/winvistax86-enterprise.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -44,7 +44,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>1</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -147,123 +147,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</CommandLine>
-          <Description>Add RDP in firewall</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable RDP</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off sidebar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/winvistax86-ultimate.cmd

@@ -0,0 +1,106 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Add RDP in firewall.
+netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
+
+rem Enable RDP.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
+
+rem Turn off sidebar.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/winvistax86-ultimate.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -44,7 +44,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>1</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -147,123 +147,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</CommandLine>
-          <Description>Add RDP in firewall</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable RDP</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off sidebar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

assets/winvistax86.cmd

@@ -0,0 +1,106 @@
+@echo off
+setlocal
+
+set "SCRIPT_DIR=%~dp0"
+set "SETUP_STARTED=%SCRIPT_DIR%setup.started"
+set "SETUP_COMPLETE=%SCRIPT_DIR%setup.complete"
+
+if "%~1"=="" goto setup
+if /i "%~1"=="setup" goto setup
+if /i "%~1"=="logon" goto logon
+exit /b 2
+
+:setup
+if exist "%SETUP_COMPLETE%" exit /b 0
+
+type nul > "%SETUP_STARTED%"
+
+rem Allow guest access to network shares.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f
+
+rem BEGIN LOCAL_ACCOUNT
+rem Prevent the local user password from expiring.
+wmic useraccount where name="Docker" set PasswordExpires=false
+rem END LOCAL_ACCOUNT
+
+rem Disable hibernation.
+POWERCFG -H OFF
+
+rem Disable monitor blanking.
+POWERCFG -X -monitor-timeout-ac 0
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f
+
+rem Disable Network Discovery popup.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f
+
+rem Disable first-run experience in Edge.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f
+
+rem Disable hibernation in the registry.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f
+
+rem Disable hibernation.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f
+
+rem Disable sleep.
+POWERCFG -X -standby-timeout-ac 0
+
+rem Add RDP in firewall.
+netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
+
+rem Enable RDP.
+reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
+
+rem Turn off sidebar.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f
+
+rem Enable RemoteApp to launch unlisted programs.
+reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f
+
+rem Disable RemoteApp allowlist.
+reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f
+
+rem Enable Network Discovery.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes
+
+rem Enable File Sharing.
+netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes
+
+rem BEGIN PRODUCT_KEY
+rem Install the product key without activating Windows immediately.
+cscript.exe //B //Nologo "%SystemRoot%\System32\slmgr.vbs" /ipk "XXX"
+rem END PRODUCT_KEY
+
+type nul > "%SETUP_COMPLETE%"
+exit /b 0
+
+:logon
+rem Run the machine setup here when SetupComplete.cmd was skipped.
+if not exist "%SETUP_COMPLETE%" call "%~f0" setup
+
+rem Show file extensions in Explorer.
+reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f
+
+rem Disable screensaver.
+reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f
+
+rem BEGIN SHARED_FOLDER
+rem Add the shared folder to the desktop and map it to drive Z:.
+if not exist "%USERPROFILE%\Desktop\Shared" mklink /d "%USERPROFILE%\Desktop\Shared" \\host.lan\Data
+net.exe use Z: \\host.lan\Data /persistent:yes
+rem END SHARED_FOLDER
+
+rem BEGIN OEM_SCRIPT
+rem Launch the custom script asynchronously in a separate visible window.
+if exist "C:\OEM\install.bat" start "Install" cmd.exe /d /c ""C:\OEM\install.bat""
+rem END OEM_SCRIPT
+
+exit /b 0

assets/winvistax86.xml

@@ -14,7 +14,7 @@
       <DiskConfiguration>
         <WillShowUI>OnError</WillShowUI>
         <Disk wcm:action="add">
-          <DiskID>0</DiskID>
+          <DiskID>1</DiskID>
           <WillWipeDisk>true</WillWipeDisk>
           <CreatePartitions>
             <CreatePartition wcm:action="add">
@@ -44,7 +44,7 @@
             </MetaData>
           </InstallFrom>
           <InstallTo>
-            <DiskID>0</DiskID>
+            <DiskID>1</DiskID>
             <PartitionID>1</PartitionID>
           </InstallTo>
           <WillShowUI>OnError</WillShowUI>
@@ -147,123 +147,8 @@
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "AllowInsecureGuestAuth" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Allow guest access to network shares</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <CommandLine>cmd /C wmic useraccount where name="Docker" set PasswordExpires=false</CommandLine>
-          <Description>Password Never Expires</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
-          <CommandLine>cmd /C POWERCFG -H OFF</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>5</Order>
-          <CommandLine>cmd /C POWERCFG -X -monitor-timeout-ac 0</CommandLine>
-          <Description>Disable monitor blanking</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>6</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard" /v "HideWizard" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>8</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks" /v NetworkList /t REG_MULTI_SZ /d "" /f</CommandLine>
-          <Description>Disable Network Discovery popup</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>9</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable first-run experience in Edge</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>10</Order>
-          <CommandLine>reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Show file extensions in Explorer</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>11</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateFileSizePercent" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Zero Hibernation File</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>12</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Disable Hibernation</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>13</Order>
-          <CommandLine>cmd /C POWERCFG -X -standby-timeout-ac 0</CommandLine>
-          <Description>Disable Sleep</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>14</Order>
-          <CommandLine>netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</CommandLine>
-          <Description>Add RDP in firewall</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>15</Order>
-          <CommandLine>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f</CommandLine>
-          <Description>Enable RDP</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>16</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" /v "TurnOffSidebar" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Turn off sidebar</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>17</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d 0 /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>18</Order>
-          <CommandLine>reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\Windows\System32\scrnsavex.scr /f</CommandLine>
-          <Description>Disable screensaver</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>19</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnlistedRemotePrograms" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Enable RemoteApp to launch unlisted programs</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>20</Order>
-          <CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" /v "fDisabledAllowList" /t REG_DWORD /d 1 /f</CommandLine>
-          <Description>Disable RemoteApp allowlist</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>21</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-32752" new enable=Yes</CommandLine>
-          <Description>Enable Network Discovery</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>22</Order>
-          <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28502" new enable=Yes</CommandLine>
-          <Description>Enable File Sharing</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>23</Order>
-          <CommandLine>cmd /C mklink /d %userprofile%\Desktop\Shared \\host.lan\Data</CommandLine>
-          <Description>Create desktop shortcut to shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>24</Order>
-          <CommandLine>cmd /C net use Z: \\host.lan\Data /persistent:yes</CommandLine>
-          <Description>Map shared folder</Description>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>25</Order>
-          <CommandLine>cmd /C if exist "C:\OEM\install.bat" start "Install" "cmd /C C:\OEM\install.bat"</CommandLine>
-          <Description>Execute custom script from the OEM folder if exists</Description>
+          <CommandLine>cmd.exe /d /c call "%WINDIR%\Setup\Scripts\SetupComplete.cmd" logon</CommandLine>
+          <Description>Configure Windows after logon</Description>
         </SynchronousCommand>
       </FirstLogonCommands>
     </component>

docs/environment.md

@@ -47,6 +47,7 @@ An empty default means the variable is unset and its value is determined automat
 | `DISK_DISCARD` | `unmap` | Discard/TRIM mode for the primary disk. |
 | `DISK_ROTATION` | `1` | Rotation rate reported to the guest. Use `1` to identify the disk as an SSD. |
 | `DISK_FLAGS` |  | Additional options used when creating `qcow2` disks. |
+| `DISK_OPTIONS` |  | Additional options appended to QEMU disk devices. |
 | `ALLOCATE` | `N` | Preallocates space for the primary disk. |
 | `STORAGE` | `/storage` | Storage directory used for disks, firmware variables, and downloads. |
 
@@ -105,6 +106,7 @@ An empty default means the variable is unset and its value is determined automat
 |---|---|---|
 | `SAMBA` | `Y` | Enables the Samba shared folder. |
 | `SAMBA_DEBUG` | `N` | Enables Samba debug output. |
+| `SAMBA_READONLY` | `N` | Enables read-only mode for the shared folder. |
 | `SHORTCUT` | `Y` | Creates desktop and drive shortcuts to the shared folder. |
 
 ## ⚙️ System
@@ -126,12 +128,12 @@ An empty default means the variable is unset and its value is determined automat
 | `BOOT_MODE` | `windows` | Boot configuration, such as `windows`, `windows_secure`, or `windows_legacy`. |
 | `BOOT_INDEX` | `9` | Boot priority index for the installation media. |
 | `MEDIA_TYPE` |  | Device type used for installation media. |
+| `USB` | `qemu-xhci,id=xhci` | QEMU USB controller configuration. |
 | `BIOS` |  | Custom firmware file. |
 | `TPM` | `N` | Enables the TPM emulator, usually set by `BOOT_MODE`. |
 | `SMM` | `N` | Enables System Management Mode, usually set by `BOOT_MODE`. |
 | `LOGO` | `Y` | Enables the custom boot logo. |
 | `CLEAR` | `N` | Resets the NVRAM variables on the next boot. |
-| `USB` | `qemu-xhci,id=xhci` | QEMU USB controller configuration. |
 
 ## 🎈 Memory Ballooning
 
@@ -161,7 +163,6 @@ Also see [Dynamic memory allocation](https://github.com/qemus/qemu/blob/master/d
 | `VERIFY` | `N` | Verifies downloaded installation media against predefined checksums. |
 | `REMOVE` | `Y` | Deletes the downloaded Windows ISO after installation to save space. |
 | `MANUAL` | `N` | Enables manual installation instead of unattended installation. |
-| `REBUILD` | `Y` | Skips rebuilding the Windows ISO and uses the original image unchanged. |
 | `COMMAND` |  | Command to be executed during the final step of automatic installation. |
 
 ## 🔌 Shutdown
@@ -180,4 +181,4 @@ Also see [Dynamic memory allocation](https://github.com/qemus/qemu/blob/master/d
 | `LOG`   | `N` | Saves all output from `install.bat` to `C:\OEM\install.log` for troubleshooting. |
 | `DETECTED` |  | Overrides the automatically detected Windows image identifier. |
 | `SERIAL` | `mon:stdio` | QEMU serial device configuration. |
-| `MONITOR` | `unix:$QEMU_DIR/monitor.sock,server,wait=off,nodelay` | QEMU monitor configuration. |
+| `MONITOR` | `unix:/run/shm/monitor.sock` | QEMU monitor configuration. |

readme.md

@@ -67,14 +67,14 @@ docker run -it --rm --name windows -e "VERSION=11" -p 8006:8006 --device=/dev/kv
 kubectl apply -f https://raw.githubusercontent.com/dockur/windows/refs/heads/master/kubernetes.yml
 ```
 
+##### Desktop applications
+
+For a complete graphical desktop experience, see [WinBoat](https://winboat.app), [WinPodX](https://www.winpodx.org), or [WinApps](https://github.com/winapps-org/winapps). Each of these projects uses this container as its backend.
+
 ##### GitHub Codespaces:
 
 [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/dockur/windows)
 
-##### Graphical installer:
-
-[![Download WinBoat](https://github.com/dockur/windows/raw/master/.github/winboat.png)](https://winboat.app)
-
 ## Requirements ⚙️
 
 - Docker or Podman on a Linux host with KVM support.
@@ -137,6 +137,7 @@ kubectl apply -f https://raw.githubusercontent.com/dockur/windows/refs/heads/mas
   | `core11`  | Tiny11 Core      | 3.0 GB   |
   | `tiny11`  | Tiny11           | 5.3 GB   |
   | `tiny10`  | Tiny10           | 3.6 GB   |
+  | `reactos` | ReactOS          | 0.1 GB   |
 
 > [!TIP]
 > To install ARM64 versions of Windows use [dockur/windows-arm](https://github.com/dockur/windows-arm/).

