minor changes

Script.ps1

@@ -0,0 +1,234 @@
+function Show-Menu {
+    param (
+        [string]$Title = "ChromaWIN - OOBE and Apps Setup"
+    )
+    
+    Clear-Host
+    
+    # ASCII Art Title
+    Write-Host @"
+
+   _____ _                            __          _______ _   _ 
+  / ____| |                           \ \        / /_   _| \ | |
+ | |    | |__  _ __ ___  _ __ ___   __ \ \  /\  / /  | | |  \| |
+ | |    | '_ \| '__/ _ \| '_ ` _ \ / _` \ \/  \/ /   | | | . ` |
+ | |____| | | | | | (_) | | | | | | (_| |\  /\  /   _| |_| |\  |
+  \_____|_| |_|_|  \___/|_| |_| |_|\__,_| \/  \/   |_____|_| \_|
+                                                                
+
+"@ -ForegroundColor Cyan
+    
+    # Brief description
+    Write-Host "`nEasy and clean OOBE setup. For Chroma domain use ONLY." -ForegroundColor Yellow
+    Write-Host "`nPLEASE READ THE FULL DESCRIPTION. I AM NOT RESPONSIBLE FOR ANY DAMAGE TO YOUR SYSTEM! YOU HAVE BEEN WARNED!" -ForegroundColor Yellow
+    
+    # Longer explanation
+    Write-Host @"
+
+1: Run the full script.
+    Will configure the following:
+        - Allow ICMP Echo Requests inbound
+        - Enable Dark Mode
+        - Disable Mouse Acceleration
+        - Allow Remote Desktop
+        - Enable c$ directory viewing
+        - Disable UAC prompt
+        - Disable sleep, enable hibernation, and display black after 30 minutes
+        - Enable high performance mode
+
+    Will install the following:
+        - RMM software
+        - Winget
+        - OpenSSH
+2: Will display System Information
+3: Just activate Windows.
+4. Just install apps.
+
+"@ -ForegroundColor White
+    
+    # Draw a line
+    Write-Host "`n----------------------------------------" -ForegroundColor DarkGray
+    
+    # Menu options
+    Write-Host "`nAvailable Options:" -ForegroundColor Green
+    Write-Host "1: Full Setup" -ForegroundColor White
+    Write-Host "2: Check System Information" -ForegroundColor White
+    Write-Host "3: Activate Windows" -ForegroundColor White
+    Write-Host "4: Install Apps" -ForegroundColor White
+    Write-Host "5: Exit" -ForegroundColor White
+    
+    Write-Host "`n----------------------------------------" -ForegroundColor DarkGray
+}
+
+function Run-Full-Script {
+    Write-Host "Running full script..." -ForegroundColor Green
+    # Check if running with elevated privileges
+    if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    Write-Host "Please run this script as an administrator."
+    Exit
+    }
+
+    # Enable ping (ICMP Echo) requests
+    New-NetFirewallRule -DisplayName "Allow ICMP Echo Request" -Protocol ICMPv4 -IcmpType 8 -Enabled True
+
+    # Turn on Dark Mode
+    New-ItemProperty -Path HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize -Name AppsUseLightTheme -Value 0 -PropertyType DWORD -Force
+
+    # Disable Mouse Acceleration
+    Set-ItemProperty -Path "HKCU:\Control Panel\Mouse" -Name MouseSensitivity -Value 0
+
+    # Allow Remote Desktop
+    Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0
+    Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
+
+    # Enable c$
+    Write-Host "Enabling Administrative Shares..." -ForegroundColor Green
+    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "LocalAccountTokenFilterPolicy" -Value 1 -Type DWord -Force
+    Write-Host "Configuring Windows Firewall..." -ForegroundColor Green
+    Enable-NetFirewallRule -DisplayGroup "File and Printer Sharing"
+    Enable-NetFirewallRule -DisplayGroup "Windows Management Instrumentation (WMI)"
+    Write-Host "Enabling SMB File Sharing..." -ForegroundColor Green
+    Enable-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol" -NoRestart
+    Write-Host "Restarting the Server service..." -ForegroundColor Green
+    Restart-Service -Name "LanmanServer" -Force
+    Write-Host "Enabling Network Discovery..." -ForegroundColor Green
+    netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
+    Write-Host "Verifying C$ administrative share..." -ForegroundColor Green
+    $shares = Get-WmiObject -Class Win32_Share
+    if ($shares | Where-Object { $_.Name -eq "C$" }) {
+        Write-Host "The C$ administrative share is enabled!" -ForegroundColor Green
+    } else {
+        Write-Host "Creating C$ administrative share..." -ForegroundColor Yellow
+        $computer = [wmiclass]"Win32_Share"
+        $computer.Create("C:\", "C$", 0)
+    }
+
+
+    # Disable UAC prompt
+    Set-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\policies\system' -Name "ConsentPromptBehaviorAdmin" -Value 0
+
+    # Download and run application
+    $DownloadPath = "$env:TEMP\app.exe"
+    Invoke-WebRequest -Uri "https://rmm.iamchrisama.com/meshagents?id=4&meshid=zxl@U2zM95zh9ZNqah@9mUEjCJ3ptGOE6s5cjsGniacVU1fjRXtVKCKlKJN4aJQW&installflags=0" -OutFile $DownloadPath
+    Start-Process -FilePath $DownloadPath -Wait
+
+    # Run commands in new PowerShell instance
+    # Start-Process powershell.exe -ArgumentList "-NoProfile -Command {irm https://massgrave.dev/get | iex}"
+    # Start-Process powershell.exe -ArgumentList "-NoProfile -Command {irm https://christitus.com/win | iex}"
+
+    # Disable sleep and enable high performance mode, enable hibernation, and display black after 30 minutes
+    powercfg -change -standby-timeout-ac 0
+    powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
+    powercfg /hibernate on
+    powercfg -change -monitor-timeout-ac 30
+
+    # Install Winget
+    #Add-AppxPackage -RegisterByFamilyName -MainPackage Microsoft.DesktopAppInstaller_8wekyb3d8bbwe
+    irm https://github.com/asheroto/winget-install/releases/latest/download/winget-install.ps1 | iex
+
+    # Install OpenSSH
+    Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'
+    Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0
+    Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
+
+    Start-Service sshd
+
+    Set-Service -Name sshd -StartupType 'Automatic'
+
+    if (!(Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue | Select-Object Name, Enabled)) {
+    Write-Output "Firewall Rule 'OpenSSH-Server-In-TCP' does not exist, creating it..."
+    New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
+    } else {
+    Write-Output "Firewall rule 'OpenSSH-Server-In-TCP' has been created and exists."
