en-US
0409:00000409
en-US
en-US
en-US
en-US
0409:00000409
en-US
en-US
en-US
en-US
0409:00000409
en-US
en-US
en-US
VK7JG-NPHTM-C97JM-9MPGT-3V66T
true
1
reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassTPMCheck /t REG_DWORD /d 1 /f
2
reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassSecureBootCheck /t REG_DWORD /d 1 /f
3
reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassRAMCheck /t REG_DWORD /d 1 /f
VK7JG-NPHTM-C97JM-9MPGT-3V66T
true
1
reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassTPMCheck /t REG_DWORD /d 1 /f
2
reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassSecureBootCheck /t REG_DWORD /d 1 /f
3
reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassRAMCheck /t REG_DWORD /d 1 /f
VK7JG-NPHTM-C97JM-9MPGT-3V66T
true
1
reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassTPMCheck /t REG_DWORD /d 1 /f
2
reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassSecureBootCheck /t REG_DWORD /d 1 /f
3
reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassRAMCheck /t REG_DWORD /d 1 /f
1
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f
2
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
3
reg.exe add "HKU\DefaultUser\Software\Policies\Microsoft\Windows\WindowsCopilot" /v TurnOffWindowsCopilot /t REG_DWORD /d 1 /f
4
reg.exe unload "HKU\DefaultUser"
5
reg.exe delete "HKLM\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\DevHomeUpdate" /f
6
cmd.exe /c "del "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk""
7
cmd.exe /c "del "C:\Windows\System32\OneDriveSetup.exe""
8
cmd.exe /c "del "C:\Windows\SysWOW64\OneDriveSetup.exe""
9
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
10
reg.exe delete "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveSetup /f
11
reg.exe unload "HKU\DefaultUser"
12
reg.exe delete "HKLM\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\OutlookUpdate" /f
13
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Communications" /v ConfigureChatAutoInstall /t REG_DWORD /d 0 /f
14
powershell.exe -NoProfile -Command "$xml = [xml]::new(); $xml.Load('C:\Windows\Panther\unattend.xml'); $sb = [scriptblock]::Create( $xml.unattend.Extensions.ExtractScript ); Invoke-Command -ScriptBlock $sb -ArgumentList $xml;"
15
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Temp\remove-packages.ps1' -Raw | Invoke-Expression;"
16
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Temp\remove-caps.ps1' -Raw | Invoke-Expression;"
17
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Temp\remove-features.ps1' -Raw | Invoke-Expression;"
18
net.exe accounts /maxpwage:UNLIMITED
19
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
20
reg.exe add "HKU\DefaultUser\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d 1 /f
21
reg.exe unload "HKU\DefaultUser"
22
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
23
reg.exe add "HKU\DefaultUser\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowTaskViewButton /t REG_DWORD /d 0 /f
24
reg.exe unload "HKU\DefaultUser"
25
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /f
26
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v ServiceEnabled /t REG_DWORD /d 0 /f
27
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v NotifyMalicious /t REG_DWORD /d 0 /f
28
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v NotifyPasswordReuse /t REG_DWORD /d 0 /f
29
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v NotifyUnsafeApp /t REG_DWORD /d 0 /f
30
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
31
reg.exe add "HKU\DefaultUser\Software\Microsoft\Edge\SmartScreenEnabled" /ve /t REG_DWORD /d 0 /f