src/define.sh

@@ -11,7 +11,6 @@ set -Eeuo pipefail
 : "${EDITION:=""}"
 : "${MANUAL:=""}"
 : "${REMOVE:=""}"
-: "${REBUILD:=""}"
 : "${VERSION:=""}"
 : "${COMMAND:=""}"
 : "${DETECTED:=""}"
@@ -38,36 +37,7 @@ USERNAME=$(strip "$USERNAME")
 DOMAIN_OU=$(strip "$DOMAIN_OU")
 WORKGROUP=$(strip "$WORKGROUP")
 
-EDITION_ORDER=(
-  "-enterprise|enterprise|enterprise enterprise-*"
-  "-ultimate|ultimate|ultimate ultimate-*"
-  "|default|@default n pro pro-* professional professional-* business business-*"
-  "-iot|iot|iot iot-* enterprise-iot enterprise-iot-*"
-  "-ltsc|ltsc|ltsc ltsc-* enterprise-ltsc enterprise-ltsc-*"
-  "-education|education|education education-* pro-education pro-education-*"
-  "-home|home|home home-*"
-  "-home-premium|home|home-premium home-premium-*"
-  "-home-basic|home|home-basic home-basic-*"
-  "-starter|starter|starter starter-*"
-)
-
-SERVER_EDITION_ORDER=(
-  "|default|@default"
-  "-datacenter|datacenter|datacenter datacenter-*"
-  "-datacenter-azure|datacenter|datacenter-azure"
-  "-enterprise|enterprise|enterprise enterprise-*"
-  "-web|web|web web-*"
-  "-foundation|foundation|foundation foundation-*"
-  "-essentials|essentials|essentials essentials-*"
-  "-standard-core|standard-core|standard-core standard-core-*"
-  "-datacenter-core|datacenter-core|datacenter-core datacenter-core-*"
-  "-datacenter-azure-core|datacenter-core|datacenter-azure-core"
-  "-enterprise-core|enterprise-core|enterprise-core enterprise-core-*"
-  "-web-core|web-core|web-core web-core-*"
-  "-hv|hv|hv hv-*"
-)
-
-MIRRORS=3
+MIRRORS=4
 
 parseVersion() {
 
@@ -77,113 +47,79 @@ parseVersion() {
 
   case "${VERSION,,}" in
     "11" | "11p" | "win11" | "pro11" | "win11p" | "windows11" | "windows 11" )
-      VERSION="win11x64"
-      ;;
+      VERSION="win11x64" ;;
     "11e" | "win11e" | "windows11e" | "windows 11e" )
-      VERSION="win11x64-enterprise-eval"
-      ;;
+      VERSION="win11x64-enterprise-eval" ;;
     "11l" | "11ltsc" | "ltsc11" | "win11l" | "win11-ltsc" | "win11x64-ltsc" )
-      VERSION="win11x64-enterprise-ltsc-eval"
-      ;;
+      VERSION="win11x64-enterprise-ltsc-eval" ;;
     "11i" | "11iot" | "iot11" | "win11i" | "win11-iot" | "win11x64-iot" )
-      VERSION="win11x64-enterprise-iot-eval"
-      ;;
+      VERSION="win11x64-enterprise-iot-eval" ;;
     "10" | "10p" | "win10" | "pro10" | "win10p" | "windows10" | "windows 10" )
-      VERSION="win10x64"
-      ;;
+      VERSION="win10x64" ;;
     "10e" | "win10e" | "windows10e" | "windows 10e" )
-      VERSION="win10x64-enterprise-eval"
-      ;;
+      VERSION="win10x64-enterprise-eval" ;;
     "10l" | "10ltsc" | "ltsc10" | "win10l" | "win10-ltsc" | "win10x64-ltsc" )
-      VERSION="win10x64-enterprise-ltsc-eval"
-      ;;
+      VERSION="win10x64-enterprise-ltsc-eval" ;;
     "10i" | "10iot" | "iot10" | "win10i" | "win10-iot" | "win10x64-iot" )
-      VERSION="win10x64-enterprise-iot-eval"
-      ;;
+      VERSION="win10x64-enterprise-iot-eval" ;;
     "8" | "8p" | "81" | "81p" | "pro8" | "8.1" | "win8" | "win8p" | "win81" | "win81p" | "windows 8" )
-      VERSION="win81x64"
-      ;;
+      VERSION="win81x64" ;;
     "8e" | "81e" | "8.1e" | "win8e" | "win81e" | "windows 8e" )
-      VERSION="win81x64-enterprise-eval"
-      ;;
+      VERSION="win81x64-enterprise-eval" ;;
     "7" | "win7" | "windows7" | "windows 7" )
-      VERSION="win7x64"
-      ;;
+      VERSION="win7x64" ;;
     "7u" | "win7u" | "windows7u" | "windows 7u" )
-      VERSION="win7x64-ultimate"
-      ;;
+      VERSION="win7x64-ultimate" ;;
     "7e" | "win7e" | "windows7e" | "windows 7e" )
-      VERSION="win7x64-enterprise"
-      ;;
+      VERSION="win7x64-enterprise" ;;
     "7x86" | "win7x86" | "win732" | "windows7x86" )
-      VERSION="win7x86"
-      ;;
+      VERSION="win7x86" ;;
     "7ux86" | "7u32" | "win7x86-ultimate" )
-      VERSION="win7x86-ultimate"
-      ;;
+      VERSION="win7x86-ultimate" ;;
     "7ex86" | "7e32" | "win7x86-enterprise" )
-      VERSION="win7x86-enterprise"
-      ;;
+      VERSION="win7x86-enterprise" ;;
     "vista" | "vs" | "6" | "winvista" | "windowsvista" | "windows vista" )
-      VERSION="winvistax64"
-      ;;
+      VERSION="winvistax64" ;;
     "vistu" | "vu" | "6u" | "winvistu" )
-      VERSION="winvistax64-ultimate"
-      ;;
+      VERSION="winvistax64-ultimate" ;;
     "viste" | "ve" | "6e" | "winviste" )
-      VERSION="winvistax64-enterprise"
-      ;;
+      VERSION="winvistax64-enterprise" ;;
     "vistax86" | "vista32" | "6x86" | "winvistax86" | "windowsvistax86" )
-      VERSION="winvistax86"
-      ;;
+      VERSION="winvistax86" ;;
     "vux86" | "vu32" | "winvistax86-ultimate" )
-      VERSION="winvistax86-ultimate"
-      ;;
+      VERSION="winvistax86-ultimate" ;;
     "vex86" | "ve32" | "winvistax86-enterprise" )
-      VERSION="winvistax86-enterprise"
-      ;;
+      VERSION="winvistax86-enterprise" ;;
     "xp" | "xp32" | "xpx86" | "5" | "5x86" | "winxp" | "winxp86" | "windowsxp" | "windows xp" )
-      VERSION="winxpx86"
-      ;;
+      VERSION="winxpx86" ;;
     "xp64" | "xpx64" | "5x64" | "winxp64" | "winxpx64" | "windowsxp64" | "windowsxpx64" )
-      VERSION="winxpx64"
-      ;;
+      VERSION="winxpx64" ;;
     "2k" | "2000" | "win2k" | "win2000" | "windows2k" | "windows2000" )
-      VERSION="win2kx86"
-      ;;
+      VERSION="win2kx86" ;;
     "25" | "2025" | "win25" | "win2025" | "windows2025" | "windows 2025" )
-      VERSION="win2025-eval"
-      ;;
+      VERSION="win2025-eval" ;;
     "22" | "2022" | "win22" | "win2022" | "windows2022" | "windows 2022" )
-      VERSION="win2022-eval"
-      ;;
+      VERSION="win2022-eval" ;;
     "19" | "2019" | "win19" | "win2019" | "windows2019" | "windows 2019" )
-      VERSION="win2019-eval"
-      ;;
+      VERSION="win2019-eval" ;;
     "16" | "2016" | "win16" | "win2016" | "windows2016" | "windows 2016" )
-      VERSION="win2016-eval"
-      ;;
+      VERSION="win2016-eval" ;;
     "hv" | "hyperv" | "hyper v" | "hyper-v" | "19hv" | "2019hv" | "win2019hv" )
-      VERSION="win2019-hv"
-      ;;
+      VERSION="win2019-hv" ;;
     "2012" | "2012r2" | "win2012" | "win2012r2" | "windows2012" | "windows 2012" )
-      VERSION="win2012r2-eval"
-      ;;
+      VERSION="win2012r2-eval" ;;
     "2008" | "2008r2" | "win2008" | "win2008r2" | "windows2008" | "windows 2008" )
-      VERSION="win2008r2"
-      ;;
+      VERSION="win2008r2" ;;
     "2003" | "2003r2" | "win2003" | "win2003r2" | "windows2003" | "windows 2003" )
-      VERSION="win2003r2"
-      ;;
+      VERSION="win2003r2" ;;
     "core11" | "core 11" )
-      VERSION="core11"
-      ;;
+      VERSION="core11" ;;
     "tiny11" | "tiny 11" )
-      VERSION="tiny11"
-      ;;
+      VERSION="tiny11" ;;
     "tiny10" | "tiny 10" )
-      VERSION="tiny10"
-      ;;
+      VERSION="tiny10" ;;
+    "reactos" | "react os" )
+      VERSION="reactos" ;;
   esac
 
   SUGGEST=$(getSuggestedVersion "$VERSION")
@@ -199,29 +135,21 @@ getSuggestedVersion() {
 
   case "$id" in
     "win10x64" | "win11x64" )
-      echo "$id"
-      ;;
+      echo "$id" ;;
     "win7x64" | "win7x86" | "winvistax64" | "winvistax86" )
-      echo "$id-ultimate"
-      ;;
+      echo "$id-ultimate" ;;
     "tiny10" )
-      echo "win10x64-ltsc"
-      ;;
+      echo "win10x64-ltsc" ;;
     *"-enterprise-ltsc-eval" )
-      echo "${id%-enterprise-ltsc-eval}-ltsc"
-      ;;
+      echo "${id%-enterprise-ltsc-eval}-ltsc" ;;
     *"-enterprise-iot-eval" )
-      echo "${id%-enterprise-iot-eval}-iot"
-      ;;
+      echo "${id%-enterprise-iot-eval}-iot" ;;
     *"-enterprise-ltsc" )
-      echo "${id%-enterprise-ltsc}-ltsc"
-      ;;
+      echo "${id%-enterprise-ltsc}-ltsc" ;;
     *"-enterprise-iot" )
-      echo "${id%-enterprise-iot}-iot"
-      ;;
+      echo "${id%-enterprise-iot}-iot" ;;
     *"-eval" )
-      echo "${id%-eval}"
-      ;;
+      echo "${id%-eval}" ;;
   esac
 
   return 0
@@ -232,11 +160,8 @@ getLanguage() {
   local source="$1"
   local input="${1,,}"
   local ret="$2"
-  local id="$source"
-  local lang=""
-  local desc=""
-  local short=""
-  local culture=""
+
+  local id="$source" lang="" desc="" short="" culture=""
 
   case "$input" in
     "ar" | "ar-"* | "arabic" | "arab" )
@@ -483,6 +408,7 @@ printVersion() {
     "tiny11"* ) desc="Tiny 11" ;;
     "tiny10"* ) desc="Tiny 10" ;;
     "core11"* ) desc="Core 11" ;;
+    "reactos"* ) desc="ReactOS" ;;
     "win7"* ) desc="Windows 7" ;;
     "win8"* ) desc="Windows 8" ;;
     "win10"* ) desc="Windows 10" ;;
@@ -522,14 +448,11 @@ printVariant() {
 
   case "${id,,}" in
     *"-iot" | *"-iot-eval" )
-      desc+=" IoT"
-      ;;
+      desc+=" IoT" ;;
     *"-ltsc" | *"-ltsc-eval" )
-      desc+=" LTSC"
-      ;;
+      desc+=" LTSC" ;;
     *"-enterprise" | *"-enterprise-eval" )
-      desc+=" Enterprise"
-      ;;
+      desc+=" Enterprise" ;;
   esac
 
   if enabled "$show_eval" && [[ "${id,,}" == *"-eval" ]]; then
@@ -566,6 +489,7 @@ printEdition() {
   local id="$1"
   local desc="$2"
   local show_eval="${3:-N}"
+
   local normalized="${id,,}"
   local result edition="" suffix=""
 
@@ -587,20 +511,15 @@ printEdition() {
           esac
           ;;
         "home" )
-          edition="Home"
-          ;;
+          edition="Home" ;;
         "starter" )
-          edition="Starter"
-          ;;
+          edition="Starter" ;;
         "ultimate" )
-          edition="Ultimate"
-          ;;
+          edition="Ultimate" ;;
         "enterprise" )
-          edition="Enterprise"
-          ;;
+          edition="Enterprise" ;;
         "education" )
-          edition="Education"
-          ;;
+          edition="Education" ;;