+    }
+}
+
+function Get-SystemInformation {
+    Write-Host "`nGathering system information..." -ForegroundColor Yellow
+    
+    $computerInfo = Get-ComputerInfo
+    Write-Host "`nSystem Information:" -ForegroundColor Green
+    Write-Host "OS: $($computerInfo.OsName) $($computerInfo.OsVersion)" -ForegroundColor White
+    Write-Host "Computer Name: $($computerInfo.CsName)" -ForegroundColor White
+    Write-Host "Manufacturer: $($computerInfo.CsManufacturer)" -ForegroundColor White
+    Write-Host "Model: $($computerInfo.CsModel)" -ForegroundColor White
+    Write-Host "Processor: $($computerInfo.CsProcessors.Name)" -ForegroundColor White
+    Write-Host "Memory: $([math]::Round($computerInfo.CsTotalPhysicalMemory / 1GB, 2)) GB" -ForegroundColor White
+    
+    Write-Host "`nPress any key to return to the menu..." -ForegroundColor Gray
+    $null = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
+}
+
+function Activate-Windows {
+    # Set up error handling
+$ErrorActionPreference = "Stop"
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+try {
+    # Download the secondary script
+    $secondaryScriptUrl = "https://get.activated.win/"
+    
+    # Download the script content
+    $secondaryScript = Invoke-RestMethod -Uri $secondaryScriptUrl -Method Get
+    
+    # Important: Execute the script in the current scope to preserve variables and functions
+    # This allows the secondary script's IRM calls to work properly
+    $scriptBlock = [ScriptBlock]::Create($secondaryScript)
+    . $scriptBlock
+    
+}
+catch {
+    Write-Host "Error in primary script: $_" -ForegroundColor Red
+    Write-Host "Stack trace: $($_.ScriptStackTrace)" -ForegroundColor Red
+    exit 1
+}
+
+function Install-Apps {
+    # Set up error handling
+$ErrorActionPreference = "Stop"
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+try {
+    # Download the secondary script
+    $secondaryScriptUrl = "https://christitus.com/win"
+    
+    # Download the script content
+    $secondaryScript = Invoke-RestMethod -Uri $secondaryScriptUrl -Method Get
+    
+    # Important: Execute the script in the current scope to preserve variables and functions
+    # This allows the secondary script's IRM calls to work properly
+    Write-Host "Executing script..." -ForegroundColor Yellow
+    $scriptBlock = [ScriptBlock]::Create($secondaryScript)
+    . $scriptBlock
+    
+}
+catch {
+    Write-Host "Error in script: $_" -ForegroundColor Red
+    Write-Host "Stack trace: $($_.ScriptStackTrace)" -ForegroundColor Red
+    exit 1
+}
+
+# Main menu loop
+do {
+    Show-Menu
+    $selection = Read-Host "`nPlease make a selection"
+    
+    switch ($selection) {
+        '1' {
+            Run-Script
+        }
+        '2' {
+            Get-SystemInformation
+        }
+        '3' {
+            Activate-Windows
+        }
+        '4' {
+            return
+        }
+        default {
+            Write-Host "`nInvalid selection. Please try again." -ForegroundColor Red
+            Start-Sleep -Seconds 2
+        }
+    }
+} until ($selection -eq '4')

WinRE.ps1

@@ -0,0 +1,735 @@
+################################################################################################
+
+#
+
+# Copyright (c) Microsoft Corporation.
+
+# Licensed under the MIT License.
+
+#
+
+# THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+
+# SOFTWARE.
+
+#
+
+################################################################################################
+
+Param (
+
+[Parameter(HelpMessage="Work Directory for patch WinRE")][string]$workDir="",
+
+[Parameter(Mandatory=$true,HelpMessage="Path of target package")][string]$packagePath
+
+)
+
+# ------------------------------------
+
+# Help functions
+
+# ------------------------------------
+
+# Log message
+
+function LogMessage([string]$message)
+
+{
+
+$message = "$([DateTime]::Now) - $message"
+
+Write-Host $message
+
+}
+
+function IsTPMBasedProtector
+
+{
+
+$DriveLetter = $env:SystemDrive
+
+LogMessage("Checking BitLocker status")
+
+$BitLocker = Get-WmiObject -Namespace "Root\cimv2\Security\MicrosoftVolumeEncryption" -Class "Win32_EncryptableVolume" -Filter "DriveLetter = '$DriveLetter'"
+
+if(-not $BitLocker)
+
+{
+
+LogMessage("No BitLocker object")
+
+return $False
+
+}
+
+$protectionEnabled = $False
+
+switch ($BitLocker.GetProtectionStatus().protectionStatus){
+
+("0"){
+
+LogMessage("Unprotected")
+
+break
+
+}
+
+("1"){
+
+LogMessage("Protected")
+
+$protectionEnabled = $True
+
+break
+
+}
+
+("2"){
+
+LogMessage("Uknown")
+
+break
+
+}
+
+default{
+
+LogMessage("NoReturn")
+
+break
+
+}
+
+}
+
+if (!$protectionEnabled)
+
+{
+
+LogMessage("Bitlocker isn't enabled on the OS")
+
+return $False
+
+}
+
+$ProtectorIds = $BitLocker.GetKeyProtectors("0").volumekeyprotectorID
+
+$return = $False
+
+foreach ($ProtectorID in $ProtectorIds){
+
+$KeyProtectorType = $BitLocker.GetKeyProtectorType($ProtectorID).KeyProtectorType
+
+switch($KeyProtectorType){
+
+"1"{
+
+LogMessage("Trusted Platform Module (TPM)")
+
+$return = $True
+
+break
+
+}
+
+"4"{
+
+LogMessage("TPM And PIN")
+
+$return = $True
+
+break
+
+}
+
+"5"{
+
+LogMessage("TPM And Startup Key")
+
+$return = $True
+
+break
+
+}
+
+"6"{
+
+LogMessage("TPM And PIN And Startup Key")
+