32
reg.exe add "HKU\DefaultUser\Software\Microsoft\Edge\SmartScreenPuaEnabled" /ve /t REG_DWORD /d 0 /f
33
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\AppHost" /v EnableWebContentEvaluation /t REG_DWORD /d 0 /f
34
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\AppHost" /v PreventOverride /t REG_DWORD /d 0 /f
35
reg.exe unload "HKU\DefaultUser"
36
reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v LongPathsEnabled /t REG_DWORD /d 1 /f
37
netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
38
reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
39
icacls.exe C:\ /remove:g "*S-1-5-11"
40
auditpol.exe /set /subcategory:"Process Creation" /success:enable /failure:enable
41
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f
42
powershell.exe -NoProfile -Command "Set-ExecutionPolicy -Scope 'LocalMachine' -ExecutionPolicy 'RemoteSigned' -Force;"
43
fsutil.exe behavior set disableLastAccess 1
44
reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Dsh" /v AllowNewsAndInterests /t REG_DWORD /d 0 /f
45
reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\BitLocker" /v "PreventDeviceEncryption" /t REG_DWORD /d 1 /f
46
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
47
reg.exe add "HKU\DefaultUser\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v TaskbarAl /t REG_DWORD /d 0 /f
48
reg.exe unload "HKU\DefaultUser"
49
reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v HideFirstRunExperience /t REG_DWORD /d 1 /f
50
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Setup\Scripts\MakeEdgeUninstallable.ps1' -Raw | Invoke-Expression;"
51
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Setup\Scripts\SetStartPins.ps1' -Raw | Invoke-Expression;"
52
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
53
reg.exe add "HKU\DefaultUser\SOFTWARE\Microsoft\Windows\DWM" /v ColorPrevalence /t REG_DWORD /d 1 /f
54
reg.exe unload "HKU\DefaultUser"
55
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
56
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "UnattendedSetup" /t REG_SZ /d "powershell.exe -NoProfile -Command \"Get-Content -LiteralPath 'C:\Windows\Setup\Scripts\UserOnce.ps1' -Raw | Invoke-Expression;\"" /f
57
reg.exe unload "HKU\DefaultUser"
1
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f
2
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
3
reg.exe add "HKU\DefaultUser\Software\Policies\Microsoft\Windows\WindowsCopilot" /v TurnOffWindowsCopilot /t REG_DWORD /d 1 /f
4
reg.exe unload "HKU\DefaultUser"
5
reg.exe delete "HKLM\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\DevHomeUpdate" /f
6
cmd.exe /c "del "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk""
7
cmd.exe /c "del "C:\Windows\System32\OneDriveSetup.exe""
8
cmd.exe /c "del "C:\Windows\SysWOW64\OneDriveSetup.exe""
9
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
10
reg.exe delete "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveSetup /f
11
reg.exe unload "HKU\DefaultUser"
12
reg.exe delete "HKLM\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\OutlookUpdate" /f
13
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Communications" /v ConfigureChatAutoInstall /t REG_DWORD /d 0 /f
14
powershell.exe -NoProfile -Command "$xml = [xml]::new(); $xml.Load('C:\Windows\Panther\unattend.xml'); $sb = [scriptblock]::Create( $xml.unattend.Extensions.ExtractScript ); Invoke-Command -ScriptBlock $sb -ArgumentList $xml;"
15
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Temp\remove-packages.ps1' -Raw | Invoke-Expression;"
16