         "n" )
           case "$normalized" in
             "win7"* ) edition="Professional N" ;;
@@ -608,22 +527,18 @@ printEdition() {
           esac
           ;;
         "iot" | "enterprise-iot" )
-          edition="IoT Enterprise LTSC"
-          ;;
+          edition="IoT Enterprise LTSC" ;;
         "ltsc" | "enterprise-ltsc" )
-          edition="Enterprise LTSC"
-          ;;
+          edition="Enterprise LTSC" ;;
         * )
           edition=$(formatEdition "$suffix")
           ;;
       esac
       ;;
     "winxp"* )
-      edition="Professional"
-      ;;
+      edition="Professional" ;;
     "win2019-hv"* )
-      edition="2019"
-      ;;
+      edition="2019" ;;
     "win20"* )
       [[ "$normalized" == *"-"* ]] && suffix="${normalized#*-}"
 
@@ -651,10 +566,10 @@ printEdition() {
 
 fromFile() {
 
-  local id=""
   local desc="$1"
   local file="${1,,}"
-  local arch="${PLATFORM,,}"
+
+  local id="" arch="${PLATFORM,,}"
 
   file="${file//-/_}"
   file="${file// /_}"
@@ -690,6 +605,8 @@ fromFile() {
       id="tiny11" ;;
     "tiny10"* | "tiny_10"* )
       id="tiny10" ;;
+    "reactos"* )
+      id="reactos" ;;
     *"_serverhypercore_"* )
       id="win2019${add}-hv" ;;
     *"server2025"* | *"server_2025"* )
@@ -718,10 +635,11 @@ fromFile() {
 
 fromName() {
 
-  local id=""
   local name="$1"
   local arch="$2"
 
+  local id=""
+
   local add=""
   [[ "$arch" != "x64" ]] && add="$arch"
 
@@ -747,9 +665,23 @@ fromName() {
   return 0
 }
 
+isClientEdition() {
+
+  case "${1,,}" in
+    "pro" | "professional" | "business" | \
+    "enterprise" | "ultimate" | "education" | \
+    "home" | "homepremium" | "home-premium" | \
+    "homebasic" | "home-basic" | "starter" | "core" )
+      return 0 ;;
+  esac
+
+  return 1
+}
+
 normalizeEdition() {
 
   local source="${1,,}"
+
   local edition
 
   source="${source//evaluation/}"
@@ -769,7 +701,7 @@ normalizeEdition() {
 
 normalizeEditionID() {
 
-  local edition
+  local edition base
   local id="$2"
 
   edition=$(normalizeEdition "$1")
@@ -777,8 +709,21 @@ normalizeEditionID() {
   case "$edition" in
     "pro" | "professional" | "business" )
       edition="" ;;
-    "pro-n" | "pron" | "professional-n" | "professionaln" )
+    "pro-n" | "pron" | "professional-n" | "professionaln" | "business-n" | "businessn" )
       edition="n" ;;
+    * )
+      if ! isClientEdition "$edition"; then
+        case "$edition" in
+          *"-n" ) base="${edition%-n}" ;;
+          *"n" ) base="${edition%n}" ;;
+          * ) base="" ;;
+        esac
+
+        if [ -n "$base" ] && isClientEdition "$base"; then
+          edition="$base-n"
+        fi
+
+      fi ;;
   esac
 
   case "${id,,}" in
@@ -802,6 +747,7 @@ getEditionID() {
 
   local name="${1,,}"
   local id="${2,,}"
+
   local edition
 
   case "$id" in
@@ -837,26 +783,19 @@ normalizeServerEdition() {
 
   case "$edition" in
     "core" | "core-installation" | "server-core-installation" )
-      edition="standard-core"
-      ;;
+      edition="standard-core" ;;
     "desktop-experience" | "server-with-a-gui" | "full-installation" )
-      edition="standard"
-      ;;
+      edition="standard" ;;
     *"-server-core-installation" )
-      edition="${edition%-server-core-installation}-core"
-      ;;
+      edition="${edition%-server-core-installation}-core" ;;
     *"-core-installation" )
-      edition="${edition%-core-installation}-core"
-      ;;
+      edition="${edition%-core-installation}-core" ;;
     *"-desktop-experience" )
-      edition="${edition%-desktop-experience}"
-      ;;
+      edition="${edition%-desktop-experience}" ;;
     *"-server-with-a-gui" )
-      edition="${edition%-server-with-a-gui}"
-      ;;
+      edition="${edition%-server-with-a-gui}" ;;
     *"-full-installation" )
-      edition="${edition%-full-installation}"
-      ;;
+      edition="${edition%-full-installation}" ;;
   esac
 
   edition="${edition#server-}"
@@ -903,6 +842,7 @@ getServerEditionID() {
 
   local name="${1,,}"
   local id="${2,,}"
+
   local edition
 
   case "$id" in
@@ -922,11 +862,51 @@ getServerEditionID() {
   return 0
 }
 
+getEditionOrder() {
+
+  local id="${1,,}"
+
+  case "$id" in
+    "win20"* )
+      printf '%s\n' \
+        "|default|@default" \
+        "-datacenter|datacenter|datacenter datacenter-*" \
+        "-datacenter-azure|datacenter|datacenter-azure" \
+        "-enterprise|enterprise|enterprise enterprise-*" \
+        "-web|web|web web-*" \
+        "-foundation|foundation|foundation foundation-*" \
+        "-essentials|essentials|essentials essentials-*" \
+        "-standard-core|standard-core|standard-core standard-core-*" \
+        "-datacenter-core|datacenter-core|datacenter-core datacenter-core-*" \
+        "-datacenter-azure-core|datacenter-core|datacenter-azure-core" \
+        "-enterprise-core|enterprise-core|enterprise-core enterprise-core-*" \
+        "-web-core|web-core|web-core web-core-*" \
+        "-hv|hv|hv hv-*"
+      ;;
+    * )
+      printf '%s\n' \
+        "-enterprise|enterprise|enterprise enterprise-*" \
+        "-ultimate|ultimate|ultimate ultimate-*" \
+        "|default|@default n pro pro-* professional professional-* business business-*" \
+        "-iot|iot|iot iot-* enterprise-iot enterprise-iot-*" \
+        "-ltsc|ltsc|ltsc ltsc-* enterprise-ltsc enterprise-ltsc-*" \
+        "-education|education|education education-* pro-education pro-education-*" \
+        "-home|home|home home-*" \
+        "-home-premium|home|home-premium home-premium-*" \
+        "-home-basic|home|home-basic home-basic-*" \
+        "-starter|starter|starter starter-*"
+      ;;
+  esac
+
+  return 0
+}
+
 getVersion() {
 
-  local id edition
   local name="$1"
   local arch="$2"
+
+  local id edition
   local evaluation=""
 
   id=$(fromName "$name" "$arch")
@@ -954,18 +934,38 @@ getVersion() {
   return 0
 }
 
+skipVersion() {
+
+  local id="$1"
+
+  case "${id,,}" in
+    "win9"* | "winxp"* | "win2k"* | "win2003"* | "reactos" )
+      return 0 ;;
+  esac
+
+  return 1
+}
+
+isLegacy() {
+
+  local id="$1"
+
+  case "${id,,}" in
+    "win9"* | "win2k"* | "winxp"* | "win2003"* | \
+    "winvista"* | "win7"* | "win2008"* | "reactos" )
+      return 0 ;;
+  esac
+
+  return 1
+}
+
 switchEdition() {
 
-  local -n id="$1"
+  local version="$1"
 
-  [[ "${id,,}" == *"-eval" ]] || return 1
-
-  id="${id::-5}"
-
-  if ! enabled "${DETECTED_ORG:-}"; then
-    DETECTED="${SUGGEST:-$id}"
-  fi
+  [[ "${version,,}" == *"-eval" ]] || return 1
 
+  echo "${version::-5}"
   return 0
 }
 
@@ -974,9 +974,8 @@ getMido() {
   local id="$1"
   local lang="$2"
   local ret="$3"
-  local url=""
-  local sum=""
-  local size=""
+
+  local url="" sum="" size=""
 
   [[ "${lang,,}" != "en" && "${lang,,}" != "en-us" ]] && return 0
 
@@ -1001,6 +1000,10 @@ getMido() {
       sum="2cee70bd183df42b92a2e0da08cc2bb7a2a9ce3a3841955a012c0f77aeb3cb29"
       url="https://software-static.download.prss.microsoft.com/dbazure/998969d5-f34g-4e03-ac9d-1f9786c66749/26100.1742.240906-0331.ge_release_svc_refresh_CLIENT_IOT_LTSC_EVAL_x64FRE_en-us.iso"
       ;;
+    "win10x64" )
+      size=6140975104
+      sum="a6f470ca6d331eb353b815c043e327a347f594f37ff525f17764738fe812852e"
+      ;;
     "win10x64-enterprise-eval" )
       size=5550497792
       sum="ef7312733a9f5d7d51cfa04ac497671995674ca5e1058d5164d6028f0938d668"
@@ -1069,9 +1072,8 @@ getLink1() {
   local id="$1"
   local lang="$2"
   local ret="$3"
-  local url=""
-  local sum=""
-  local size=""
+
+  local url="" sum="" size=""
   local host="https://dl.bobpony.com/windows"
 
   [[ "${lang,,}" != "en" && "${lang,,}" != "en-us" ]] && return 0
@@ -1208,9 +1210,8 @@ getLink2() {
   local id="$1"
   local lang="$2"
   local ret="$3"
-  local url=""
-  local sum=""
-  local size=""
+
+  local url="" sum="" size=""
   local host="https://files.dog/MSDN"
 
   [[ "${lang,,}" != "en" && "${lang,,}" != "en-us" ]] && return 0
@@ -1302,9 +1303,36 @@ getLink3() {
   local id="$1"
   local lang="$2"
   local ret="$3"
-  local url=""
-  local sum=""
-  local size=""
+
+  local url="" sum="" size=""
+  local host="https://iso.reactos.org"
+
+  [[ "${lang,,}" != "en" && "${lang,,}" != "en-us" ]] && return 0
+
+  case "${id,,}" in
+    "reactos" )
+      size=0
+      sum=""
+      url="livecd/latest-x86-gcc-lin-rel"
+      ;;
+  esac
+
+  case "${ret,,}" in
+    "sum" ) echo "$sum" ;;
+    "size" ) echo "$size" ;;
+    *) [ -n "$url" ] && echo "$host/$url";;
+  esac
+
+  return 0
+}
+
+getLink4() {
+
+  local id="$1"
+  local lang="$2"
+  local ret="$3"
+
+  local url="" sum="" size=""
   local host="https://archive.org/download"
 
   [[ "${lang,,}" != "en" && "${lang,,}" != "en-us" ]] && return 0
@@ -1473,12 +1501,13 @@ getLink3() {
 
 getValue() {
 
-  local val=""
   local id="$2"
   local lang="$3"
   local type="$4"
   local func="getLink$1"
 
+  local val=""
+
   if [ "$1" -gt 0 ] && [ "$1" -le "$MIRRORS" ]; then
     val=$($func "$id" "$lang" "$type")
   fi
@@ -1506,6 +1535,7 @@ isMido() {
 
   local id="$1"
   local lang="$2"
+
   local sum
 
   disabled "${MIDO:-}" && return 1
@@ -1528,8 +1558,7 @@ isESD() {
     "win10${PLATFORM,,}" | \
     "win11${PLATFORM,,}-enterprise" | \
     "win10${PLATFORM,,}-enterprise" )
-      return 0
-      ;;
+      return 0 ;;
   esac
 
   return 1
@@ -1548,10 +1577,8 @@ validVersion() {
   isESD "$id" "$lang" && return 0
 
   for ((i=1;i<=MIRRORS;i++)); do
-
     url=$(getLink "$i" "$id" "$lang")
     [ -n "$url" ] && return 0
-
   done
 
   return 1

src/entry.sh

@@ -63,7 +63,7 @@ else
 fi
 
 pid=$!
-( sleep 30; boot ) &
+waitForBoot "$pid" 30 &
 
 rc=0
 wait "$pid" || rc=$?