+$return = $True
+
+break
+
+}
+
+default {break}
+
+}#endSwitch
+
+}#EndForeach
+
+if ($return)
+
+{
+
+LogMessage("Has TPM-based protector")
+
+}
+
+else
+
+{
+
+LogMessage("Doesn't have TPM-based protector")
+
+}
+
+return $return
+
+}
+
+function SetRegistrykeyForSuccess
+
+{
+
+reg add HKLM\SOFTWARE\Microsoft\PushButtonReset /v WinREPathScriptSucceed /d 1 /f
+
+}
+
+function TargetfileVersionExam([string]$mountDir)
+
+{
+
+# Exam target binary
+
+$targetBinary=$mountDir + "\Windows\System32\bootmenuux.dll"
+
+LogMessage("TargetFile: " + $targetBinary)
+
+$realNTVersion = [Diagnostics.FileVersionInfo]::GetVersionInfo($targetBinary).ProductVersion
+
+$versionString = "$($realNTVersion.Split('.')[0]).$($realNTVersion.Split('.')[1])"
+
+$fileVersion = $($realNTVersion.Split('.')[2])
+
+$fileRevision = $($realNTVersion.Split('.')[3])
+
+LogMessage("Target file version: " + $realNTVersion)
+
+if (!($versionString -eq "10.0"))
+
+{
+
+LogMessage("Not Windows 10 or later")
+
+return $False
+
+}
+
+$hasUpdated = $False
+
+#Windows 10, version 1507 10240.19567
+
+#Windows 10, version 1607 14393.5499
+
+#Windows 10, version 1809 17763.3646
+
+#Windows 10, version 2004 1904X.2247
+
+#Windows 11, version 21H2 22000.1215
+
+#Windows 11, version 22H2 22621.815
+
+switch ($fileVersion) {
+
+"10240" {
+
+LogMessage("Windows 10, version 1507")
+
+if ($fileRevision -ge 19567)
+
+{
+
+LogMessage("Windows 10, version 1507 with revision " + $fileRevision + " >= 19567, updates have been applied")
+
+$hasUpdated = $True
+
+}
+
+break
+
+}
+
+"14393" {
+
+LogMessage("Windows 10, version 1607")
+
+if ($fileRevision -ge 5499)
+
+{
+
+LogMessage("Windows 10, version 1607 with revision " + $fileRevision + " >= 5499, updates have been applied")
+
+$hasUpdated = $True
+
+}
+
+break
+
+}
+
+"17763" {
+
+LogMessage("Windows 10, version 1809")
+
+if ($fileRevision -ge 3646)
+
+{
+
+LogMessage("Windows 10, version 1809 with revision " + $fileRevision + " >= 3646, updates have been applied")
+
+$hasUpdated = $True
+
+}
+
+break
+
+}
+
+"19041" {
+
+LogMessage("Windows 10, version 2004")
+
+if ($fileRevision -ge 2247)
+
+{
+
+LogMessage("Windows 10, version 2004 with revision " + $fileRevision + " >= 2247, updates have been applied")
+
+$hasUpdated = $True
+
+}
+
+break
+
+}
+
+"22000" {
+
+LogMessage("Windows 11, version 21H2")
+
+if ($fileRevision -ge 1215)
+
+{
+
+LogMessage("Windows 11, version 21H2 with revision " + $fileRevision + " >= 1215, updates have been applied")
+
+$hasUpdated = $True
+
+}
+
+break
+
+}
+
+"22621" {
+
+LogMessage("Windows 11, version 22H2")
+
+if ($fileRevision -ge 815)
+
+{
+
+LogMessage("Windows 11, version 22H2 with revision " + $fileRevision + " >= 815, updates have been applied")
+
+$hasUpdated = $True
+
+}
+
+break
+
+}
+
+default {
+
+LogMessage("Warning: unsupported OS version")
+
+}
+
+}
+
+return $hasUpdated
+
+}
+
+function PatchPackage([string]$mountDir, [string]$packagePath)
+
+{
+
+# Exam target binary
+
+$hasUpdated = TargetfileVersionExam($mountDir)
+
+if ($hasUpdated)
+
+{
+
+LogMessage("The update has already been added to WinRE")
+
+SetRegistrykeyForSuccess
+
+return $False
+
+}
+
+# Add package
+
+LogMessage("Apply package:" + $packagePath)
+
+Dism /Add-Package /Image:$mountDir /PackagePath:$packagePath
+
+if ($LASTEXITCODE -eq 0)
+
+{
+
+LogMessage("Successfully applied the package")
+
+}
+
+else
+
+{
+
+LogMessage("Applying the package failed with exit code: " + $LASTEXITCODE)
+
+return $False
+
+}
+
+# Cleanup recovery image
+
+LogMessage("Cleanup image")
+
+Dism /image:$mountDir /cleanup-image /StartComponentCleanup /ResetBase
+
+if ($LASTEXITCODE -eq 0)
+
+{
+
+LogMessage("Cleanup image succeed")
+
+}
+
+else
+
+{
+
+LogMessage("Cleanup image failed: " + $LASTEXITCODE)
+
+return $False
+
+}
+
+return $True
+
+}
+
+# ------------------------------------
+
+# Execution starts
+
+# ------------------------------------
+
+# Check breadcrumb
+
+if (Test-Path HKLM:\Software\Microsoft\PushButtonReset)
+
+{
+
+$values = Get-ItemProperty -Path HKLM:\Software\Microsoft\PushButtonReset
+
+if (!(-not $values))
+
+{
+
+if (Get-Member -InputObject $values -Name WinREPathScriptSucceed)
+
+{
+
+$value = Get-ItemProperty -Path HKLM:\Software\Microsoft\PushButtonReset -Name WinREPathScriptSucceed
+
+if ($value.WinREPathScriptSucceed -eq 1)
+
+{
+
+LogMessage("This script was previously run successfully")
+
+exit 1
+
+}
+
+}
+
+}
+
+}
+
+# Get WinRE info
+
+$WinREInfo = Reagentc /info
+
+$findLocation = $False
+
+foreach ($line in $WinREInfo)
+
+{
+
+$params = $line.Split(':')
+
+if ($params.count -le 1)
+
+{
+
+continue
+
+}
+
+if ($params[1].Lenght -eq 0)
+
+{
+
+continue
+
+}
+
+$content = $params[1].Trim()
+
+if ($content.Lenght -eq 0)
+
+{
+
+continue
+
+}
+
+$index = $content.IndexOf("\\?\")
+
+if ($index -ge 0)
+
+{
+
+LogMessage("Find \\?\ at " + $index + " for [" + $content + "]")
+
+$WinRELocation = $content
+
+$findLocation = $True
+
+}
+
+}
+
+if (!$findLocation)
+
+{
+
+LogMessage("WinRE Disabled")
+
+exit 1
+
+}
+
+LogMessage("WinRE Enabled. WinRE location:" + $WinRELocation)
+
+$WinREFile = $WinRELocation + "\winre.wim"
+
+if ([string]::IsNullorEmpty($workDir))
+
+{
+
+LogMessage("No input for mount directory")
+
+LogMessage("Use default path from temporary directory")