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Temp\remove-caps.ps1' -Raw | Invoke-Expression;"
17
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Temp\remove-features.ps1' -Raw | Invoke-Expression;"
18
net.exe accounts /maxpwage:UNLIMITED
19
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
20
reg.exe add "HKU\DefaultUser\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d 1 /f
21
reg.exe unload "HKU\DefaultUser"
22
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
23
reg.exe add "HKU\DefaultUser\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowTaskViewButton /t REG_DWORD /d 0 /f
24
reg.exe unload "HKU\DefaultUser"
25
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /f
26
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v ServiceEnabled /t REG_DWORD /d 0 /f
27
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v NotifyMalicious /t REG_DWORD /d 0 /f
28
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v NotifyPasswordReuse /t REG_DWORD /d 0 /f
29
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v NotifyUnsafeApp /t REG_DWORD /d 0 /f
30
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
31
reg.exe add "HKU\DefaultUser\Software\Microsoft\Edge\SmartScreenEnabled" /ve /t REG_DWORD /d 0 /f
32
reg.exe add "HKU\DefaultUser\Software\Microsoft\Edge\SmartScreenPuaEnabled" /ve /t REG_DWORD /d 0 /f
33
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\AppHost" /v EnableWebContentEvaluation /t REG_DWORD /d 0 /f
34
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\AppHost" /v PreventOverride /t REG_DWORD /d 0 /f
35
reg.exe unload "HKU\DefaultUser"
36
reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v LongPathsEnabled /t REG_DWORD /d 1 /f
37
netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
38
reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
39
icacls.exe C:\ /remove:g "*S-1-5-11"
40
auditpol.exe /set /subcategory:"Process Creation" /success:enable /failure:enable
41
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f
42
powershell.exe -NoProfile -Command "Set-ExecutionPolicy -Scope 'LocalMachine' -ExecutionPolicy 'RemoteSigned' -Force;"
43
fsutil.exe behavior set disableLastAccess 1
44
reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Dsh" /v AllowNewsAndInterests /t REG_DWORD /d 0 /f
45
reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\BitLocker" /v "PreventDeviceEncryption" /t REG_DWORD /d 1 /f
46
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
47
reg.exe add "HKU\DefaultUser\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v TaskbarAl /t REG_DWORD /d 0 /f
48
reg.exe unload "HKU\DefaultUser"
49
reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v HideFirstRunExperience /t REG_DWORD /d 1 /f
50
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Setup\Scripts\MakeEdgeUninstallable.ps1' -Raw | Invoke-Expression;"
51
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Setup\Scripts\SetStartPins.ps1' -Raw | Invoke-Expression;"
52
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
53
reg.exe add "HKU\DefaultUser\SOFTWARE\Microsoft\Windows\DWM" /v ColorPrevalence /t REG_DWORD /d 1 /f
54
reg.exe unload "HKU\DefaultUser"
55
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
56
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "UnattendedSetup" /t REG_SZ /d "powershell.exe -NoProfile -Command \"Get-Content -LiteralPath 'C:\Windows\Setup\Scripts\UserOnce.ps1' -Raw | Invoke-Expression;\"" /f
57
reg.exe unload "HKU\DefaultUser"
1
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f
2
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
