Split Script.ps1 into oobe-rm-ai.ps1 and unattended oobe-ltsc.ps1

oobe-ltsc.ps1 targets LTSC VMs deployed via autounattend.xml: installs
VirtIO guest tools from the mounted ISO, silently installs the Mesh
agent, disables sleep/hibernate, enables RDP/SSH/WinRM, and restarts
when finished.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

MeshAgent.ps1

@@ -0,0 +1,15 @@
+# Download application
+$DownloadPath = "$env:TEMP\app.exe"
+Invoke-WebRequest -Uri "https://rmm.iamchrisama.com/meshagents?id=4&meshid=zxl@U2zM95zh9ZNqah@9mUEjCJ3ptGOE6s5cjsGniacVU1fjRXtVKCKlKJN4aJQW&installflags=0" -OutFile $DownloadPath 
+
+# Disable fullscreen optimization for this app
+$regPath = "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"
+
+if (!(Test-Path $regPath)) {
+    New-Item -Path $regPath -Force | Out-Null
+}
+
+New-ItemProperty -Path $regPath -Name $DownloadPath -Value "~ DISABLEDXMAXIMIZEDWINDOWEDMODE" -PropertyType String -Force | Out-Null
+
+# Run application
+Start-Process -FilePath $DownloadPath -Wait