src/mido.sh

@@ -6,6 +6,7 @@ handleCurlError() {
   local code="$1"
   local server="$2"
   local reason="${3:-}"
+
   local signal
 
   if [ -n "$reason" ] && (( code <= 125 )); then
@@ -29,8 +30,7 @@ handleCurlError() {
         SEGV | ABRT) error "Curl crashed with signal $signal." ;;
         "") error "Curl terminated with exit status $code." ;;
         *) error "Curl terminated due to signal $signal." ;;
-      esac
-      ;;
+      esac ;;
   esac
 
   return 1
@@ -38,10 +38,9 @@ handleCurlError() {
 
 curlRequest() {
 
-  local output="$1"
-  local server="$2"
-  local agent="$3"
-  shift 3
+  local server="$1"
+  local agent="$2"
+  shift 2
 
   local log reason response
 
@@ -50,6 +49,8 @@ curlRequest() {
     return 1
   fi
 
+  # Preserve curl's status under errexit so its stderr can be translated
+  # into a useful error instead of terminating the script immediately.
   {
     response=$(LC_ALL=C curl \
       --silent \
@@ -76,40 +77,27 @@ curlRequest() {
 
   rm -f "$log"
 
-  if [ -n "$output" ]; then
-    printf -v "$output" '%s' "$response"
-  fi
-
+  printf '%s' "$response"
   return 0
 }
 
-downloadWindows() {
+downloadWindowsLink() {
 
-  local id="$1"
-  local lang="$2"
-  local desc="$3"
+  local productId="$1"
+  local url="$2"
+  local agent="$3"
+  local language="$4"
+  local lang="$5"
+  local desc="$6"
+  local type="$7"
 
-  local ovToken="" ovTicks="" ovTime
-  local skuId skuJson
-  local linkJson link
-  local language ovData
-  local session agent
-  local type winVer
-  local page productId
+  local ovToken="" ovTicks=""
   local profile="606624d44113"
+  local skuId skuJson linkJson
+  local link ovData ovTime session
 
-  agent=$(getAgent)
-  language=$(getLanguage "$lang" "name")
-
-  case "${id,,}" in
-    "win11x64" ) winVer="11" && type="1" ;;
-    "win11arm64" ) winVer="11arm64" && type="2" ;;
-    * ) error "Invalid VERSION specified, value \"$id\" is not recognized!" && return 1 ;;
-  esac
-
-  local url="https://www.microsoft.com/en-us/software-download/windows$winVer"
-
-  # uuidgen: For MacOS (installed by default) and other systems (e.g. with no /proc) that don't have a kernel interface for generating random UUIDs
+  # Prefer the Linux kernel UUID source, with uuidgen as a portable fallback
+  # for macOS and systems without /proc.
   if ! session=$(cat /proc/sys/kernel/random/uuid 2> /dev/null || uuidgen --random); then
     error "Failed to generate session ID!"
     return 1
@@ -122,49 +110,32 @@ downloadWindows() {
     return 1
   fi
 
-  # Get product edition ID for latest release of given Windows version
-  enabled "$DEBUG" && echo "Parsing download page: ${url}"
-
-  curlRequest page "Microsoft" "$agent" \
-    --header "Accept:" \
-    --max-filesize 1M \
-    -- "$url" || return 1
-
-  enabled "$DEBUG" && echo -n "Getting Product edition ID: "
-  productId=$(echo "$page" | grep -Eo '<option value="[0-9]+">Windows' | cut -d '"' -f 2 | head -n 1 | tr -cd '0-9' | head -c 16)
-  enabled "$DEBUG" && echo "$productId"
-
-  if [ -z "$productId" ]; then
-    error "Product edition ID not found!"
-    return 1
-  fi
-
-  # Microsoft download "protection" requires the sessionId to be whitelisted through vlscppe.microsoft.com/tags
+  # Register the session with Microsoft's anti-abuse endpoint before
+  # requesting SKU or download links.
 
   local orgId="y6jn8c31"
   local vlsUrl="https://vlscppe.microsoft.com/tags?org_id=$orgId&session_id=$session"
 
   enabled "$DEBUG" && echo "Getting Session ID: $session"
 
-  # Permit Session ID
-  curlRequest "" "Microsoft" "$agent" \
+  curlRequest "Microsoft" "$agent" \
     --output /dev/null \
     --header "Accept:" \
     --max-filesize 100K \
     -- "$vlsUrl" || return 1
 
-  # Microsoft download "protection" also requires an ov-df.microsoft.com request/reply
-  # 1) Request mdt.js to get w and rticks. InstanceId is (currently) constant.
+  # Complete Microsoft's ov-df challenge by retrieving a token and timing
+  # value, then returning both with the current timestamp.
 
   local instance="560dc9f3-1aa5-4a2f-b63c-9e18f8d0e175"
   local ovUrl="https://ov-df.microsoft.com/mdt.js?instanceId=$instance&PageId=si&session_id=$session"
 
   enabled "$DEBUG" && echo -n "Getting OV data: "
 
-  curlRequest ovData "Microsoft" "$agent" \
+  ovData=$(curlRequest "Microsoft" "$agent" \
     --header "Accept:" \
     --max-filesize 1M \
-    -- "$ovUrl" || return 1
+    -- "$ovUrl") || return 1
 
   if [[ $ovData =~ [\?\&]w=([A-Fa-f0-9]+) ]]; then
     ovToken="${BASH_REMATCH[1]}"
@@ -183,14 +154,12 @@ downloadWindows() {
 
   sleep 0.2
 
-  # 2) Send a reply with session ID, current epoch and previously retrieved w and rticks
-
   ovTime=$(date +%s%3N)
   ovUrl="https://ov-df.microsoft.com/?session_id=$session&CustomerId=$instance&PageId=si&w=$ovToken&mdt=$ovTime&rticks=$ovTicks"
 
   enabled "$DEBUG" && echo "Sending OV reply: $instance"
 
-  curlRequest "" "Microsoft" "$agent" \
+  curlRequest "Microsoft" "$agent" \
     --output /dev/null \
     --header "Accept:" \
     --max-filesize 100K \
@@ -200,13 +169,15 @@ downloadWindows() {
 
   local skuUrl="https://www.microsoft.com/software-download-connector/api/getskuinformationbyproductedition?profile=$profile&ProductEditionId=$productId&SKU=undefined&friendlyFileName=undefined&Locale=en-US&sessionID=$session"
 
-  curlRequest skuJson "Microsoft" "$agent" \
+  skuJson=$(curlRequest "Microsoft" "$agent" \
     --referer "$url" \
     --header "Accept:" \
     --max-filesize 100K \
-    -- "$skuUrl" || return 1
+    -- "$skuUrl") || return 1
 
-  { skuId=$(echo "$skuJson" | jq --arg LANG "$language" -r '.Skus[] | select(.Language==$LANG).Id') 2>/dev/null; local rc=$?; } || :
+  # Guard jq under errexit so malformed API data can be handled as a normal
+  # missing-result error. The same pattern is reused for the link response.
+  { skuId=$(printf '%s\n' "$skuJson" | jq --arg LANG "$language" -r 'first(.Skus[]? | select(.Language == $LANG) | .Id) // empty') 2>/dev/null; local rc=$?; } || :
 
   if [ -z "$skuId" ] || [[ "${skuId,,}" == "null" ]] || (( rc != 0 )); then
     language=$(getLanguage "$lang" "desc")
@@ -217,34 +188,33 @@ downloadWindows() {
   enabled "$DEBUG" && echo "$skuId"
   enabled "$DEBUG" && echo "Getting ISO download link..."
 
-  # Get ISO download link
-  # If any request is going to be blocked by Microsoft it's always this last one (the previous requests always seem to succeed)
+  # Microsoft normally applies request or IP blocking on this final connector
+  # call rather than during the preceding session setup.
 
   local linkUrl="https://www.microsoft.com/software-download-connector/api/GetProductDownloadLinksBySku?profile=$profile&ProductEditionId=undefined&SKU=$skuId&friendlyFileName=undefined&Locale=en-US&sessionID=$session"
 
-  curlRequest linkJson "Microsoft" "$agent" \
+  linkJson=$(curlRequest "Microsoft" "$agent" \
     --referer "$url" \
     --header "Accept:" \
     --max-filesize 100K \
-    -- "$linkUrl" || return 1
+    -- "$linkUrl") || return 1
 
   if ! [ "$linkJson" ]; then
-    # This should only happen if there's been some change to how this API works
     error "Microsoft servers gave us an empty response to our request for an automated download."
     return 1
   fi
 
-  if echo "$linkJson" | grep -q "Sentinel marked this request as rejected."; then
+  if grep -Fq "Sentinel marked this request as rejected." <<< "$linkJson"; then
     error "Microsoft blocked the automated download request based on your IP address."
     return 1
   fi
 
-  if echo "$linkJson" | grep -q "We are unable to complete your request at this time."; then
+  if grep -Fq "We are unable to complete your request at this time." <<< "$linkJson"; then
     error "Microsoft blocked the automated download request."
     return 1
   fi
 
-  { link=$(echo "$linkJson" | jq --argjson TYPE "$type" -r '.ProductDownloadOptions[] | select(.DownloadType==$TYPE).Uri') 2>/dev/null; rc=$?; } || :
+  { link=$(printf '%s\n' "$linkJson" | jq --argjson TYPE "$type" -r 'first(.ProductDownloadOptions[]? | select(.DownloadType == $TYPE) | .Uri) // empty') 2>/dev/null; rc=$?; } || :
 
   if [ -z "$link" ] || [[ "${link,,}" == "null" ]] || (( rc != 0 )); then
     error "Microsoft server gave us no download link to our request for an automated download!"
@@ -256,11 +226,85 @@ downloadWindows() {
   return 0
 }
 
+downloadWindows() {
+
+  local id="$1"
+  local lang="$2"
+  local desc="$3"
+
+  local agent language page
+  local productId type winVer
+
+  agent=$(getAgent)
+  language=$(getLanguage "$lang" "name")
+
+  case "${id,,}" in
+    "win10x64" )
+      productId="2618"
+      winVer="10"
+      type="1" ;;
+    "win11x64" )
+      productId="3321"
+      winVer="11"
+      type="1" ;;
+    "win11arm64" )
+      productId="3324"
+      winVer="11arm64"
+      type="2" ;;
+    * )
+      error "Invalid VERSION specified, value \"$id\" is not recognized!"
+      return 1 ;;
+  esac
+
+  local url="https://www.microsoft.com/en-us/software-download/windows$winVer"
+  [[ "${id,,}" == "win10"* ]] && url+="ISO"
+
+  enabled "$DEBUG" && echo "Using Product edition ID: $productId"
+
+  if downloadWindowsLink "$productId" "$url" "$agent" "$language" "$lang" "$desc" "$type"; then
+    return 0
+  fi
+
+  sleep 1
+
+  # Product edition IDs can change. If the configured ID fails, recover the
+  # current value from Microsoft's public download page and retry once.
+  local msg="retrying using a different method..."
+  info "Microsoft download request failed, $msg"
+  enabled "$DEBUG" && echo "Parsing download page: ${url}"
+
+  page=$(curlRequest "Microsoft" "$agent" \
+    --header "Accept:" \
+    --max-filesize 1M \
+    -- "$url") || return 1
+
+  enabled "$DEBUG" && echo -n "Getting Product edition ID: "
+  productId=$(printf '%s' "$page" |
+    tr '\r\n' '  ' |
+    grep -Eio "<option[^>]*value=[\"'][0-9]+[\"'][^>]*>[[:space:]]*Windows[^<]*" |
+    sed -nE "s/.*value=[\"']([0-9]+)[\"'].*/\1/p" |
+    sed -n '1p' |
+    cut -c 1-16 || true)
+  enabled "$DEBUG" && echo "$productId"
+
+  if [ -z "$productId" ]; then
+    info "Failed to fetch the Product edition ID from the download page, $msg"
+    return 1
+  fi
+
+  if ! downloadWindowsLink "$productId" "$url" "$agent" "$language" "$lang" "$desc" "$type"; then
+    return 1
+  fi
+
+  return 0
+}
+
 downloadWindowsEval() {
 
   local id="$1"
   local lang="$2"
   local desc="$3"
+
   local culture compare type
   local agent language winVer
 
@@ -305,27 +349,28 @@ downloadWindowsEval() {
 
   enabled "$DEBUG" && echo "Parsing download page: ${url}"
 
-  curlRequest page "Microsoft" "$agent" \
+  page=$(curlRequest "Microsoft" "$agent" \
     --location \
     --max-filesize 1M \
-    -- "$url" || return 1
+    -- "$url") || return 1
 
   if ! [ "$page" ]; then
-    # This should only happen if there's been some change to where this download page is located
     error "Windows server download page gave us an empty response"
     return 1
   fi
 
   enabled "$DEBUG" && echo "Getting download link.."