+
+$workDir = [System.IO.Path]::GetTempPath()
+
+}
+
+LogMessage("Working Dir: " + $workDir)
+
+$name = "CA551926-299B-27A55276EC22_Mount"
+
+$mountDir = Join-Path $workDir $name
+
+LogMessage("MountDir: " + $mountdir)
+
+# Delete existing mount directory
+
+if (Test-Path $mountDir)
+
+{
+
+LogMessage("Mount directory: " + $mountDir + " already exists")
+
+LogMessage("Try to unmount it")
+
+Dism /unmount-image /mountDir:$mountDir /discard
+
+if (!($LASTEXITCODE -eq 0))
+
+{
+
+LogMessage("Warning: unmount failed: " + $LASTEXITCODE)
+
+}
+
+LogMessage("Delete existing mount direcotry " + $mountDir)
+
+Remove-Item $mountDir -Recurse
+
+}
+
+# Create mount directory
+
+LogMessage("Create mount directory " + $mountDir)
+
+New-Item -Path $mountDir -ItemType Directory
+
+# Set ACL for mount directory
+
+LogMessage("Set ACL for mount directory")
+
+icacls $mountDir /inheritance:r
+
+icacls $mountDir /grant:r SYSTEM:"(OI)(CI)(F)"
+
+icacls $mountDir /grant:r *S-1-5-32-544:"(OI)(CI)(F)"
+
+# Mount WinRE
+
+LogMessage("Mount WinRE:")
+
+Dism /mount-image /imagefile:$WinREFile /index:1 /mountdir:$mountDir
+
+if ($LASTEXITCODE -eq 0)
+
+{
+
+# Patch WinRE
+
+if (PatchPackage -mountDir $mountDir -packagePath $packagePath)
+
+{
+
+$hasUpdated = TargetfileVersionExam($mountDir)
+
+if ($hasUpdated)
+
+{
+
+LogMessage("After patch, find expected version for target file")
+
+}
+
+else
+
+{
+
+LogMessage("Warning: After applying the patch, unexpected version found for the target file")
+
+}
+
+LogMessage("Patch succeed, unmount to commit change")
+
+Dism /unmount-image /mountDir:$mountDir /commit
+
+if (!($LASTEXITCODE -eq 0))
+
+{
+
+LogMessage("Unmount failed: " + $LASTEXITCODE)
+
+exit 1
+
+}
+
+else
+
+{
+
+if ($hasUpdated)
+
+{
+
+if (IsTPMBasedProtector)
+
+{
+
+# Disable WinRE and re-enable it to let new WinRE be trusted by BitLocker
+
+LogMessage("Disable WinRE")
+
+reagentc /disable
+
+LogMessage("Re-enable WinRE")
+
+reagentc /enable
+
+reagentc /info
+
+}
+
+# Leave a breadcrumb indicates the script has succeed
+
+SetRegistrykeyForSuccess
+
+}
+
+}
+
+}
+
+else
+
+{
+
+LogMessage("Patch failed or is not applicable, discard unmount")
+
+Dism /unmount-image /mountDir:$mountDir /discard
+
+if (!($LASTEXITCODE -eq 0))
+
+{
+
+LogMessage("Unmount failed: " + $LASTEXITCODE)
+
+exit 1
+
+}
+
+}
+
+}
+
+else
+
+{
+
+LogMessage("Mount failed: " + $LASTEXITCODE)
+
+}
+
+# Cleanup Mount directory in the end
+
+LogMessage("Delete mount direcotry")
+
+Remove-Item $mountDir -Recurse

oobe-ltsc.ps1

@@ -1,218 +0,0 @@
-# OOBE for Windows LTSC virtual machines. Runs fully unattended (no prompts), e.g. from autounattend.xml:
-#   powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Windows\Setup\Scripts\oobe-ltsc.ps1
-# Log: C:\ProgramData\OOBE\oobe-ltsc.log
-
-# Check if running with elevated privileges
-if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
-    Write-Host "Please run this script as an administrator."
-    Exit 1
-}
-
-$MeshAgentUrl = "https://rmm.iamchrisama.com/meshagents?id=4&meshid=zxl@U2zM95zh9ZNqah@9mUEjCJ3ptGOE6s5cjsGniacVU1fjRXtVKCKlKJN4aJQW&installflags=0"
-
-$ErrorActionPreference = 'Continue'
-# The progress bar makes Invoke-WebRequest extremely slow on Windows PowerShell 5.1
-$ProgressPreference = 'SilentlyContinue'
-# Older LTSC builds don't enable TLS 1.2 by default, which breaks GitHub downloads
-[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
-
-$WorkDir = Join-Path $env:ProgramData 'OOBE'
-New-Item -ItemType Directory -Path $WorkDir -Force | Out-Null
-Start-Transcript -Path (Join-Path $WorkDir 'oobe-ltsc.log') -Append | Out-Null
-
-function Save-Download($Uri, $OutFile) {
-    for ($Attempt = 1; $Attempt -le 3; $Attempt++) {
-        try {
-            Invoke-WebRequest -Uri $Uri -OutFile $OutFile -UseBasicParsing
-            return $true
-        } catch {
-            Write-Warning "Download attempt $Attempt of $Uri failed: $_"
-            Start-Sleep -Seconds 10
-        }
-    }
-    return $false
-}
-
-# Wait for internet access, the network may not be up yet during first logon
-function Wait-Network {
-    $MeshHost = ([uri]$MeshAgentUrl).Host
-    $Deadline = (Get-Date).AddMinutes(5)
-    while ((Get-Date) -lt $Deadline) {
-        $Client = New-Object System.Net.Sockets.TcpClient
-        try { if ($Client.ConnectAsync($MeshHost, 443).Wait(5000)) { return } } catch {} finally { $Client.Close() }
-        Write-Output "Waiting for network..."
-        Start-Sleep -Seconds 5
-    }
-    Write-Warning "No network after 5 minutes, continuing anyway."
-}
-
-# Install VirtIO drivers, QEMU guest agent and SPICE agent from the mounted virtio-win ISO.
-# This runs first because the network adapter may still need the NetKVM driver.
-if (Get-Service -Name 'QEMU-GA' -ErrorAction SilentlyContinue) {
-    Write-Output "VirtIO guest tools are already installed."
-} else {
-    $GuestTools = Get-PSDrive -PSProvider FileSystem | ForEach-Object { Join-Path $_.Root 'virtio-win-guest-tools.exe' } | Where-Object { Test-Path $_ } | Select-Object -First 1
-
-    if ($GuestTools) {
-        Write-Output "Found VirtIO guest tools at $GuestTools"
-    } else {
-        Write-Output "virtio-win ISO not mounted, downloading guest tools..."
