diff --git a/README.md b/README.md
index 9ff2782..aee0256 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,66 @@
-# Windows OOBE Script
+# Windows OOBE Scripts
 
-First thing to run when logged into windows for the first time.
+Unattended setup for Windows 10 Enterprise LTSC 2021: an answer file installs Windows, then a PowerShell script configures the machine on first logon and restarts it.
 
-`irm https://url.isworking.fyi/oobe | iex`
\ No newline at end of file
+| Variant | Answer file | OOBE script | Disk | ISO |
+|---|---|---|---|---|
+| VMs (Unraid/KVM, VirtIO) | `unattend/vms-WIPE-DISK.xml` | `oobe-vms.ps1` | **Wipes Disk 0 without asking** | `build/virtio-vms.iso` |
+| Desktops, laptops, any VM | `unattend/desktop-PROMPT-DISK.xml` | `oobe-desktop.ps1` | Prompts you to pick the disk/partition | `build/desktop.iso` |
+
+## Run a script by hand
+
+From an elevated PowerShell:
+
+```powershell
+irm https://url.isworking.fyi/oobe-vms | iex
+irm https://url.isworking.fyi/oobe-desktop | iex
+```
+
+The short links point at the raw files on `master`, so pushing a change updates what new installs run. Logs go to `C:\ProgramData\OOBE\oobe-<name>.log`.
+
+## What the scripts do
+
+Both:
+
+- Install the MeshCentral agent silently as a service
+- Enable RDP, ping, the `C$` admin share, and OpenSSH Server (PowerShell as the default shell)
+- Set the network to Private, turn off the UAC prompt, and turn on dark mode with no mouse acceleration (current user and default profile)
+- Install Winget
+- Restart when finished
+
+`oobe-vms.ps1` also:
+
+- Installs the VirtIO drivers, QEMU guest agent and SPICE agent from the mounted virtio-win ISO (downloads them if it isn't mounted)
+- Never sleeps or hibernates (enforced by policy), never turns off the display or disks, and stops Windows powering down the network adapter
+- Enables WinRM and keeps the clock synced
+
+`oobe-desktop.ps1` also:
+
+- Uses the Balanced plan: dims the display after 5 minutes (only works on screens Windows controls the brightness of) and sleeps after 30 minutes
+
+## Build the ISOs
+
+Requires `curl` and `xorriso`:
+
+```sh
+./build-isos.sh
+```
+
+This downloads the latest virtio-win ISO (only when a new release is out) and writes to `build/`, which git ignores:
+
+- `virtio-vms.iso`: virtio-win plus `autounattend.xml` (the VM answer file) and `oobe-vms.ps1`
+- `desktop.iso`: `autounattend.xml` (the desktop answer file) and `oobe-desktop.ps1`
+
+Rerun it after changing an answer file. Changes to the scripts reach new installs through the short links without a rebuild. The copy on the ISO is only used if the download fails.
+
+## Install
+
+**VM (Unraid):** put the LTSC ISO in "OS Install ISO" and `virtio-vms.iso` in "VirtIO Drivers ISO", then boot. Everything is automatic, and **Disk 0 is erased**.
+
+**Desktop:** copy `autounattend.xml` and `oobe-desktop.ps1` from `desktop.iso` to the root of the LTSC install USB. For a VM, attach `desktop.iso` as a second CD instead. Setup stops once to ask where to install; everything else is automatic.
+
+Setup only reads a file named exactly `autounattend.xml` at the root of a disc or USB drive.
+
+## Accounts
+
+Both answer files create a local administrator `labadmin` with the placeholder password `mdwelcome`, stored in plain text. VMs log in automatically every boot; desktops only on the first logon, then show the sign-in screen. Change the password in the answer file before using this for anything that matters.