 
-  local filter="https://go.microsoft.com/fwlink/?linkid=[0-9]\+&clcid=0x[0-9a-z]\+&culture=${culture,,}&country=${country,,}"
+  # Normalize HTML-encoded query separators before extracting fwlinks.
+  page=${page//&amp;/&}
+  page=${page//&#38;/&}
 
-  if ! echo "$page" | grep -io "$filter" > /dev/null; then
-    filter="https://go.microsoft.com/fwlink/p/?linkid=[0-9]\+&clcid=0x[0-9a-z]\+&culture=${culture,,}&country=${country,,}"
-  fi
-
-  links=$(echo "$page" | grep -io "$filter") || {
-    # This should only happen if there's been some change to the download endpoint web address
+  links=$(printf '%s\n' "$page" |
+    grep -Eio "https://go\.microsoft\.com/fwlink(/p)?/\?[^\"'<>[:space:]]+" |
+    grep -Ei '(^|[?&])culture='"${culture,,}"'(&|$)' |
+    grep -Ei '(^|[?&])country='"${country,,}"'(&|$)') || {
+    # Distinguish a changed or missing English page from an unavailable
+    # translation for an otherwise supported product.
     if [[ "${lang,,}" == "en" || "${lang,,}" == "en-"* ]]; then
       error "Windows server download page gave us no download link!"
     else
@@ -335,34 +380,36 @@ downloadWindowsEval() {
     return 1
   }
 
+  # Evaluation pages currently expose several matching fwlinks in a known
+  # product/platform order, so select the entry for the requested variant.
   case "$type" in
     "iot" )
       case "${PLATFORM,,}" in
         "x64" )
-          link=$(echo "$links" | head -n 1) ;;
+          link=$(printf '%s\n' "$links" | head -n 1) ;;
         "arm64" )
-          link=$(echo "$links" | head -n 2 | tail -n 1) ;;
+          link=$(printf '%s\n' "$links" | head -n 2 | tail -n 1) ;;
       esac ;;
     "ltsc" )
       case "${PLATFORM,,}" in
         "x64" )
-          link=$(echo "$links" | head -n 2 | tail -n 1) ;;
+          link=$(printf '%s\n' "$links" | head -n 2 | tail -n 1) ;;
       esac ;;
     "enterprise" )
       case "${PLATFORM,,}" in
         "x64" )
           if [[ "$winVer" != "windows-10"* ]]; then
-            link=$(echo "$links" | head -n 1)
+            link=$(printf '%s\n' "$links" | head -n 1)
           else
-            link=$(echo "$links" | head -n 2 | tail -n 1)
+            link=$(printf '%s\n' "$links" | head -n 2 | tail -n 1)
           fi ;;
         "arm64" )
-          link=$(echo "$links" | head -n 2 | tail -n 1) ;;
+          link=$(printf '%s\n' "$links" | head -n 2 | tail -n 1) ;;
       esac ;;
     "server" )
       case "${PLATFORM,,}" in
         "x64" )
-          link=$(echo "$links" | head -n 1) ;;
+          link=$(printf '%s\n' "$links" | head -n 1) ;;
       esac ;;
     * )
       error "Invalid type specified, value \"$type\" is not recognized!" && return 1 ;;
@@ -370,19 +417,21 @@ downloadWindowsEval() {
 
   [ -z "$link" ] && error "Could not parse download link from page!" && return 1
 
-  # Follow redirect so proceeding log message is useful
-  # This is a request we make that Fido doesn't
+  # Resolve the fwlink now so later logging and platform validation use the
+  # actual ISO URL rather than Microsoft's generic redirect.
 
-  curlRequest link "Microsoft" "$agent" \
+  link=$(curlRequest "Microsoft" "$agent" \
     --location \
     --output /dev/null \
     --write-out "%{url_effective}" \
     --head \
-    -- "$link" || return 1
+    -- "$link") || return 1
 
   local lower="${link,,}"
   local separator='(^|[[:space:]_./-])'
 
+  # Guard against page-order changes resolving to the wrong architecture
+  # before downloading a multi-gigabyte image.
   case "${PLATFORM,,}" in
     "x64" )
       if [[ "$lower" =~ ${separator}(arm64|a64) ]]; then
@@ -400,6 +449,8 @@ downloadWindowsEval() {
       fi ;;
   esac
 
+  # During debug verification, compare the resolved filename with the static
+  # catalog entry to expose unexpected changes on Microsoft's page.
   if enabled "$DEBUG" && enabled "$VERIFY" && [[ "${lang,,}" == "en"* ]]; then
 
     compare=$(getMido "$id" "$lang" "")
@@ -444,14 +495,11 @@ getMidoDetected() {
   # Derive the normal answer-file identity from the requested download route.
   case "$default" in
     *"-enterprise-ltsc-eval" )
-      default="${default%-enterprise-ltsc-eval}-ltsc"
-      ;;
+      default="${default%-enterprise-ltsc-eval}-ltsc" ;;
     *"-enterprise-iot-eval" )
-      default="${default%-enterprise-iot-eval}-iot"
-      ;;
+      default="${default%-enterprise-iot-eval}-iot" ;;
     *"-eval" )
-      default="${default%-eval}"
-      ;;
+      default="${default%-eval}" ;;
   esac
 
   # Preserve a genuinely different DETECTED override.
@@ -463,17 +511,13 @@ getMidoDetected() {
   # Select the answer-file identity for the source that actually succeeded.
   case "$source" in
     *"-enterprise-ltsc-eval" )
-      detected="${source%-enterprise-ltsc-eval}-ltsc-eval"
-      ;;
+      detected="${source%-enterprise-ltsc-eval}-ltsc-eval" ;;
     *"-enterprise-iot-eval" )
-      detected="${source%-enterprise-iot-eval}-iot-eval"
-      ;;
+      detected="${source%-enterprise-iot-eval}-iot-eval" ;;
     *"-eval" )
-      detected="$source"
-      ;;
+      detected="$source" ;;
     * )
-      detected="${current:-$default}"
-      ;;
+      detected="${current:-$default}" ;;
   esac
 
   echo "$detected"
@@ -485,21 +529,21 @@ downloadWindowsLtsc() {
   local id="$1"
   local lang="$2"
   local desc="$3"
+
   local alternate alternate_desc
 
   case "${id,,}" in
     "win11${PLATFORM,,}-enterprise-iot-eval" )
-      alternate="win11${PLATFORM,,}-enterprise-ltsc-eval"
-      ;;
+      alternate="win11${PLATFORM,,}-enterprise-ltsc-eval" ;;
     "win11${PLATFORM,,}-enterprise-ltsc-eval" )
-      alternate="win11${PLATFORM,,}-enterprise-iot-eval"
-      ;;
+      alternate="win11${PLATFORM,,}-enterprise-iot-eval" ;;
     * )
       error "Invalid VERSION specified, value \"$id\" is not recognized!"
-      return 1
-      ;;
+      return 1 ;;
   esac
 
+  # IoT and LTSC share related evaluation sources and may become unavailable
+  # independently, so use the sibling edition as a compatibility fallback.
   if downloadWindowsEval "$id" "$lang" "$desc" > /dev/null 2>&1; then
     MIDO_SOURCE="$id"
     return 0
@@ -524,9 +568,12 @@ getWindows() {
   local lang="$2"
   local desc="$3"
   local web_desc="$4"
+
   local language edition
 
   MIDO_SOURCE=""
+  MIDO_STATIC="N"
+
   language=$(getLanguage "$lang" "desc")
   edition=$(printEdition "$version" "$desc" "Y")
 
@@ -534,6 +581,8 @@ getWindows() {
   local web_msg="Requesting $web_desc from the Microsoft servers..."
   info "$msg" && html "$web_msg"
 
+  # These sources are only published in English, so avoid trying download
+  # routes that cannot satisfy the requested language.
   case "${version,,}" in
     "win2008r2"* | \
     "win81${PLATFORM,,}"* | \
@@ -546,7 +595,10 @@ getWindows() {
       fi ;;
   esac
 
+  # ARM64 downloads exist only for the explicitly supported Windows 11
+  # routes; all other catalog entries remain x64-only.
   case "${version,,}" in
+    "win10x64" ) ;;
     "win11${PLATFORM,,}" ) ;;
     "win11${PLATFORM,,}-enterprise"* ) ;;
     * )
@@ -557,8 +609,10 @@ getWindows() {
       fi ;;
   esac
 
+  # Prefer live Microsoft download routes. Unsupported or failed live routes
+  # fall through to the configured static catalog below.
   case "${version,,}" in
-    "win11${PLATFORM,,}" )
+    "win10x64" | "win11${PLATFORM,,}" )
 
       if downloadWindows "$version" "$lang" "$edition"; then
         MIDO_SOURCE="$version"
@@ -568,8 +622,7 @@ getWindows() {
     "win11${PLATFORM,,}-enterprise-iot-eval" | \
     "win11${PLATFORM,,}-enterprise-ltsc-eval" )
 
-      downloadWindowsLtsc "$version" "$lang" "$edition" && return 0
-      ;;
+      downloadWindowsLtsc "$version" "$lang" "$edition" && return 0 ;;
 
     "win11${PLATFORM,,}-enterprise"* )
 
@@ -590,13 +643,16 @@ getWindows() {
 
     * )
       error "Invalid VERSION specified, value \"$version\" is not recognized!"
-      return 1
-      ;;
+      return 1 ;;
   esac
 
+  # Static catalog URLs are the last resort after live Microsoft methods are
+  # unavailable or have failed.
   MIDO_URL=$(getMido "$version" "$lang" "")
   [ -z "$MIDO_URL" ] && return 1
 
+  MIDO_STATIC="Y"
+
   if [[ "${version,,}" == "win2008r2"* ]]; then
     MIDO_SOURCE="win2008r2-eval"
     return 0
@@ -610,11 +666,10 @@ getBuild() {
 
   local id="$1"
   local ret="$2"
-  local url=""
-  local name=""
   local build="$3"
-  local edition=""
+
   local file="catalog.xml"
+  local url="" name="" edition=""
 
   case "${id,,}" in
     "win11${PLATFORM,,}" )
@@ -640,10 +695,9 @@ getCatalog() {
 
   local id="$1"
   local ret="$2"
-  local url=""
-  local name=""
-  local edition=""
+
   local file="catalog.cab"
+  local url="" name="" edition=""
 
   if [[ "${id,,}" == "win11"* ]] && ! isCompatible; then
     # ARMv8.0 cannot run Windows 11 builds 24H2 and up.
@@ -673,19 +727,108 @@ getCatalog() {
     "url" ) echo "$url" ;;
     "file" ) echo "$file" ;;
     "name" ) echo "$name" ;;
-    "edition" ) echo '[Edition="'"${edition}"'"]' ;;
+    "edition" ) echo "$edition" ;;
     *) echo "";;
   esac
 
   return 0
 }
 
-getXmlTag() {
+parseESD() {
 
-  local tag="$1"
-  local file="$2"
+  local xml="$1"
+  local version="$2"
+  local lang="$3"
+  local desc="$4"
+  local edition="$5"
+  local culture="$6"
 
-  xmllint --nonet --xpath "//$tag" "$file" 2>/dev/null | sed -E -e "s/<[\/]?$tag>//g" || true
+  local xmlFile="${xml##*/}"  
+  local file_path file_sum file_size file_edition
+  local file_culture file_match=0 language_match=0
+  local records architecture language separator=$'\x1f'
+
+  ESD=""
+  ESD_SUM=""
+  ESD_SIZE=""
+
+  # Microsoft catalogs have used different XML namespaces. Match elements by
+  # local name and flatten the catalog once so selection needs no temporary XML.
+  if ! records=$(xmlstarlet sel \
+    -T -t \
+    -m "//*[local-name()='File']" \
+      -v "normalize-space(*[local-name()='Architecture'])" \
+      -o "$separator" \
+      -v "normalize-space(*[local-name()='Edition'])" \
+      -o "$separator" \
+      -v "normalize-space(*[local-name()='LanguageCode'])" \
+      -o "$separator" \
+      -v "normalize-space(*[local-name()='FilePath'])" \
+      -o "$separator" \
+      -v "normalize-space(*[local-name()='Sha1'])" \
+      -o "$separator" \
+      -v "normalize-space(*[local-name()='Size'])" \
+      -n \
+    "$xml" 2>/dev/null); then
+
+    error "Failed to parse $xmlFile!"
+    return 1
+  fi
+
+  # Track product/platform and language matches separately so failures can
+  # distinguish an unavailable edition from an unavailable translation.