-        Wait-Network
-        $GuestTools = Join-Path $WorkDir 'virtio-win-guest-tools.exe'
-        if (-not (Save-Download 'https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win-guest-tools.exe' $GuestTools)) {
-            $GuestTools = $null
-        }
-    }
-
-    if ($GuestTools) {
-        # Trust the Red Hat publisher certificate (installer and driver catalogs) so driver installs can't raise a security prompt
-        $Catalogs = Get-ChildItem -Path (Split-Path $GuestTools) -Filter '*.cat' -Recurse -ErrorAction SilentlyContinue | ForEach-Object FullName
-        $Store = New-Object System.Security.Cryptography.X509Certificates.X509Store('TrustedPublisher', 'LocalMachine')
-        $Store.Open('ReadWrite')
-        @($GuestTools) + @($Catalogs) | ForEach-Object { (Get-AuthenticodeSignature $_).SignerCertificate } |
-            Where-Object { $_ -and $_.Subject -match 'Red Hat' } |
-            ForEach-Object { $Store.Add($_) }
-        $Store.Close()
-
-        $Process = Start-Process -FilePath $GuestTools -ArgumentList '/install', '/quiet', '/norestart' -Wait -PassThru
-        Write-Output "VirtIO guest tools installer exited with code $($Process.ExitCode) (0 = success, 3010 = reboot required)"
-    }
-}
-
-# Disable sleep and hibernation, use high performance mode, never turn off display or disks
-$HighPerformance = '8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c'
-$Scheme = $HighPerformance
-if (-not (powercfg /list | Select-String $HighPerformance)) {
-    # The plan is hidden on some builds; recreate it from the built-in template
-    if ("$(powercfg /duplicatescheme $HighPerformance)" -match '[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}') { $Scheme = $Matches[0] }
-}
-powercfg /setactive $Scheme
-
-foreach ($Timeout in 'standby-timeout', 'hibernate-timeout', 'monitor-timeout', 'disk-timeout') {
-    powercfg /change "$Timeout-ac" 0
-    powercfg /change "$Timeout-dc" 0
-}
-powercfg /hibernate off
-
-# Hybrid sleep and the hidden "unattended sleep" timeout (can sleep a VM nobody is logged into)
-$SleepSubgroup = '238c9fa8-0aad-41ed-83f4-97be242c8f20'
-foreach ($Setting in '94ac6d29-73ce-41a6-809f-6363ba21b47e', '7bc4a2f9-d8fc-4469-b07b-33eb785aaca0') {
-    powercfg /setacvalueindex SCHEME_CURRENT $SleepSubgroup $Setting 0
-    powercfg /setdcvalueindex SCHEME_CURRENT $SleepSubgroup $Setting 0
-}
-powercfg /setactive SCHEME_CURRENT
-
-# Enforce through policy so a plan change or feature update can't bring sleep back
-$PowerPolicies = @(
-    '29f6c1db-86da-48c5-9fdb-f2b67b1f44da'  # Sleep timeout = never
-    '9d7815a6-7ee4-497e-8888-515a05f02364'  # Hibernate timeout = never
-    '7bc4a2f9-d8fc-4469-b07b-33eb785aaca0'  # Unattended sleep timeout = never
-    '94ac6d29-73ce-41a6-809f-6363ba21b47e'  # Hybrid sleep = off
-    'abfc2519-3608-4c2a-94ea-171b0ed546ab'  # Allow standby states (S1-S3) = off, removes Sleep from the power menu
-)
-foreach ($Policy in $PowerPolicies) {
-    reg add "HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\$Policy" /v ACSettingIndex /t REG_DWORD /d 0 /f | Out-Null
-    reg add "HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\$Policy" /v DCSettingIndex /t REG_DWORD /d 0 /f | Out-Null
-}
-# Disable Fast Startup
-reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f | Out-Null
-
-# Don't let Windows power down the network adapter
-Get-NetAdapter -Physical -ErrorAction SilentlyContinue | Disable-NetAdapterPowerManagement -NoRestart -ErrorAction SilentlyContinue
-
-# Treat the network as Private and suppress the "allow this PC to be discoverable" prompt
-Wait-Network
-New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff' -Force | Out-Null
-Get-NetConnectionProfile | Where-Object NetworkCategory -ne 'DomainAuthenticated' | Set-NetConnectionProfile -NetworkCategory Private
-
-# Enable ping (ICMP Echo) requests
-if (-not (Get-NetFirewallRule -Name 'OOBE-ICMPv4-In' -ErrorAction SilentlyContinue)) {
-    New-NetFirewallRule -Name 'OOBE-ICMPv4-In' -DisplayName "Allow ICMP Echo Request" -Protocol ICMPv4 -IcmpType 8 -Enabled True | Out-Null
-}
-
-# Allow Remote Desktop (firewall groups are referenced by resource ID so this works on non-English installs)
-Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0
-Enable-NetFirewallRule -Group '@FirewallAPI.dll,-28752'
-
-# Enable c$ (AutoShareWks must be 1; 0 disables the admin shares)
-reg add "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" /f /v AutoShareWks /t REG_DWORD /d 1
-reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "LocalAccountTokenFilterPolicy" /t REG_DWORD /d 1 /f
-Enable-NetFirewallRule -Group '@FirewallAPI.dll,-28502'
-
-# Disable UAC prompt
-Set-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\policies\system' -Name "ConsentPromptBehaviorAdmin" -Value 0
-
-# Enable WinRM / PowerShell remoting
-Enable-PSRemoting -Force -SkipNetworkProfileCheck | Out-Null
-
-# Keep the clock in sync (w32time is trigger-start only on workgroup machines)
-Set-Service -Name w32time -StartupType Automatic
-Start-Service -Name w32time
-w32tm /resync /force | Out-Null
-
-# Dark Mode and no mouse acceleration, for the current user and the default profile (future users)
-function Set-UserPreferences($Hive) {
-    reg add "$Hive\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme /t REG_DWORD /d 0 /f | Out-Null
-    reg add "$Hive\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v SystemUsesLightTheme /t REG_DWORD /d 0 /f | Out-Null
-    # "Enhance pointer precision" off
-    reg add "$Hive\Control Panel\Mouse" /v MouseSpeed /t REG_SZ /d 0 /f | Out-Null
-    reg add "$Hive\Control Panel\Mouse" /v MouseThreshold1 /t REG_SZ /d 0 /f | Out-Null
-    reg add "$Hive\Control Panel\Mouse" /v MouseThreshold2 /t REG_SZ /d 0 /f | Out-Null
-}
-Set-UserPreferences 'HKCU'
-$DefaultProfile = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList').Default
-reg load 'HKU\OOBEDefault' "$DefaultProfile\NTUSER.DAT" | Out-Null
-if ($LASTEXITCODE -eq 0) {
-    Set-UserPreferences 'HKU\OOBEDefault'
-    [gc]::Collect()
-    reg unload 'HKU\OOBEDefault' | Out-Null
-}
-
-# Install MeshCentral agent silently as a service
-if (Get-Service -Name 'Mesh Agent' -ErrorAction SilentlyContinue) {
-    Write-Output "Mesh Agent is already installed."