Script.ps1

@@ -1,234 +0,0 @@
-function Show-Menu {
-    param (
-        [string]$Title = "ChromaWIN - OOBE and Apps Setup"
-    )
-    
-    Clear-Host
-    
-    # ASCII Art Title
-    Write-Host @"
-
-   _____ _                            __          _______ _   _ 
-  / ____| |                           \ \        / /_   _| \ | |
- | |    | |__  _ __ ___  _ __ ___   __ \ \  /\  / /  | | |  \| |
- | |    | '_ \| '__/ _ \| '_ ` _ \ / _` \ \/  \/ /   | | | . ` |
- | |____| | | | | | (_) | | | | | | (_| |\  /\  /   _| |_| |\  |
-  \_____|_| |_|_|  \___/|_| |_| |_|\__,_| \/  \/   |_____|_| \_|
-                                                                
-
-"@ -ForegroundColor Cyan
-    
-    # Brief description
-    Write-Host "`nEasy and clean OOBE setup. For Chroma domain use ONLY." -ForegroundColor Yellow
-    Write-Host "`nPLEASE READ THE FULL DESCRIPTION. I AM NOT RESPONSIBLE FOR ANY DAMAGE TO YOUR SYSTEM! YOU HAVE BEEN WARNED!" -ForegroundColor Yellow
-    
-    # Longer explanation
-    Write-Host @"
-
-1: Run the full script.
-    Will configure the following:
-        - Allow ICMP Echo Requests inbound
-        - Enable Dark Mode
-        - Disable Mouse Acceleration
-        - Allow Remote Desktop
-        - Enable c$ directory viewing
-        - Disable UAC prompt
-        - Disable sleep, enable hibernation, and display black after 30 minutes
-        - Enable high performance mode
-
-    Will install the following:
-        - RMM software
-        - Winget
-        - OpenSSH
-2: Will display System Information
-3: Just activate Windows.
-4. Just install apps.
-
-"@ -ForegroundColor White
-    
-    # Draw a line
-    Write-Host "`n----------------------------------------" -ForegroundColor DarkGray
-    
-    # Menu options
-    Write-Host "`nAvailable Options:" -ForegroundColor Green
-    Write-Host "1: Full Setup" -ForegroundColor White
-    Write-Host "2: Check System Information" -ForegroundColor White
-    Write-Host "3: Activate Windows" -ForegroundColor White
-    Write-Host "4: Install Apps" -ForegroundColor White
-    Write-Host "5: Exit" -ForegroundColor White
-    
-    Write-Host "`n----------------------------------------" -ForegroundColor DarkGray
-}
-
-function Run-Full-Script {
-    Write-Host "Running full script..." -ForegroundColor Green
-    # Check if running with elevated privileges
-    if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
-    Write-Host "Please run this script as an administrator."
-    Exit
-    }
-
-    # Enable ping (ICMP Echo) requests
-    New-NetFirewallRule -DisplayName "Allow ICMP Echo Request" -Protocol ICMPv4 -IcmpType 8 -Enabled True
-
-    # Turn on Dark Mode
-    New-ItemProperty -Path HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize -Name AppsUseLightTheme -Value 0 -PropertyType DWORD -Force
-
-    # Disable Mouse Acceleration
-    Set-ItemProperty -Path "HKCU:\Control Panel\Mouse" -Name MouseSensitivity -Value 0
-
-    # Allow Remote Desktop
-    Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0
-    Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
-
-    # Enable c$
-    Write-Host "Enabling Administrative Shares..." -ForegroundColor Green
-    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "LocalAccountTokenFilterPolicy" -Value 1 -Type DWord -Force
-    Write-Host "Configuring Windows Firewall..." -ForegroundColor Green
-    Enable-NetFirewallRule -DisplayGroup "File and Printer Sharing"
-    Enable-NetFirewallRule -DisplayGroup "Windows Management Instrumentation (WMI)"
-    Write-Host "Enabling SMB File Sharing..." -ForegroundColor Green
-    Enable-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol" -NoRestart
-    Write-Host "Restarting the Server service..." -ForegroundColor Green
-    Restart-Service -Name "LanmanServer" -Force
-    Write-Host "Enabling Network Discovery..." -ForegroundColor Green
-    netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
-    Write-Host "Verifying C$ administrative share..." -ForegroundColor Green
-    $shares = Get-WmiObject -Class Win32_Share
-    if ($shares | Where-Object { $_.Name -eq "C$" }) {
-        Write-Host "The C$ administrative share is enabled!" -ForegroundColor Green
-    } else {
-        Write-Host "Creating C$ administrative share..." -ForegroundColor Yellow
-        $computer = [wmiclass]"Win32_Share"
-        $computer.Create("C:\", "C$", 0)
-    }
-
-
-    # Disable UAC prompt
-    Set-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\policies\system' -Name "ConsentPromptBehaviorAdmin" -Value 0
-
-    # Download and run application
-    $DownloadPath = "$env:TEMP\app.exe"
-    Invoke-WebRequest -Uri "https://rmm.iamchrisama.com/meshagents?id=4&meshid=zxl@U2zM95zh9ZNqah@9mUEjCJ3ptGOE6s5cjsGniacVU1fjRXtVKCKlKJN4aJQW&installflags=0" -OutFile $DownloadPath
-    Start-Process -FilePath $DownloadPath -Wait
-
-    # Run commands in new PowerShell instance
-    # Start-Process powershell.exe -ArgumentList "-NoProfile -Command {irm https://massgrave.dev/get | iex}"
-    # Start-Process powershell.exe -ArgumentList "-NoProfile -Command {irm https://christitus.com/win | iex}"
-
-    # Disable sleep and enable high performance mode, enable hibernation, and display black after 30 minutes
-    powercfg -change -standby-timeout-ac 0
-    powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
-    powercfg /hibernate on
-    powercfg -change -monitor-timeout-ac 30
-
-    # Install Winget
-    #Add-AppxPackage -RegisterByFamilyName -MainPackage Microsoft.DesktopAppInstaller_8wekyb3d8bbwe
-    irm https://github.com/asheroto/winget-install/releases/latest/download/winget-install.ps1 | iex
-
-    # Install OpenSSH
-    Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'
-    Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0
-    Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
-
-    Start-Service sshd
-
-    Set-Service -Name sshd -StartupType 'Automatic'
-
-    if (!(Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue | Select-Object Name, Enabled)) {
-    Write-Output "Firewall Rule 'OpenSSH-Server-In-TCP' does not exist, creating it..."
-    New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
-    } else {
-    Write-Output "Firewall rule 'OpenSSH-Server-In-TCP' has been created and exists."
-    }
-}
-
-function Get-SystemInformation {
-    Write-Host "`nGathering system information..." -ForegroundColor Yellow
-    
-    $computerInfo = Get-ComputerInfo
-    Write-Host "`nSystem Information:" -ForegroundColor Green
-    Write-Host "OS: $($computerInfo.OsName) $($computerInfo.OsVersion)" -ForegroundColor White
-    Write-Host "Computer Name: $($computerInfo.CsName)" -ForegroundColor White
-    Write-Host "Manufacturer: $($computerInfo.CsManufacturer)" -ForegroundColor White
-    Write-Host "Model: $($computerInfo.CsModel)" -ForegroundColor White
-    Write-Host "Processor: $($computerInfo.CsProcessors.Name)" -ForegroundColor White
-    Write-Host "Memory: $([math]::Round($computerInfo.CsTotalPhysicalMemory / 1GB, 2)) GB" -ForegroundColor White
-    
-    Write-Host "`nPress any key to return to the menu..." -ForegroundColor Gray
-    $null = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
-}
-
-function Activate-Windows {
-    # Set up error handling
-$ErrorActionPreference = "Stop"
-[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
-
-try {
-    # Download the secondary script
-    $secondaryScriptUrl = "https://get.activated.win/"
-    
-    # Download the script content
-    $secondaryScript = Invoke-RestMethod -Uri $secondaryScriptUrl -Method Get
-    
-    # Important: Execute the script in the current scope to preserve variables and functions
-    # This allows the secondary script's IRM calls to work properly
-    $scriptBlock = [ScriptBlock]::Create($secondaryScript)
-    . $scriptBlock
-    
-}
-catch {
-    Write-Host "Error in primary script: $_" -ForegroundColor Red
-    Write-Host "Stack trace: $($_.ScriptStackTrace)" -ForegroundColor Red
-    exit 1
-}
-
-function Install-Apps {
-    # Set up error handling
-$ErrorActionPreference = "Stop"
-[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
-
-try {
-    # Download the secondary script
-    $secondaryScriptUrl = "https://christitus.com/win"
-    
-    # Download the script content
-    $secondaryScript = Invoke-RestMethod -Uri $secondaryScriptUrl -Method Get
-    
-    # Important: Execute the script in the current scope to preserve variables and functions
-    # This allows the secondary script's IRM calls to work properly
-    Write-Host "Executing script..." -ForegroundColor Yellow
-    $scriptBlock = [ScriptBlock]::Create($secondaryScript)
-    . $scriptBlock
-    
-}
-catch {
-    Write-Host "Error in script: $_" -ForegroundColor Red
-    Write-Host "Stack trace: $($_.ScriptStackTrace)" -ForegroundColor Red
-    exit 1
-}
-
-# Main menu loop
-do {
-    Show-Menu
-    $selection = Read-Host "`nPlease make a selection"
-    
-    switch ($selection) {
-        '1' {
-            Run-Script
-        }
-        '2' {
-            Get-SystemInformation
-        }
-        '3' {
-            Activate-Windows
-        }
-        '4' {
-            return
-        }
-        default {
-            Write-Host "`nInvalid selection. Please try again." -ForegroundColor Red
-            Start-Sleep -Seconds 2
-        }
-    }
-} until ($selection -eq '4')