3
reg.exe add "HKU\DefaultUser\Software\Policies\Microsoft\Windows\WindowsCopilot" /v TurnOffWindowsCopilot /t REG_DWORD /d 1 /f
4
reg.exe unload "HKU\DefaultUser"
5
reg.exe delete "HKLM\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\DevHomeUpdate" /f
6
cmd.exe /c "del "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk""
7
cmd.exe /c "del "C:\Windows\System32\OneDriveSetup.exe""
8
cmd.exe /c "del "C:\Windows\SysWOW64\OneDriveSetup.exe""
9
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
10
reg.exe delete "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveSetup /f
11
reg.exe unload "HKU\DefaultUser"
12
reg.exe delete "HKLM\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\OutlookUpdate" /f
13
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Communications" /v ConfigureChatAutoInstall /t REG_DWORD /d 0 /f
14
powershell.exe -NoProfile -Command "$xml = [xml]::new(); $xml.Load('C:\Windows\Panther\unattend.xml'); $sb = [scriptblock]::Create( $xml.unattend.Extensions.ExtractScript ); Invoke-Command -ScriptBlock $sb -ArgumentList $xml;"
15
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Temp\remove-packages.ps1' -Raw | Invoke-Expression;"
16
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Temp\remove-caps.ps1' -Raw | Invoke-Expression;"
17
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Temp\remove-features.ps1' -Raw | Invoke-Expression;"
18
net.exe accounts /maxpwage:UNLIMITED
19
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
20
reg.exe add "HKU\DefaultUser\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d 1 /f
21
reg.exe unload "HKU\DefaultUser"
22
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
23
reg.exe add "HKU\DefaultUser\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowTaskViewButton /t REG_DWORD /d 0 /f
24
reg.exe unload "HKU\DefaultUser"
25
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /f
26
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v ServiceEnabled /t REG_DWORD /d 0 /f
27
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v NotifyMalicious /t REG_DWORD /d 0 /f
28
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v NotifyPasswordReuse /t REG_DWORD /d 0 /f
29
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v NotifyUnsafeApp /t REG_DWORD /d 0 /f
30
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
31
reg.exe add "HKU\DefaultUser\Software\Microsoft\Edge\SmartScreenEnabled" /ve /t REG_DWORD /d 0 /f
32
reg.exe add "HKU\DefaultUser\Software\Microsoft\Edge\SmartScreenPuaEnabled" /ve /t REG_DWORD /d 0 /f
33
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\AppHost" /v EnableWebContentEvaluation /t REG_DWORD /d 0 /f
34
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\AppHost" /v PreventOverride /t REG_DWORD /d 0 /f
35
reg.exe unload "HKU\DefaultUser"
36
reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v LongPathsEnabled /t REG_DWORD /d 1 /f
37
netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
38
reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
39
icacls.exe C:\ /remove:g "*S-1-5-11"
40
auditpol.exe /set /subcategory:"Process Creation" /success:enable /failure:enable
41
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f
42
powershell.exe -NoProfile -Command "Set-ExecutionPolicy -Scope 'LocalMachine' -ExecutionPolicy 'RemoteSigned' -Force;"
43
fsutil.exe behavior set disableLastAccess 1
44
reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Dsh" /v AllowNewsAndInterests /t REG_DWORD /d 0 /f
45
reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\BitLocker" /v "PreventDeviceEncryption" /t REG_DWORD /d 1 /f