+  while IFS="$separator" read -r \
+    architecture file_edition file_culture \
+    file_path file_sum file_size; do
+
+    [ -n "$architecture$file_path$file_sum$file_size$file_culture$file_edition" ] || continue
+
+    [ "${architecture,,}" = "${PLATFORM,,}" ] || continue
+
+    if [ -n "$edition" ] &&
+      [ "${file_edition,,}" != "${edition,,}" ]; then
+      continue
+    fi
+
+    file_match=1
+
+    [ "${file_culture,,}" = "${culture,,}" ] || continue
+
+    language_match=1
+    ESD="$file_path"
+    ESD_SUM="$file_sum"
+    ESD_SIZE="$file_size"
+    break
+
+  done <<< "$records"
+
+  if (( ! file_match )); then
+    desc=$(printEdition "$version" "$desc" "Y")
+    error "No download link available for $desc!"
+    return 1
+  fi
+
+  if (( ! language_match )); then
+    desc=$(printEdition "$version" "$desc" "Y")
+    language=$(getLanguage "$lang" "desc")
+    error "No download in the $language language available for $desc!"
+    return 1
+  fi
+
+  if [ -z "$ESD" ]; then
+    error "Failed to find ESD URL in $xmlFile!"
+    return 1
+  fi
+
+  if [ -z "$ESD_SUM" ]; then
+    error "Failed to find ESD checksum in $xmlFile!"
+    return 1
+  fi
+
+  if [ -z "$ESD_SIZE" ]; then
+    error "Failed to find ESD filesize in $xmlFile!"
+    return 1
+  fi
 
   return 0
 }
@@ -696,12 +839,10 @@ getESD() {
   local version="$2"
   local lang="$3"
   local desc="$4"
-  local file result culture
-  local language edition catalog
+
+  local file culture log
+  local edition catalog rc=0
   local xmlFile="products.xml"
-  local esdFile="esd_edition.xml"
-  local filterFile="products_filter.xml"
-  local log
 
   file=$(getCatalog "$version" "file")
   catalog=$(getCatalog "$version" "url")
@@ -728,10 +869,12 @@ getESD() {
     return 1
   fi
 
+  # Preserve wget's status under errexit so its log can provide the actual
+  # server or filesystem failure reason.
   {
     LC_ALL=C wget "$catalog" -O "$dir/$file" --no-verbose --timeout=30 \
       --no-http-keep-alive --output-file="$log"
-    local rc=$?
+    rc=$?
   } || :
 
   if (( rc != 0 )); then
@@ -758,6 +901,8 @@ getESD() {
 
   rm -f "$log"
 
+  # Normal catalogs arrive as CAB archives, while pinned build catalogs are
+  # already XML and only need the common filename.
   if [[ "$file" == *".xml" ]]; then
 
     if ! mv -f "$dir/$file" "$dir/$xmlFile"; then
@@ -777,61 +922,13 @@ getESD() {
 
   fi
 
-  if [ ! -f "$dir/$xmlFile" ] || [ ! -s "$dir/$xmlFile" ]; then
+  if [ ! -s "$dir/$xmlFile" ]; then
     error "Failed to find $xmlFile in $file!"
     return 1
   fi
 
-  local query='//File[Architecture="'${PLATFORM,,}'"]'"${edition}"''
-  result=$(xmllint --nonet --xpath "${query}" "$dir/$xmlFile" 2>/dev/null || true)
-
-  if [ -z "$result" ]; then
-
-    query='//File[Architecture="'${PLATFORM^^}'"]'"${edition}"''
-    result=$(xmllint --nonet --xpath "${query}" "$dir/$xmlFile" 2>/dev/null || true)
-
-    if [ -z "$result" ]; then
-      desc=$(printEdition "$version" "$desc" "Y")
-      language=$(getLanguage "$lang" "desc")
-      error "No download link available for $desc!"
-      return 1
-    fi
-
-  fi
-
-  echo -e '<Catalog>' > "$dir/$filterFile"
-  echo "$result" >> "$dir/$filterFile"
-  echo -e '</Catalog>'>> "$dir/$filterFile"
-
-  result=$(xmllint --nonet --xpath "//File[LanguageCode=\"${culture,,}\"]" "$dir/$filterFile" 2>/dev/null || true)
-
-  if [ -z "$result" ]; then
-    desc=$(printEdition "$version" "$desc" "Y")
-    language=$(getLanguage "$lang" "desc")
-    error "No download in the $language language available for $desc!"
-    return 1
-  fi
-
-  echo "$result" > "$dir/$esdFile"
-
-  ESD=$(getXmlTag "FilePath" "$dir/$esdFile")
-
-  if [ -z "$ESD" ]; then
-    error "Failed to find ESD URL in $esdFile!"
-    return 1
-  fi
-
-  ESD_SUM=$(getXmlTag "Sha1" "$dir/$esdFile")
-
-  if [ -z "$ESD_SUM" ]; then
-    error "Failed to find ESD checksum in $esdFile!"
-    return 1
-  fi
-
-  ESD_SIZE=$(getXmlTag "Size" "$dir/$esdFile")
-
-  if [ -z "$ESD_SIZE" ]; then
-    error "Failed to find ESD filesize in $esdFile!"
+  if ! parseESD \
+    "$dir/$xmlFile" "$version" "$lang" "$desc" "$edition" "$culture"; then
     return 1
   fi
 
@@ -841,10 +938,13 @@ getESD() {
 
 isCompressed() {
 
-  local file="$1"
+  local url="${1%%\?*}"
 
-  case "${file,,}" in
-    *".7z" | *".zip" | *".rar" | *".lzma" | *".bz" | *".bz2" )
+  # The ReactOS latest-build endpoint returns an archive without a filename
+  # extension, so recognize its path explicitly.
+  case "${url,,}" in
+    *.7z | *.zip | *.rar | *.tar | *.cab | *.cpio | \
+    *.lzh | *.lha | *.xar | */latest-x86-gcc-lin-rel )
       return 0 ;;
   esac
 
@@ -868,7 +968,10 @@ verifyFile() {
   local hash
 
   [ -z "$check" ] && return 0
-  ! enabled "$VERIFY" && return 0
+  enabled "$VERIFY" || return 0
+
+  # Microsoft ESD catalogs publish SHA1, while current mirror metadata normally
+  # uses SHA256; the digest length identifies which algorithm is required.
   [[ "${#check}" == "40" ]] && algo="SHA1"
 
   local msg="Verifying downloaded ISO..."
@@ -918,10 +1021,13 @@ downloadFile() {
   local desc="$4"
   local web_desc="$5"
   local connections="${6:-1}"
+
+  local domain dots
   local msg="Downloading $web_desc"
   local console_msg="Downloading $desc"
-  local domain dots
 
+  # Keep mirror messages concise by reducing subdomains to the final two
+  # labels, while Microsoft downloads retain the generic description.
   domain=$(echo "$url" | awk -F/ '{print $3}')
   dots=$(echo "$domain" | tr -cd '.' | wc -c)
   (( dots > 1 )) && domain=$(expr "$domain" : '.*\.\(.*\..*\)')
@@ -950,14 +1056,21 @@ tryDownload() {
   local desc="$6"
   local seconds="$7"
   local web_desc="$8"
-  local total
+
+  local total minimum="104857600"
+
+  # Compressed archives can legitimately be much smaller than the ISO they
+  # contain, so use a lower sanity threshold until extraction.
+  if isCompressed "$url"; then
+    minimum="10485760"
+  fi
 
   if downloadRetry \
       "$iso" \
       "${CONNECTIONS:-1}" \
       "$seconds" \
       "$desc" \
-      "100000000" \
+      "$minimum" \
       "$iso" \
       "$url" \
       "$size" \
@@ -998,8 +1111,8 @@ fallbackEnglish() {
   local lang="$3"
   local desc="$4"
   local web_desc="$5"
-  local culture web_msg
 
+  local culture web_msg
   local msg="No working download method was found for $desc, falling back to English..."
   info "$msg"
 
@@ -1025,12 +1138,11 @@ downloadImage() {
   local iso="$1"
   local version="$2"
   local lang="$3"
+
   local requested="$version"
-  local tried="n"
-  local success="n"
-  local seconds="5"
   local detected="$DETECTED"  
-  local url sum size base desc web_desc language i
+  local tried="n" success="n" seconds="5"
+  local i url sum size base language desc web_desc 
 
   if [[ "${version,,}" == "http"* ]]; then
 
@@ -1066,6 +1178,8 @@ downloadImage() {
     desc+=" in $language"
   fi
 
+  # Prefer a live Microsoft URL and retry link generation once before moving
+  # on to ESD catalogs or mirrors.
   if isMido "$version" "$lang"; then
 
     tried="y"
@@ -1086,13 +1200,18 @@ downloadImage() {
       sum=""
       size=""
 
-      # Skip verification if the retrieved URL differs from the static URL.
+      # Apply the metadata belonging to the configured static URL.
       if [[ "${MIDO_URL%%\?*}" == "${url%%\?*}" ]]; then
         size=$(getMido "$version" "$lang" "size")
         sum=$(getMido "$version" "$lang" "sum")
       fi
 
-      if tryDownload "$iso" "$MIDO_URL" "$sum" "$size" "$lang" "$desc" "$seconds" "$web_desc"; then
+      local download_desc="$desc"
+      if enabled "$MIDO_STATIC"; then
+        download_desc+=" using a static link"
+      fi
+
+      if tryDownload "$iso" "$MIDO_URL" "$sum" "$size" "$lang" "$download_desc" "$seconds" "$web_desc"; then
         # Commit the candidate only after the image was downloaded and verified.
         DETECTED="$detected"
         return 0
@@ -1101,7 +1220,13 @@ downloadImage() {
     fi
   fi
 
-  if switchEdition version; then
+  # Some editions share another download route. Update the effective version
+  # before looking up ESD catalogs and mirrors.
+  if version=$(switchEdition "$version"); then
+  
+    if ! enabled "${DETECTED_ORG:-}"; then
+      DETECTED="${SUGGEST:-$version}"
+    fi
 
     desc=$(printVariant "$DETECTED" "" "Y")
     web_desc=$(printVariant "$DETECTED" "")
@@ -1130,6 +1255,8 @@ downloadImage() {
 
     if [[ "$success" == "y" ]]; then
 
+      # Standalone ESD media requires a different extraction path, so expose
+      # its real extension through the active ISO variable.
       ISO="${ISO%.*}.esd"
 
       if tryDownload "$ISO" "$ESD" "$ESD_SUM" "$ESD_SIZE" "$lang" "$desc" "$seconds" "$web_desc"; then

src/power.sh

@@ -11,40 +11,203 @@ SHUTDOWN_SIGNAL=0
 
 QEMU_PTY="$QEMU_DIR/qemu.pty"
 QEMU_END="$QEMU_DIR/qemu.end"
+ACPI_SOCKET="$QEMU_DIR/acpi.sock"
 CONSOLE_PID="$QEMU_DIR/console.pid"
 CONSOLE_SOCKET="$QEMU_DIR/console.sock"
 QEMU_START_PID="$QEMU_DIR/qemu.start.pid"
 
-bootFailed() {
+bootStatus() {
 
-  local fail=""
+  [ ! -s "$QEMU_PTY" ] && return 1
 
   if [[ "${BOOT_MODE,,}" == "windows_legacy" ]]; then
-    grep -Fq "No bootable device." "$QEMU_PTY" && fail="y"
-    grep -Fq "BOOTMGR is missing" "$QEMU_PTY" && fail="y"
+    local line last recent
+
+    # Only inspect output produced after the most recent BIOS boot attempt so
+    # stale failures from an earlier device do not affect the current state.
+    line=$(grep -nE '^Booting from (Hard Disk|DVD/CD)' "$QEMU_PTY" | tail -1)
+    [ -z "$line" ] && return 1
+
+    last="${line#*:}"
+    recent=$(tail -n +"${line%%:*}" "$QEMU_PTY")
+
+    grep -Fq "Loading FreeLoader..." <<< "$recent" && return 0
+
+    if grep -Fq \
+      -e "No bootable device." \
+      -e "BOOTMGR is missing" \
+      <<< "$recent"; then
+      return 2
     fi
 
-  [ -n "$fail" ]
+    # These BIOS messages only describe the failed device attempt. QEMU may
+    # immediately continue with another boot target, so clear pending success
+    # instead of treating them as a terminal failure.