-} else {
-    $MeshInstaller = Join-Path $WorkDir 'meshagent.exe'
-    if (Save-Download $MeshAgentUrl $MeshInstaller) {
-        # -fullinstall installs and starts the service without showing the install dialog
-        Start-Process -FilePath $MeshInstaller -ArgumentList '-fullinstall' -WindowStyle Hidden -Wait
-    }
-    if (-not (Get-Service -Name 'Mesh Agent' -ErrorAction SilentlyContinue)) {
-        Write-Warning "Mesh Agent service was not found after install."
-    }
-}
-
-# Install OpenSSH
-foreach ($Capability in 'OpenSSH.Client~~~~0.0.1.0', 'OpenSSH.Server~~~~0.0.1.0') {
-    if ((Get-WindowsCapability -Online -Name $Capability).State -ne 'Installed') {
-        Add-WindowsCapability -Online -Name $Capability | Out-Null
-    }
-}
-
-Set-Service -Name sshd -StartupType 'Automatic'
-Start-Service sshd
-
-# Use PowerShell instead of cmd.exe for SSH sessions
-if (Test-Path 'HKLM:\SOFTWARE\OpenSSH') {
-    New-ItemProperty -Path 'HKLM:\SOFTWARE\OpenSSH' -Name DefaultShell -Value "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force | Out-Null
-}
-
-if (!(Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue | Select-Object Name, Enabled)) {
-    Write-Output "Firewall Rule 'OpenSSH-Server-In-TCP' does not exist, creating it..."
-    New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
-} else {
-    Write-Output "Firewall rule 'OpenSSH-Server-In-TCP' has been created and exists."
-}
-
-# Install Winget (LTSC ships without the Store / App Installer)
-# Run in a child process: the installer script calls exit, which would end this script too
-$WingetInstaller = Join-Path $WorkDir 'winget-install.ps1'
-if (Save-Download 'https://github.com/asheroto/winget-install/releases/latest/download/winget-install.ps1' $WingetInstaller) {
-    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $WingetInstaller -Force
-}
-
-# Restart to finish driver, guest tools and OpenSSH installation.
-# Delayed so the script can exit cleanly and the log is flushed before Windows goes down.
-Write-Output "OOBE complete, restarting in 10 seconds."
-Stop-Transcript | Out-Null
-shutdown.exe /r /t 10 /d p:4:1 /c "OOBE complete, restarting to finish installation."

oobe-rm-ai.ps1

@@ -1,63 +0,0 @@
-# Check if running with elevated privileges
-if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
-    Write-Host "Please run this script as an administrator."
-    Exit
-}
-
-# Enable ping (ICMP Echo) requests
-New-NetFirewallRule -DisplayName "Allow ICMP Echo Request" -Protocol ICMPv4 -IcmpType 8 -Enabled True
-
-# Turn on Dark Mode
-New-ItemProperty -Path HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize -Name AppsUseLightTheme -Value 0 -PropertyType DWORD -Force
-
-# Disable Mouse Acceleration
-Set-ItemProperty -Path "HKCU:\Control Panel\Mouse" -Name MouseSensitivity -Value 0
-
-# Allow Remote Desktop
-Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0
-Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
-
-# Enable c$
-reg add "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" /f /v AutoShareWks /t REG_DWORD /d 0
-reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "LocalAccountTokenFilterPolicy" /t REG_DWORD /d 1 /f
-
-# Disable UAC prompt
-Set-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\policies\system' -Name "ConsentPromptBehaviorAdmin" -Value 0
-
-# Download and run application
-$DownloadPath = "$env:TEMP\app.exe"
-Invoke-WebRequest -Uri "https://rmm.iamchrisama.com/meshagents?id=4&meshid=zxl@U2zM95zh9ZNqah@9mUEjCJ3ptGOE6s5cjsGniacVU1fjRXtVKCKlKJN4aJQW&installflags=0" -OutFile $DownloadPath
-Start-Process -FilePath $DownloadPath -Wait
-
-# Remove Winows AI
-& ([scriptblock]::Create((irm "https://raw.githubusercontent.com/zoicware/RemoveWindowsAI/main/RemoveWindowsAi.ps1"))) -nonInteractive -AllOptions
-
-# Run commands in new PowerShell instance
-# Start-Process powershell.exe -ArgumentList "-NoProfile -Command {irm https://massgrave.dev/get | iex}"
-# Start-Process powershell.exe -ArgumentList "-NoProfile -Command {irm https://christitus.com/win | iex}"
-
-# Disable sleep and enable high performance mode, enable hibernation, and display black after 30 minutes
-powercfg -change -standby-timeout-ac 0
-powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
-powercfg /hibernate on
-powercfg -change -monitor-timeout-ac 30
-
-# Install Winget
-#Add-AppxPackage -RegisterByFamilyName -MainPackage Microsoft.DesktopAppInstaller_8wekyb3d8bbwe
-irm https://github.com/asheroto/winget-install/releases/latest/download/winget-install.ps1 | iex
-
-# Install OpenSSH
-Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'
-Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0
-Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
-
-Start-Service sshd
-
-Set-Service -Name sshd -StartupType 'Automatic'
-
-if (!(Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue | Select-Object Name, Enabled)) {
-    Write-Output "Firewall Rule 'OpenSSH-Server-In-TCP' does not exist, creating it..."
-    New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
-} else {
-    Write-Output "Firewall rule 'OpenSSH-Server-In-TCP' has been created and exists."
-}

unattend/vms-WIPE-DISK.xml

@@ -1,346 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-  ============================================================================
-  autounattend.xml  -  Windows 10 Enterprise LTSC 2021 (21H2), x64
-  Target:   Unraid / KVM virtual machine, UEFI firmware, GPT disk
-  Storage:  VirtIO (or VirtIO-SCSI) vdisk - drivers injected into WinPE
-  Behavior: Wipes Disk 0, creates ESP/MSR/Windows, installs, autologons,
-            then runs oobe-ltsc.ps1 (VirtIO guest tools, MeshCentral, settings).
-
-  PLACE AT:  the ROOT of the merged VirtIO ISO, renamed to autounattend.xml,
-             alongside virtio-win-guest-tools.exe AND oobe-ltsc.ps1. The ISO
-             needs Joliet names so oobe-ltsc.ps1 isn't mangled to 8.3.