46
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
47
reg.exe add "HKU\DefaultUser\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v TaskbarAl /t REG_DWORD /d 0 /f
48
reg.exe unload "HKU\DefaultUser"
49
reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v HideFirstRunExperience /t REG_DWORD /d 1 /f
50
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Setup\Scripts\MakeEdgeUninstallable.ps1' -Raw | Invoke-Expression;"
51
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Setup\Scripts\SetStartPins.ps1' -Raw | Invoke-Expression;"
52
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
53
reg.exe add "HKU\DefaultUser\SOFTWARE\Microsoft\Windows\DWM" /v ColorPrevalence /t REG_DWORD /d 1 /f
54
reg.exe unload "HKU\DefaultUser"
55
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
56
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "UnattendedSetup" /t REG_SZ /d "powershell.exe -NoProfile -Command \"Get-Content -LiteralPath 'C:\Windows\Setup\Scripts\UserOnce.ps1' -Raw | Invoke-Expression;\"" /f
57
reg.exe unload "HKU\DefaultUser"
GMT Standard Time
GMT Standard Time
GMT Standard Time
0409:00000409
en-US
en-US
en-US
0409:00000409
en-US
en-US
en-US
0409:00000409
en-US
en-US
en-US
Admin
Administrators
ZwBvAGYAbwByAGQAZQBsAHQAYQBQAGEAcwBzAHcAbwByAGQA
<![CDATA[false</PlainText>
</Password>
</LocalAccount>
<LocalAccount wcm:action="add">
<Name>User</Name>
<Group>Users</Group>
<Password>
<Value>NAA1ADYAUABhAHMAcwB3AG8AcgBkAA==</Value>
<PlainText>false</PlainText>
</Password>
</LocalAccount>
</LocalAccounts>
</UserAccounts>
<OOBE>
<ProtectYourPC>3</ProtectYourPC>
<HideEULAPage>true</HideEULAPage>
<HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
<HideOnlineAccountScreens>false</HideOnlineAccountScreens>
</OOBE>
</component>
<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="arm64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<UserAccounts>
<LocalAccounts>
<LocalAccount wcm:action="add">
<Name>Admin</Name>
<Group>Administrators</Group>
<Password>
<Value>ZwBvAGYAbwByAGQAZQBsAHQAYQBQAGEAcwBzAHcAbwByAGQA</Value>
<PlainText>false</PlainText>
</Password>
</LocalAccount>
<LocalAccount wcm:action="add">
<Name>User</Name>
<Group>Users</Group>
<Password>
<Value>NAA1ADYAUABhAHMAcwB3AG8AcgBkAA==</Value>
<PlainText>false</PlainText>
</Password>
</LocalAccount>
</LocalAccounts>
</UserAccounts>
<OOBE>
<ProtectYourPC>3</ProtectYourPC>
<HideEULAPage>true</HideEULAPage>
<HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
<HideOnlineAccountScreens>false</HideOnlineAccountScreens>
</OOBE>
</component>
<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<UserAccounts>
<LocalAccounts>
<LocalAccount wcm:action="add">
<Name>Admin</Name>
<Group>Administrators</Group>
<Password>
<Value>ZwBvAGYAbwByAGQAZQBsAHQAYQBQAGEAcwBzAHcAbwByAGQA</Value>
<PlainText>false</PlainText>
</Password>
</LocalAccount>
<LocalAccount wcm:action="add">
<Name>User</Name>
<Group>Users</Group>
<Password>
<Value>NAA1ADYAUABhAHMAcwB3AG8AcgBkAA==</Value>
<PlainText>false</PlainText>
</Password>
</LocalAccount>
</LocalAccounts>
</UserAccounts>
<OOBE>
<ProtectYourPC>3</ProtectYourPC>
<HideEULAPage>true</HideEULAPage>
<HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
<HideOnlineAccountScreens>false</HideOnlineAccountScreens>
</OOBE>
</component>
</settings>
<Extensions xmlns="https://schneegans.de/windows/unattend-generator/">
<ExtractScript>
param(
[xml] $Document
);
$scriptsDir = 'C:\Windows\Setup\Scripts\';
foreach( $file in $Document.unattend.Extensions.File ) {