+    if grep -Fq \
+      -e "Boot failed: not a bootable disk" \
+      -e "Boot failed: Could not read from CDROM" \
+      -e "Boot failed: could not read the boot disk" \
+      <<< "$recent"; then
+      return 5
+    fi
+
+    if [[ "$last" == "Booting from Hard Disk"* ]]; then
+      return 3
+    fi
+
+    if [[ "$last" == "Booting from DVD/CD"* ]]; then
+      return 4
+    fi
+
+    return 1
+  fi
+
+  local line last recent
+
+  # OVMF logs every boot option it tries. Track the newest attempt and only
+  # evaluate messages emitted from that point onward.
+  line=$(grep -nE \
+    'BdsDxe: starting Boot[[:xdigit:]]{4} ' \
+    "$QEMU_PTY" | tail -1)
+
+  [ -z "$line" ] && return 1
+
+  last="${line#*:}"
+  recent=$(tail -n +"${line%%:*}" "$QEMU_PTY")
+
+  if [[ "$last" == *'"Windows Boot Manager"'* ]]; then
+    return 0
+  fi
+
+  grep -Eq \
+    'BdsDxe: failed to start Boot[[:xdigit:]]{4} "UEFI QEMU .*DVD-ROM.*: Time out' \
+    <<< "$recent" && return 2
+
+  grep -Fq \
+    "BdsDxe: No bootable option or device was found." \
+    <<< "$recent" && return 2
+
+  grep -Fq "UEFI Interactive Shell" <<< "$recent" && return 2
+
+  grep -Eq \
+    -e '"UEFI QEMU .*DVD-ROM' \
+    -e 'CDROM\(' \
+    -e 'USB\(' \
+    <<< "$last" && return 4
+
+  return 1
 }
 
-boot() {
+waitForBoot() {
 
-  [ -f "$QEMU_END" ] && return 0
+  local pid="$1"
+  local timeout="${2:-30}"
+  local keySent=0
+  local pendingType=0
+  local pendingLine=""
+  local pendingDeadline=0
+  local keyDelay status marker
+  local deadline=$((SECONDS + timeout))
+  local screen="visit http://127.0.0.1:$WEB_PORT/ to view the screen..."
 
-  if [ -s "$QEMU_PTY" ]; then
-    if [ "$(stat -c%s "$QEMU_PTY")" -gt 7 ]; then
-      if ! bootFailed; then
+  while isAlive "$pid"; do
+
+    # Send the boot key once, either immediately after the prompt appears or
+    # shortly after firmware starts the DVD when the prompt is not logged.
+    if (( ! keySent )) && needsBootKey; then
+
+      if keyDelay=$(bootKeyDelay); then
+
+        if [[ "$keyDelay" == "0" ]]; then
+          if sendKey spc 0 500; then
+            keySent=1
+          fi
+        else
+          if sendKey spc "$keyDelay" 250 4 0.75; then
+            keySent=1
+          fi
+        fi
+
+      fi
+
+    fi
+
+    if bootStatus; then
+      status=0
+    else
+      status=$?
+    fi
+
+    case "$status" in
+
+      0) echo
 
         if [[ "${DISPLAY,,}" == "web" ]] && ! disabled "${WEB:-Y}"; then
-          info "$(app) started successfully, visit http://127.0.0.1:$WEB_PORT/ to view the screen..."
+          info "$(app) started successfully, $screen"
         else
           info "$(app) started successfully."
         fi
 
-        return 0
+        echo && return 0 ;;
+
+      2) echo
+
+        error "$(app) could not boot, aborting..."
+        terminateQemu
+        return 0 ;;
+
+      3 | 4)
+
+        marker=$(getBootMarker)
+
+        # A firmware boot line alone is not proof that the guest started. Wait
+        # briefly for a more definitive success or failure message, restarting
+        # the grace period whenever firmware begins a different boot attempt.
+        if [[ "$marker" != "$pendingLine" ]] || (( status != pendingType )); then
+          pendingLine="$marker"
+          pendingType=$status
+
+          pendingDeadline=$((SECONDS + 6))
         fi
+
+        if (( pendingDeadline > 0 && SECONDS >= pendingDeadline )); then
+          echo
+
+          if [[ "${DISPLAY,,}" == "web" ]] && ! disabled "${WEB:-Y}"; then
+            info "$(app) started successfully, $screen"
+          else
+            info "$(app) started successfully."
           fi
+
+          echo && return 0
         fi
+        ;;
+
+      5)
+
+        # A failed device attempt is transitional because firmware may continue
+        # with another target. Discard any pending success decision.
+        pendingType=0
+        pendingLine=""
+        pendingDeadline=0
+        ;;
+
+      *)
+
+        pendingType=0
+        pendingLine=""
+        pendingDeadline=0
+        ;;
+
+    esac
+
+    (( SECONDS >= deadline )) && break
+
+    sleep 0.25
+  done
+
+  isAlive "$pid" || return 0
+  [ -f "$QEMU_END" ] && return 0
 
   error "Timeout while waiting for QEMU to boot the machine, aborting..."
   terminateQemu
@@ -54,19 +217,33 @@ boot() {
 
 legacyBootReady() {
 
-  local last
-  local bios="Booting from Hard"
+  local line last recent
+  local hard="Booting from Hard"
+  local cdrom="Booting from DVD/CD"
 
-  last=$(grep "^Booting.*" "$QEMU_PTY" | tail -1)
-  [[ "${last,,}" != "${bios,,}"* ]] && return 1
-  grep -Fq "No bootable device." "$QEMU_PTY" && return 1
-  grep -Fq "BOOTMGR is missing" "$QEMU_PTY" && return 1
+  line=$(grep -n "^Booting.*" "$QEMU_PTY" | tail -1)
+  [ -z "$line" ] && return 1
+
+  last="${line#*:}"
+  recent=$(tail -n +"${line%%:*}" "$QEMU_PTY")
+
+  # ACPI shutdown is safe once BIOS has handed control to the hard disk, unless
+  # the same attempt already produced a known boot failure.
+  [[ "${last,,}" != "${hard,,}"* ]] && return 1
+
+  grep -Fq "Loading FreeLoader..." <<< "$recent" && return 0
+  grep -Fq "No bootable device." <<< "$recent" && return 1
+  grep -Fq "BOOTMGR is missing" <<< "$recent" && return 1
+  grep -Fq "Boot failed: not a bootable disk" <<< "$recent" && return 1
+  grep -Fq "Boot failed: could not read the boot disk" <<< "$recent" && return 1
 
   return 0
 }
 
 ready() {
 
+  # The marker means installation completed previously, so shutdown no longer
+  # needs to infer guest readiness from firmware output.
   [ -f "$STORAGE/windows.boot" ] && return 0
   [ ! -s "$QEMU_PTY" ] && return 1
 
@@ -75,12 +252,124 @@ ready() {
     return 1
   fi
 
-  local line="\"Windows Boot Manager\""
-  grep -Fq "$line" "$QEMU_PTY" && return 0
+  local last
+  last=$(grep -E \
+    'BdsDxe: starting Boot[[:xdigit:]]{4} ' \
+    "$QEMU_PTY" | tail -1)
+
+  # Only a Windows Boot Manager entry loaded from a hard disk proves that setup
+  # has progressed far enough for an ACPI shutdown request to be appropriate.
+  grep -Eq \
+    'BdsDxe: starting Boot[[:xdigit:]]{4} "Windows Boot Manager" from .*HD\(' \
+    <<< "$last" && return 0
 
   return 1
 }
 
+sendKey() {
+
+  local key="$1"
+  local delay="${2:-0}"
+  local hold="${3:-100}"
+  local repeat="${4:-1}"
+  local interval="${5:-0}"
+  local i output
+
+  [ ! -S "$ACPI_SOCKET" ] && return 1
+  [[ "$delay" != "0" ]] && sleep "$delay"
+
+  # Send all repeats through one monitor connection so timing remains stable
+  # and QEMU receives the sequence as one operation.
+  if ! output=$(
+    {
+      for ((i = 1; i <= repeat; i++)); do
+        printf 'sendkey %s %s\n' "$key" "$hold"
+
+        if (( i < repeat )); then
+          sleep "$interval"
+        fi
+      done
+    } | nc -q 1 -w 1 -U "$ACPI_SOCKET" 2>&1
+  ); then
+    return 1
+  fi
+
+  # The human monitor may return success at the transport level while reporting
+  # a command error in its text response, so inspect that output explicitly.
+  if grep -Eqi \
+    -e 'unknown command' \
+    -e 'unknown key' \
+    -e 'invalid parameter' \
+    -e 'invalid key' \
+    -e '^error:' \
+    <<< "$output"; then
+
+    warn "failed to send boot key through QEMU monitor!"
+
+    if enabled "${DEBUG:-}"; then
+      echo "$output"
+    fi
+
+    return 1
+  fi
+
+  return 0
+}
+
+supportsBootKey() {
+
+  local id="$1"
+
+  [[ "${id,,}" == "win"* ]]
+}
+
+needsBootKey() {
+
+  [ ! -s "$BOOT" ] && return 1
+  [[ "${BOOT,,}" != *".iso" ]] && return 1
+  [ -f "$STORAGE/windows.boot" ] && return 1
+
+  supportsBootKey "$DETECTED"
+}
+
+bootKeyDelay() {
+
+  [ ! -s "$QEMU_PTY" ] && return 1
+
+  # A visible prompt is the safest trigger and should be answered immediately.
+  if grep -Fq "Press any key to" "$QEMU_PTY"; then
+    echo 0
+    return 0
+  fi
+
+  # Some firmware or Windows versions do not log the prompt. In that case wait
+  # briefly after the DVD boot attempt and send several short key presses.
+  if [[ "${BOOT_MODE,,}" == "windows_legacy" ]]; then
+    grep -Fq "Booting from DVD/CD" "$QEMU_PTY" || return 1
+  else
+    grep -Eq \
+      'BdsDxe: starting Boot[[:xdigit:]]{4} "UEFI QEMU .*DVD-ROM' \
+      "$QEMU_PTY" || return 1
+  fi
+
+  echo 0.5
+  return 0
+}
+
+getBootMarker() {
+
+  if [[ "${BOOT_MODE,,}" == "windows_legacy" ]]; then
+    grep -nE '^Booting from (Hard Disk|DVD/CD)' "$QEMU_PTY" | tail -1
+    return 0
+  fi
+
+  grep -nE \
+    'BdsDxe: starting Boot[[:xdigit:]]{4} ' \
+    "$QEMU_PTY" | tail -1
+
+  return 0
+}
+
 markWindowsBooted() {
 
   local file="$STORAGE/windows.boot"
@@ -89,8 +378,9 @@ markWindowsBooted() {
     return 0
   fi
 
-  # Remove CD-ROM ISO after install
-  ! ready && return 0
+  # Do not remove installation media until firmware output confirms Windows is
+  # now booting from the installed disk rather than from setup media.
+  ready || return 0
 
   if ! touch "$file"; then
     warn "failed to create Windows installation marker!"
@@ -114,6 +404,8 @@ finish() {
 
   local reason=$1 failed=0
 
+  # QEMU_END distinguishes an expected shutdown path from an unexpected QEMU
+  # exit carrying the same process status.
   if [ ! -f "$QEMU_END" ] && (( reason != 0 )); then
     failed=1
   fi
@@ -150,7 +442,13 @@ abortDuringSetup() {
 
   local code="$1"
 
+  # Before Windows boots from disk, ACPI may be ignored or interpreted by setup
+  # itself. Terminate QEMU directly instead of waiting for a graceful shutdown.
+  if [[ "${DETECTED,,}" != "reactos" ]] || [ -n "${CUSTOM:-}" ]; then
     info "Cannot send ACPI signal during $(app) setup, aborting..."
+  else
+    info "ReactOS LiveCD does not support ACPI shutdown, terminating..."
+  fi
 
   terminateQemu
 
@@ -166,12 +464,16 @@ gracefulShutdown() {
   local sig="$1"
   local pid code
 
+  # Traps can run in subshells created by pipelines or command substitutions;
+  # only the original shell may coordinate QEMU shutdown.
   [[ $BASHPID != "$TRAP_PID" ]] && return
 
   code=$(signalCode "$sig")
 
   if [ -f "$QEMU_END" ]; then
 
+    # A second Ctrl-C during an active shutdown skips the remaining grace period
+    # and lets the shutdown loop force QEMU down immediately.
     if (( code == 130 && SHUTDOWN_SIGNAL == code )); then
       SHUTDOWN_SKIP=1
       echo && info "Received SIGINT again, forcing shutdown..."