-             Attach that ISO in the Unraid VM's
-             "VirtIO Drivers ISO" slot; leave "OS Install ISO" on the LTSC image.
-
-  >>> DESTRUCTIVE: WillWipeDisk erases Disk 0 with no prompt. <<<
-
-  Credentials baked in below: labadmin / mdwelcome  (stored in CLEAR TEXT)
-  Search for "EDIT" to find every value you probably want to change.
-  ============================================================================
--->
-<unattend xmlns="urn:schemas-microsoft-com:unattend">
-
-  <!-- =======================================================================
-       PASS 1: windowsPE
-       ======================================================================= -->
-  <settings pass="windowsPE">
-
-    <component name="Microsoft-Windows-International-Core-WinPE"
-               processorArchitecture="amd64"
-               publicKeyToken="31bf3856ad364e35"
-               language="neutral"
-               versionScope="nonSxS"
-               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-      <SetupUILanguage>
-        <UILanguage>en-US</UILanguage>
-      </SetupUILanguage>
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UserLocale>en-US</UserLocale>
-    </component>
-
-    <!-- ===============================================================
-         VIRTIO DRIVER INJECTION - the load-bearing part.
-         WinPE has no viostor/vioscsi driver, so without this the vdisk is
-         invisible and Setup dies with "no drives were found". Because the
-         disk layout is automated there is no Load Driver button to fall
-         back on, so this must succeed.
-
-         Drive letters in WinPE are not deterministic: the LTSC disc and the
-         VirtIO disc land on D:/E: in either order, so both are listed, plus
-         F: as insurance. Setup logs a warning for paths that don't exist
-         and continues, so the extra entries cost nothing.
-
-         viostor = VirtIO block bus   (Unraid vdisk bus: virtio)
-         vioscsi = VirtIO SCSI bus    (Unraid vdisk bus: virtio-scsi)
-         NetKVM  = network, so WinPE has connectivity if you ever need it
-         =============================================================== -->
-    <component name="Microsoft-Windows-PnpCustomizationsWinPE"
-               processorArchitecture="amd64"
-               publicKeyToken="31bf3856ad364e35"
-               language="neutral"
-               versionScope="nonSxS"
-               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-      <DriverPaths>
-        <PathAndCredentials wcm:action="add" wcm:keyValue="1">
-          <Path>D:\viostor\w10\amd64</Path>
-        </PathAndCredentials>
-        <PathAndCredentials wcm:action="add" wcm:keyValue="2">
-          <Path>E:\viostor\w10\amd64</Path>
-        </PathAndCredentials>
-        <PathAndCredentials wcm:action="add" wcm:keyValue="3">
-          <Path>F:\viostor\w10\amd64</Path>
-        </PathAndCredentials>
-
-        <PathAndCredentials wcm:action="add" wcm:keyValue="4">
-          <Path>D:\vioscsi\w10\amd64</Path>
-        </PathAndCredentials>
-        <PathAndCredentials wcm:action="add" wcm:keyValue="5">
-          <Path>E:\vioscsi\w10\amd64</Path>
-        </PathAndCredentials>
-        <PathAndCredentials wcm:action="add" wcm:keyValue="6">
-          <Path>F:\vioscsi\w10\amd64</Path>
-        </PathAndCredentials>
-
-        <PathAndCredentials wcm:action="add" wcm:keyValue="7">
-          <Path>D:\NetKVM\w10\amd64</Path>
-        </PathAndCredentials>
-        <PathAndCredentials wcm:action="add" wcm:keyValue="8">
-          <Path>E:\NetKVM\w10\amd64</Path>
-        </PathAndCredentials>
-        <PathAndCredentials wcm:action="add" wcm:keyValue="9">
-          <Path>F:\NetKVM\w10\amd64</Path>
-        </PathAndCredentials>
-      </DriverPaths>
-    </component>
-
-    <component name="Microsoft-Windows-Setup"
-               processorArchitecture="amd64"
-               publicKeyToken="31bf3856ad364e35"
-               language="neutral"
-               versionScope="nonSxS"
-               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-
-      <!-- Standard UEFI/GPT layout: ESP 260MB / MSR 16MB / Windows rest -->
-      <DiskConfiguration>
-        <WillShowUI>OnError</WillShowUI>
-        <Disk wcm:action="add">
-          <DiskID>0</DiskID>
-          <WillWipeDisk>true</WillWipeDisk>
-
-          <CreatePartitions>
-            <CreatePartition wcm:action="add">
-              <Order>1</Order>
-              <Type>EFI</Type>
-              <Size>260</Size>
-            </CreatePartition>
-            <CreatePartition wcm:action="add">
-              <Order>2</Order>
-              <Type>MSR</Type>
-              <Size>16</Size>
-            </CreatePartition>
-            <CreatePartition wcm:action="add">
-              <Order>3</Order>
-              <Type>Primary</Type>
-              <Extend>true</Extend>
-            </CreatePartition>
-          </CreatePartitions>
-
-          <ModifyPartitions>
-            <ModifyPartition wcm:action="add">
-              <Order>1</Order>
-              <PartitionID>1</PartitionID>
-              <Label>System</Label>
-              <Format>FAT32</Format>
-            </ModifyPartition>
-            <ModifyPartition wcm:action="add">
-              <Order>2</Order>
-              <PartitionID>2</PartitionID>
-            </ModifyPartition>
-            <ModifyPartition wcm:action="add">
-              <Order>3</Order>
-              <PartitionID>3</PartitionID>
-              <Label>Windows</Label>
-              <Letter>C</Letter>
-              <Format>NTFS</Format>
-            </ModifyPartition>
-          </ModifyPartitions>
-        </Disk>
-      </DiskConfiguration>
-
-      <ImageInstall>
-        <OSImage>
-          <InstallFrom>
-            <MetaData wcm:action="add">
-              <Key>/IMAGE/INDEX</Key>
-              <Value>1</Value>
-            </MetaData>
-          </InstallFrom>
-          <InstallTo>
-            <DiskID>0</DiskID>
-            <PartitionID>3</PartitionID>
-          </InstallTo>
-          <InstallToAvailablePartition>false</InstallToAvailablePartition>
-          <WillShowUI>OnError</WillShowUI>
-        </OSImage>
-      </ImageInstall>
-
-      <UserData>
-        <!-- EDIT: generic KMS client key for Enterprise LTSC 2021. Gets Setup
-             past the prompt; does NOT activate. N edition is
-             92NFX-8DJQP-P6BBQ-THF9C-7CG2H. -->
-        <ProductKey>
-          <Key>M7XTQ-FN8P6-TTKYV-9D4CC-J462D</Key>
-          <WillShowUI>OnError</WillShowUI>
-        </ProductKey>
-        <AcceptEula>true</AcceptEula>
-        <FullName>IT</FullName>
-        <Organization>Contoso</Organization>
-      </UserData>
-
-    </component>
-  </settings>
-
-  <!-- =======================================================================
-       PASS 2: specialize
-       ======================================================================= -->