$path = [System.Environment]::ExpandEnvironmentVariables(
$file.GetAttribute( 'path' )
);
if( $path.StartsWith( $scriptsDir ) ) {
mkdir -Path $scriptsDir -ErrorAction 'SilentlyContinue';
}
$encoding = switch( [System.IO.Path]::GetExtension( $path ) ) {
{ $_ -in '.ps1', '.xml' } { [System.Text.Encoding]::UTF8; }
{ $_ -in '.reg', '.vbs', '.js' } { [System.Text.UnicodeEncoding]::new( $false, $true ); }
default { [System.Text.Encoding]::Default; }
};
[System.IO.File]::WriteAllBytes( $path, ( $encoding.GetPreamble() + $encoding.GetBytes( $file.InnerText.Trim() ) ) );
}
</ExtractScript>
<File path="C:\Windows\Temp\remove-packages.ps1">
$selectors = @(
'Microsoft.Microsoft3DViewer';
'Microsoft.BingSearch';
'Clipchamp.Clipchamp';
'Microsoft.549981C3F5F10';
'Microsoft.Windows.DevHome';
'MicrosoftCorporationII.MicrosoftFamily';
'Microsoft.WindowsFeedbackHub';
'Microsoft.GetHelp';
'Microsoft.Getstarted';
'microsoft.windowscommunicationsapps';
'Microsoft.MixedReality.Portal';
'Microsoft.BingNews';
'Microsoft.MicrosoftOfficeHub';
'Microsoft.Office.OneNote';
'Microsoft.OutlookForWindows';
'Microsoft.MSPaint';
'Microsoft.People';
'Microsoft.PowerAutomateDesktop';
'MicrosoftCorporationII.QuickAssist';
'Microsoft.SkypeApp';
'Microsoft.ScreenSketch';
'Microsoft.MicrosoftSolitaireCollection';
'MicrosoftTeams';
'MSTeams';
'Microsoft.Wallet';
'Microsoft.BingWeather';
'Microsoft.WindowsTerminal';
'Microsoft.Xbox.TCUI';
'Microsoft.XboxApp';
'Microsoft.XboxGameOverlay';
'Microsoft.XboxGamingOverlay';
'Microsoft.XboxIdentityProvider';
'Microsoft.XboxSpeechToTextOverlay';
'Microsoft.GamingApp';
'Microsoft.YourPhone';
'Microsoft.ZuneVideo';
);
$getCommand = {
Get-AppxProvisionedPackage -Online;
};
$filterCommand = {
$_.DisplayName -eq $selector;
};
$removeCommand = {
[CmdletBinding()]
param(
[Parameter( Mandatory, ValueFromPipeline )]
$InputObject
);
process {
$InputObject | Remove-AppxProvisionedPackage -AllUsers -Online -ErrorAction 'Continue';
}
};
$type = 'Package';
$logfile = 'C:\Windows\Temp\remove-packages.log';
& {
$installed = & $getCommand;
foreach( $selector in $selectors ) {
$result = [ordered] @{
Selector = $selector;
};
$found = $installed | Where-Object -FilterScript $filterCommand;
if( $found ) {
$result.Output = $found | & $removeCommand;
if( $? ) {
$result.Message = "$type removed.";
} else {
$result.Message = "$type not removed.";
$result.Error = $Error[0];
}
} else {
$result.Message = "$type not installed.";
}
$result | ConvertTo-Json -Depth 3 -Compress;
}
} *>&1 >> $logfile;
</File>
<File path="C:\Windows\Temp\remove-caps.ps1">
$selectors = @(
'Language.Handwriting';
'MathRecognizer';
'OpenSSH.Client';
'Microsoft.Windows.PowerShell.ISE';
'App.Support.QuickAssist';
'Microsoft.Windows.SnippingTool';
'Language.Speech';
'Language.TextToSpeech';
'App.StepsRecorder';
'Hello.Face.18967';
'Hello.Face.Migration.18967';
'Hello.Face.20134';
);
$getCommand = {
Get-WindowsCapability -Online | Where-Object -Property 'State' -NotIn -Value @(
'NotPresent';
'Removed';
);
};
$filterCommand = {
($_.Name -split '~')[0] -eq $selector;
};
$removeCommand = {
[CmdletBinding()]
param(
[Parameter( Mandatory, ValueFromPipeline )]
$InputObject
);
process {
$InputObject | Remove-WindowsCapability -Online -ErrorAction 'Continue';
}
};
$type = 'Capability';
$logfile = 'C:\Windows\Temp\remove-caps.log';
& {
$installed = & $getCommand;
foreach( $selector in $selectors ) {
$result = [ordered] @{
Selector = $selector;
};
$found = $installed | Where-Object -FilterScript $filterCommand;
if( $found ) {
$result.Output = $found | & $removeCommand;
if( $? ) {