@@ -182,12 +484,16 @@ gracefulShutdown() {
     return
   fi
 
+  # Signal handlers must complete their own error handling and cleanup without
+  # errexit terminating the shell partway through the shutdown sequence.
   set +e
   SHUTDOWN_SIGNAL=$code
 
   touch "$QEMU_END"
   echo && info "Received $sig signal, sending ACPI shutdown signal..."
 
+  # Interactive startup may receive a signal before the PID file appears, so
+  # briefly wait for it there; non-interactive operation fails immediately.
   if ! readQemuPid pid; then
     if ! interactive || ! waitQemuPid pid; then
       warn "QEMU PID file does not exist?"
@@ -210,9 +516,11 @@ gracefulShutdown() {
   finish "$code"
 }
 
-! enabled "$SHUTDOWN" && return 0
+enabled "$SHUTDOWN" || return 0
 [ -n "${QEMU_TIMEOUT:-}" ] && TIMEOUT="$QEMU_TIMEOUT"
 
+# Keep Ctrl-C available to interactive users without installing an unnecessary
+# SIGINT handler for background/container execution.
 if interactive; then
   _trap gracefulShutdown SIGINT
 fi

src/samba.sh

@@ -3,6 +3,7 @@ set -Eeuo pipefail
 
 : "${SAMBA:="Y"}"            # Enable Samba
 : "${SAMBA_DEBUG:="N"}"      # Disable debug
+: "${SAMBA_READONLY:="N"}"   # Disable writes
 : "${SAMBA_CONFIG:="/etc/samba/smb.conf"}"
 
 DDN_PID="/var/run/wsdd.pid"
@@ -21,29 +22,32 @@ configureNetwork() {
 
   if enabled "$DHCP"; then
 
-    hostname="$UPLINK"
-    interfaces="$DEV"
+    SAMBA_HOSTNAME="$UPLINK"
+    SAMBA_INTERFACES="$DEV"
 
   else
 
-    hostname="host.lan"
+    SAMBA_HOSTNAME="host.lan"
 
+    # User-mode networking has no host bridge to bind to, so expose Samba only
+    # through loopback and let QEMU's forwarding provide guest access.
     if isUserMode; then
-      interfaces="lo"
+      SAMBA_INTERFACES="lo"
     else
-      interfaces="$BRIDGE"
+      SAMBA_INTERFACES="$BRIDGE"
     fi
 
     if [ -n "${SAMBA_INTERFACE:-}" ]; then
-      interfaces+=",$SAMBA_INTERFACE"
+      SAMBA_INTERFACES+=",$SAMBA_INTERFACE"
     fi
 
   fi
 
-  netbios="${hostname%%.*}"
-  netbios="${netbios:0:15}"
+  # NetBIOS names are limited to 15 visible characters.
+  SAMBA_NETBIOS="${SAMBA_HOSTNAME%%.*}"
+  SAMBA_NETBIOS="${SAMBA_NETBIOS:0:15}"
 
-  [ -z "$netbios" ] && netbios="host"
+  [ -z "$SAMBA_NETBIOS" ] && SAMBA_NETBIOS="host"
 
   return 0
 }
@@ -87,7 +91,10 @@ addShare() {
   local name="$3"
   local comment="$4"
   local cfg="$5"
-  local owner
+  local owner probe
+  local empty="N"
+  local writable="N"
+  local readonly="N"
   local tmp="/tmp/smb"
 
   if [ ! -d "$dir" ]; then
@@ -102,13 +109,53 @@ addShare() {
     error "$msg" && return 1
   fi
 
-  if [ ! -w "$dir" ]; then
-    local msg="shared folder ($dir) is not writeable!"
-    warn "$msg"
+  if [ -z "$(ls -A "$dir")" ]; then
+    empty="Y"
   fi
 
-  if [ -z "$(ls -A "$dir")" ]; then
+  # The generated fallback share contains only instructions and must never be
+  # writable from the guest.
+  if [[ "$dir" == "$tmp" ]]; then
 
+    readonly="Y"
+
+  elif enabled "$SAMBA_READONLY"; then
+
+    readonly="Y"
+
+  # Test actual write access instead of relying on mount flags or mode bits,
+  # which may not reflect bind-mount and host filesystem restrictions.
+  elif probe=$(mktemp "$dir/.samba-write-test.XXXXXX" 2>/dev/null); then
+
+    writable="Y"
+
+    if ! rm -f "$probe"; then
+      error "Failed to remove write test file ($probe)."
+      return 1
+    fi
+
+  # Empty bind mounts are safe to initialize with shared-directory permissions.
+  # Retry the write probe afterward because the original mode may have blocked it.
+  elif [[ "$empty" == "Y" ]] && chmod 2777 "$dir" 2>/dev/null; then
+
+    if probe=$(mktemp "$dir/.samba-write-test.XXXXXX" 2>/dev/null); then
+
+      writable="Y"
+
+      if ! rm -f "$probe"; then
+        error "Failed to remove write test file ($probe)."
+        return 1
+      fi
+
+    fi
+
+  fi
+
+  if [[ "$writable" == "Y" ]]; then
+
+    if [[ "$empty" == "Y" ]]; then
+
+      # Keep newly created content in the shared group through the setgid bit.
       if ! chmod 2777 "$dir"; then
         error "Failed to set permissions for directory $dir" && return 1
       fi
@@ -118,6 +165,8 @@ addShare() {
         return 1
       fi
 
+      # Docker commonly creates a missing bind source as root. Transfer an empty
+      # directory to the default non-root owner used for shared content.
       if [[ "$owner" == "0" ]]; then
         if ! chown "1000:1000" "$dir"; then
           error "Failed to set ownership for directory $dir" && return 1
@@ -126,6 +175,13 @@ addShare() {
 
     fi
 
+  elif [[ "$readonly" != "Y" ]]; then
+
+    # Preserve access to non-writable mounts by exporting them read-only.
+    readonly="Y"
+
+  fi
+
   if [[ "$dir" == "$tmp" ]]; then
     writeReadme "$dir" "$ref" || return 1
   fi
@@ -135,7 +191,13 @@ addShare() {
     echo "[$name]"
     echo "    path = $dir"
     echo "    comment = $comment"
-    echo "    writable = yes"
+
+    if [[ "$readonly" == "Y" ]]; then
+      echo "    read only = yes"
+    else
+      echo "    read only = no"
+    fi
+
     echo "    guest ok = yes"
     echo "    guest only = yes"
   } >> "$cfg"; then
@@ -151,20 +213,27 @@ writeConfig() {
   if ! {
     echo "[global]"
     echo "    server string = Dockur"
-    echo "    netbios name = $netbios"
+    echo "    netbios name = $SAMBA_NETBIOS"
     echo "    workgroup = WORKGROUP"
-    echo "    interfaces = $interfaces"
+    echo "    interfaces = $SAMBA_INTERFACES"
     echo "    bind interfaces only = yes"
     echo "    security = user"
     echo "    guest account = nobody"
     echo "    map to guest = Bad User"
+
+    # Retain SMB1 negotiation for legacy Windows guests.
     echo "    server min protocol = NT1"
+
+    # Allow bind-mounted shares to follow symlinks outside their share root.
     echo "    follow symlinks = yes"
     echo "    wide links = yes"
     echo "    unix extensions = no"
     echo "    inherit owner = yes"
     echo "    create mask = 0666"
     echo "    directory mask = 02777"
+
+    # Perform guest filesystem access as root so bind mounts with differing host
+    # ownership remain usable; share-level read-only checks still apply.
     echo "    force user = root"
     echo "    force group = root"
     echo "    force create mode = 0666"
@@ -192,11 +261,13 @@ selectPrimaryShare() {
     return 1
   fi
 
-  share="/shared"
-  [ ! -d "$share" ] && [ -d "$STORAGE/shared" ] && share="$STORAGE/shared"
-  [ ! -d "$share" ] && [ -d "/data" ] && share="/data"
-  [ ! -d "$share" ] && [ -d "$STORAGE/data" ] && share="$STORAGE/data"
-  [ ! -d "$share" ] && share="$tmp"
+  # Prefer explicit root-level bind mounts, then storage-local compatibility
+  # paths. When none exist, publish an instructional read-only share.
+  SAMBA_SHARE="/shared"
+  [ ! -d "$SAMBA_SHARE" ] && [ -d "$STORAGE/shared" ] && SAMBA_SHARE="$STORAGE/shared"
+  [ ! -d "$SAMBA_SHARE" ] && [ -d "/data" ] && SAMBA_SHARE="/data"
+  [ ! -d "$SAMBA_SHARE" ] && [ -d "$STORAGE/data" ] && SAMBA_SHARE="$STORAGE/data"
+  [ ! -d "$SAMBA_SHARE" ] && SAMBA_SHARE="$tmp"
 
   return 0
 }
@@ -207,6 +278,8 @@ addOptionalShare() {
   local ref="/shared$index"
   local name="Data$index"
 
+  # Optional shares are best-effort and must not prevent the primary share or
+  # Samba service from starting.
   if [ -d "$ref" ]; then
     addShare "$ref" "$ref" "$name" "Shared" "$SAMBA_CONFIG" || :
   elif [ -d "/data$index" ]; then
@@ -218,13 +291,13 @@ addOptionalShare() {
 
 prepareSambaDirs() {
 
-  # Create directories if missing
   mkdir -p \
     /var/lib/samba/sysvol \
     /var/lib/samba/private \
     /var/lib/samba/bind-dns || return 1
 
-  # Try to repair Samba permissions
+  # Runtime directories may retain restrictive modes from earlier daemon runs
+  # or package defaults, so repair only the known Samba lock and core paths.
   [ -d /run/samba/msg.lock ] && chmod -R 0755 /run/samba/msg.lock 2>/dev/null || :
   [ -d /var/log/samba/cores ] && chmod -R 0700 /var/log/samba/cores 2>/dev/null || :
   [ -d /var/cache/samba/msg.lock ] && chmod -R 0755 /var/cache/samba/msg.lock 2>/dev/null || :
@@ -251,6 +324,8 @@ startDaemon() {
 
   rm -f "$log" || :
 
+  # Keep initialization alive after a daemon startup failure so its log can be
+  # streamed and the actual Samba error remains visible to the user.
   if ! "$@"; then
     SAMBA_DEBUG="Y"
     error "Failed to start $name daemon!"
@@ -270,7 +345,6 @@ startSamba() {
 
 startNetbios() {
 
-  # Enable NetBIOS on Windows 7 and lower
   enabled "$DEBUG" && echo "Starting NetBIOS daemon..."
 
   startDaemon "NetBIOS" "/var/log/samba/log.nmbd" \
@@ -281,11 +355,12 @@ startNetbios() {
 
 startWsddn() {
 
-  # Enable Web Service Discovery on Vista and up
   enabled "$DEBUG" && echo "Starting wsddn daemon..."
 
+  # wsddn accepts one interface, while Samba may bind to an additional
+  # user-supplied interface as well.
   startDaemon "wsddn" "/var/log/wsddn.log" \
-    wsddn -i "${interfaces%%,*}" -H "$hostname" \
+    wsddn -i "${SAMBA_INTERFACES%%,*}" -H "$SAMBA_HOSTNAME" \
       --unixd --log-file=/var/log/wsddn.log --pid-file="$DDN_PID"
 
   return 0
@@ -297,19 +372,22 @@ html "Initializing shared folder..."
 enabled "$DEBUG" && echo "Starting Samba daemon..."
 
 writeConfig || return 0
-
-# Add shared folders
 selectPrimaryShare || return 0
 
-addShare "$share" "/shared" "Data" "Shared" "$SAMBA_CONFIG" || return 0
+addShare "$SAMBA_SHARE" "/shared" "Data" "Shared" "$SAMBA_CONFIG" || return 0
 addOptionalShare "2" || :
 addOptionalShare "3" || :
 
 prepareSambaDirs || return 0
 
 startSamba || return 0
+
+# User-mode networking does not expose a LAN interface where discovery
+# broadcasts would be useful.
 isUserMode && return 0
 
+# Older Windows versions discover shares through NetBIOS, while modern Windows
+# uses Web Services Discovery.
 if [[ "${BOOT_MODE:-}" == "windows_legacy" ]]; then
   startNetbios || :
 else