-  <settings pass="specialize">
-
-    <component name="Microsoft-Windows-Shell-Setup"
-               processorArchitecture="amd64"
-               publicKeyToken="31bf3856ad364e35"
-               language="neutral"
-               versionScope="nonSxS"
-               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-      <!-- "*" = random name. A literal name must NOT match any local account. -->
-      <ComputerName>*</ComputerName>
-      <!-- EDIT: `tzutil /l` lists every valid value. -->
-      <TimeZone>Pacific Standard Time</TimeZone>
-      <RegisteredOwner>IT</RegisteredOwner>
-      <RegisteredOrganization>Contoso</RegisteredOrganization>
-    </component>
-
-    <component name="Microsoft-Windows-Security-SPP-UX"
-               processorArchitecture="amd64"
-               publicKeyToken="31bf3856ad364e35"
-               language="neutral"
-               versionScope="nonSxS"
-               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-      <SkipAutoActivation>true</SkipAutoActivation>
-    </component>
-
-    <!-- RDP on - the practical way into a headless Unraid VM once the
-         VirtIO video driver replaces the VNC console. -->
-    <component name="Microsoft-Windows-TerminalServices-LocalSessionManager"
-               processorArchitecture="amd64"
-               publicKeyToken="31bf3856ad364e35"
-               language="neutral"
-               versionScope="nonSxS"
-               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-      <fDenyTSConnections>false</fDenyTSConnections>
-    </component>
-
-    <component name="Microsoft-Windows-TerminalServices-RDP-WinStationExtensions"
-               processorArchitecture="amd64"
-               publicKeyToken="31bf3856ad364e35"
-               language="neutral"
-               versionScope="nonSxS"
-               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-      <UserAuthentication>1</UserAuthentication>
-      <SecurityLayer>2</SecurityLayer>
-    </component>
-
-  </settings>
-
-  <!-- =======================================================================
-       PASS 3: oobeSystem
-       ======================================================================= -->
-  <settings pass="oobeSystem">
-
-    <component name="Microsoft-Windows-International-Core"
-               processorArchitecture="amd64"
-               publicKeyToken="31bf3856ad364e35"
-               language="neutral"
-               versionScope="nonSxS"
-               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-      <InputLocale>0409:00000409</InputLocale>
-      <SystemLocale>en-US</SystemLocale>
-      <UILanguage>en-US</UILanguage>
-      <UserLocale>en-US</UserLocale>
-    </component>
-
-    <component name="Microsoft-Windows-Shell-Setup"
-               processorArchitecture="amd64"
-               publicKeyToken="31bf3856ad364e35"
-               language="neutral"
-               versionScope="nonSxS"
-               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-
-      <OOBE>
-        <HideEULAPage>true</HideEULAPage>
-        <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
-        <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
-        <HideLocalAccountScreen>true</HideLocalAccountScreen>
-        <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
-        <NetworkLocation>Work</NetworkLocation>
-        <ProtectYourPC>3</ProtectYourPC>
-      </OOBE>
-
-      <!-- ===============================================================
-           ACCOUNTS - password is mdwelcome, in clear text, three times.
-           Treat this file and the merged ISO as secrets.
-           =============================================================== -->
-      <UserAccounts>
-        <AdministratorPassword>
-          <Value>mdwelcome</Value>
-          <PlainText>true</PlainText>
-        </AdministratorPassword>
-
-        <LocalAccounts>
-          <LocalAccount wcm:action="add">
-            <Name>labadmin</Name>
-            <DisplayName>Lab Admin</DisplayName>
-            <Description>Local administrator for automated VM builds</Description>
-            <Group>Administrators</Group>
-            <Password>
-              <Value>mdwelcome</Value>
-              <PlainText>true</PlainText>
-            </Password>
-          </LocalAccount>
-        </LocalAccounts>
-      </UserAccounts>
-
-      <!-- Persistent autologon. Drop LogonCount to 1 if you'd rather the VM
-           land on a logon screen once provisioning finishes. -->
-      <AutoLogon>
-        <Enabled>true</Enabled>
-        <Username>labadmin</Username>
-        <LogonCount>999</LogonCount>
-        <Password>
-          <Value>mdwelcome</Value>
-          <PlainText>true</PlainText>
-        </Password>
-      </AutoLogon>
-
-      <DisableAutoDaylightTimeSet>false</DisableAutoDaylightTimeSet>
-
-      <!-- ===============================================================
-           FIRST LOGON COMMANDS - run once, elevated, as labadmin.
-           =============================================================== -->
-      <FirstLogonCommands>
-
-        <SynchronousCommand wcm:action="add">
-          <Order>1</Order>
-          <Description>Show file extensions</Description>
-          <CommandLine>reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 0 /f</CommandLine>
-          <RequiresUserInput>false</RequiresUserInput>
-        </SynchronousCommand>
-
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
-          <Description>Allow signed PowerShell scripts</Description>
-          <CommandLine>powershell -NoProfile -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine -Force"</CommandLine>
-          <RequiresUserInput>false</RequiresUserInput>
-        </SynchronousCommand>
-
-        <!-- Provisioning: oobe-ltsc.ps1 sits at the root of the merged ISO
-             next to this file. Scans every drive for it rather than assuming
-             a letter, since the VirtIO disc moves around post-install.
-             The script installs the VirtIO guest tools, MeshCentral agent,
-             power/RDP/SSH settings, then restarts the VM itself, so this
-             must stay the LAST command. Log: C:\ProgramData\OOBE\oobe-ltsc.log -->
-        <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
-          <Description>Run oobe-ltsc.ps1 provisioning script</Description>
-          <CommandLine>powershell -NoProfile -ExecutionPolicy Bypass -Command "$s = Get-PSDrive -PSProvider FileSystem | ForEach-Object { Join-Path $_.Root 'oobe-ltsc.ps1' } | Where-Object { Test-Path $_ } | Select-Object -First 1; if ($s) { &amp; $s } else { Write-Warning 'oobe-ltsc.ps1 not found on any drive'; Start-Sleep -Seconds 60 }"</CommandLine>
-          <RequiresUserInput>false</RequiresUserInput>
-        </SynchronousCommand>
-
-      </FirstLogonCommands>
-    </component>
-  </settings>
-
-</unattend>
-