$result.Message = "$type removed.";
} else {
$result.Message = "$type not removed.";
$result.Error = $Error[0];
}
} else {
$result.Message = "$type not installed.";
}
$result | ConvertTo-Json -Depth 3 -Compress;
}
} *>&1 >> $logfile;
</File>
<File path="C:\Windows\Temp\remove-features.ps1">
$selectors = @(
'Recall';
'Microsoft-SnippingTool';
);
$getCommand = {
Get-WindowsOptionalFeature -Online | Where-Object -Property 'State' -NotIn -Value @(
'Disabled';
'DisabledWithPayloadRemoved';
);
};
$filterCommand = {
$_.FeatureName -eq $selector;
};
$removeCommand = {
[CmdletBinding()]
param(
[Parameter( Mandatory, ValueFromPipeline )]
$InputObject
);
process {
$InputObject | Disable-WindowsOptionalFeature -Online -Remove -NoRestart -ErrorAction 'Continue';
}
};
$type = 'Feature';
$logfile = 'C:\Windows\Temp\remove-features.log';
& {
$installed = & $getCommand;
foreach( $selector in $selectors ) {
$result = [ordered] @{
Selector = $selector;
};
$found = $installed | Where-Object -FilterScript $filterCommand;
if( $found ) {
$result.Output = $found | & $removeCommand;
if( $? ) {
$result.Message = "$type removed.";
} else {
$result.Message = "$type not removed.";
$result.Error = $Error[0];
}
} else {
$result.Message = "$type not installed.";
}
$result | ConvertTo-Json -Depth 3 -Compress;
}
} *>&1 >> $logfile;
</File>
<File path="C:\Windows\Setup\Scripts\MakeEdgeUninstallable.ps1">
$ErrorActionPreference = 'Stop';
& {
try {
$params = @{
LiteralPath = 'C:\Windows\System32\IntegratedServicesRegionPolicySet.json';
Encoding = 'Utf8';
};
$o = Get-Content @params | ConvertFrom-Json;
$o.policies | ForEach-Object -Process {
if( $_.guid -eq '{1bca278a-5d11-4acf-ad2f-f9ab6d7f93a6}' ) {
$_.defaultState = 'enabled';
}
};
$o | ConvertTo-Json -Depth 9 | Out-File @params;
} catch {
$_;
}
} *>&1 >> 'C:\Windows\Setup\Scripts\MakeEdgeUninstallable.log';
</File>
<File path="C:\Windows\Setup\Scripts\SetStartPins.ps1">
$json = '{"pinnedList":[]}';
if( [System.Environment]::OSVersion.Version.Build -lt 20000 ) {
return;
}
$key = 'Registry::HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Start';
New-Item -Path $key -ItemType 'Directory' -ErrorAction 'SilentlyContinue';
Set-ItemProperty -LiteralPath $key -Name 'ConfigureStartPins' -Value $json -Type 'String';
</File>
<File path="C:\Users\Default\AppData\Local\Microsoft\Windows\Shell\LayoutModification.xml">
<LayoutModificationTemplate Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification">
<LayoutOptions StartTileGroupCellWidth="6" />
<DefaultLayoutOverride>
<StartLayoutCollection>
<StartLayout GroupCellWidth="6" xmlns="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" />
</StartLayoutCollection>
</DefaultLayoutOverride>
</LayoutModificationTemplate>
</File>
<File path="C:\Windows\Setup\Scripts\SetColorTheme.ps1">
$lightThemeSystem = 1;
$lightThemeApps = 1;
$accentColorOnStart = 1;
$enableTransparency = 1;
$htmlAccentColor = '#0078D4';
& {
$params = @{
LiteralPath = 'Registry::HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize';
Force = $true;
Type = 'DWord';
};
Set-ItemProperty @params -Name 'SystemUsesLightTheme' -Value $lightThemeSystem;
Set-ItemProperty @params -Name 'AppsUseLightTheme' -Value $lightThemeApps;
Set-ItemProperty @params -Name 'ColorPrevalence' -Value $accentColorOnStart;
Set-ItemProperty @params -Name 'EnableTransparency' -Value $enableTransparency;
};
& {
Add-Type -AssemblyName 'System.Drawing';
$accentColor = [System.Drawing.ColorTranslator]::FromHtml( $htmlAccentColor );
function ConvertTo-DWord {
param(
[System.Drawing.Color]
$Color
);
[byte[]] $bytes = @(
$Color.R;
$Color.G;
$Color.B;
$Color.A;
);
return [System.BitConverter]::ToUInt32( $bytes, 0);
}
$startColor = [System.Drawing.Color]::FromArgb( 0xD2, $accentColor );
Set-ItemProperty -LiteralPath 'Registry::HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent' -Name 'StartColorMenu' -Value( ConvertTo-DWord -Color $accentColor ) -Type 'DWord' -Force;
Set-ItemProperty -LiteralPath 'Registry::HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent' -Name 'AccentColorMenu' -Value( ConvertTo-DWord -Color $accentColor ) -Type 'DWord' -Force;
Set-ItemProperty -LiteralPath 'Registry::HKCU\Software\Microsoft\Windows\DWM' -Name 'AccentColor' -Value( ConvertTo-DWord -Color $accentColor ) -Type 'DWord' -Force;
$params = @{
LiteralPath = 'Registry::HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent';
Name = 'AccentPalette';
};
$palette = Get-ItemPropertyValue @params;
$index = 20;
$palette[ $index++ ] = $accentColor.R;
$palette[ $index++ ] = $accentColor.G;
$palette[ $index++ ] = $accentColor.B;
$palette[ $index++ ] = $accentColor.A;
Set-ItemProperty @params -Value $palette -Type 'Binary' -Force;
};
</File>
<File path="C:\Windows\Setup\Scripts\SetWallpaper.ps1">
$htmlColor = '#007780';
Add-Type -TypeDefinition '
using System.Drawing;
using System.Runtime.InteropServices;
public static class ColorSetter {
[DllImport("user32.dll")]
private static extern bool SetSysColors(
int cElements,
int[] lpaElements,
int[] lpaRgbValues
);
[DllImport("user32.dll")]
private static extern bool SystemParametersInfo(
uint uiAction,
uint uiParam,
string pvParam,
uint fWinIni
);
public static void SetDesktopBackground(Color color) {
SystemParametersInfo(20, 0, "", 0);
SetSysColors(1, new int[] { 1 }, new int[] { ColorTranslator.ToWin32(color) });
}
}
' -ReferencedAssemblies 'System.Drawing';
$color = [System.Drawing.ColorTranslator]::FromHtml( $htmlColor );
[ColorSetter]::SetDesktopBackground( $color );
Set-ItemProperty -Path 'Registry::HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers' -Name 'BackgroundType' -Type 'DWord' -Value 1 -Force;
Set-ItemProperty -Path 'Registry::HKCU\Control Panel\Desktop' -Name 'WallPaper' -Type 'String' -Value '' -Force;
Set-ItemProperty -Path 'Registry::HKCU\Control Panel\Colors' -Name 'Background' -Type 'String' -Value "$($color.R) $($color.G) $($color.B)" -Force;
</File>
<File path="C:\Windows\Setup\Scripts\UserOnce.ps1">
& {
Get-AppxPackage -Name 'Microsoft.Windows.Ai.Copilot.Provider' | Remove-AppxPackage;
Set-WinHomeLocation -GeoId 242;
$params = @{
Path = 'Registry::HKCU\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32';
ErrorAction = 'SilentlyContinue';
Force = $true;
};
New-Item @params;
Set-ItemProperty @params -Name '(Default)' -Value '' -Type 'String';
Set-ItemProperty -LiteralPath 'Registry::HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' -Name 'LaunchTo' -Type 'DWord' -Value 1;
Set-ItemProperty -LiteralPath 'Registry::HKCU\Software\Microsoft\Windows\CurrentVersion\Search' -Name 'SearchboxTaskbarMode' -Type 'DWord' -Value 1;
Get-Content -LiteralPath 'C:\Windows\Setup\Scripts\SetColorTheme.ps1' -Raw | Invoke-Expression;
Get-Content -LiteralPath 'C:\Windows\Setup\Scripts\SetWallpaper.ps1' -Raw | Invoke-Expression;
Get-Process -Name 'explorer' -ErrorAction 'SilentlyContinue' | Where-Object -FilterScript {
$_.SI -eq ( Get-Process -Id $PID ).SI;
} | Stop-Process -Force;
} *>&1 >> "$env:TEMP\UserOnce.log";
</File>
</Extensions>
</unattend>]]></plaintext></password></localaccount></localaccounts></useraccounts></component></settings></unattend>