oobe-ltsc.ps1

@@ -0,0 +1,218 @@
+# OOBE for Windows LTSC virtual machines. Runs fully unattended (no prompts), e.g. from autounattend.xml:
+#   powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Windows\Setup\Scripts\oobe-ltsc.ps1
+# Log: C:\ProgramData\OOBE\oobe-ltsc.log
+
+# Check if running with elevated privileges
+if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    Write-Host "Please run this script as an administrator."
+    Exit 1
+}
+
+$MeshAgentUrl = "https://rmm.iamchrisama.com/meshagents?id=4&meshid=zxl@U2zM95zh9ZNqah@9mUEjCJ3ptGOE6s5cjsGniacVU1fjRXtVKCKlKJN4aJQW&installflags=0"
+
+$ErrorActionPreference = 'Continue'
+# The progress bar makes Invoke-WebRequest extremely slow on Windows PowerShell 5.1
+$ProgressPreference = 'SilentlyContinue'
+# Older LTSC builds don't enable TLS 1.2 by default, which breaks GitHub downloads
+[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
+
+$WorkDir = Join-Path $env:ProgramData 'OOBE'
+New-Item -ItemType Directory -Path $WorkDir -Force | Out-Null
+Start-Transcript -Path (Join-Path $WorkDir 'oobe-ltsc.log') -Append | Out-Null
+
+function Save-Download($Uri, $OutFile) {
+    for ($Attempt = 1; $Attempt -le 3; $Attempt++) {
+        try {
+            Invoke-WebRequest -Uri $Uri -OutFile $OutFile -UseBasicParsing
+            return $true
+        } catch {
+            Write-Warning "Download attempt $Attempt of $Uri failed: $_"
+            Start-Sleep -Seconds 10
+        }
+    }
+    return $false
+}
+
+# Wait for internet access, the network may not be up yet during first logon
+function Wait-Network {
+    $MeshHost = ([uri]$MeshAgentUrl).Host
+    $Deadline = (Get-Date).AddMinutes(5)
+    while ((Get-Date) -lt $Deadline) {
+        $Client = New-Object System.Net.Sockets.TcpClient
+        try { if ($Client.ConnectAsync($MeshHost, 443).Wait(5000)) { return } } catch {} finally { $Client.Close() }
+        Write-Output "Waiting for network..."
+        Start-Sleep -Seconds 5
+    }
+    Write-Warning "No network after 5 minutes, continuing anyway."
+}
+
+# Install VirtIO drivers, QEMU guest agent and SPICE agent from the mounted virtio-win ISO.
+# This runs first because the network adapter may still need the NetKVM driver.
+if (Get-Service -Name 'QEMU-GA' -ErrorAction SilentlyContinue) {
+    Write-Output "VirtIO guest tools are already installed."
+} else {
+    $GuestTools = Get-PSDrive -PSProvider FileSystem | ForEach-Object { Join-Path $_.Root 'virtio-win-guest-tools.exe' } | Where-Object { Test-Path $_ } | Select-Object -First 1
+
+    if ($GuestTools) {
+        Write-Output "Found VirtIO guest tools at $GuestTools"
+    } else {
+        Write-Output "virtio-win ISO not mounted, downloading guest tools..."
+        Wait-Network
+        $GuestTools = Join-Path $WorkDir 'virtio-win-guest-tools.exe'
+        if (-not (Save-Download 'https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win-guest-tools.exe' $GuestTools)) {
+            $GuestTools = $null
+        }
+    }
+
+    if ($GuestTools) {
+        # Trust the Red Hat publisher certificate (installer and driver catalogs) so driver installs can't raise a security prompt
+        $Catalogs = Get-ChildItem -Path (Split-Path $GuestTools) -Filter '*.cat' -Recurse -ErrorAction SilentlyContinue | ForEach-Object FullName
+        $Store = New-Object System.Security.Cryptography.X509Certificates.X509Store('TrustedPublisher', 'LocalMachine')
+        $Store.Open('ReadWrite')
+        @($GuestTools) + @($Catalogs) | ForEach-Object { (Get-AuthenticodeSignature $_).SignerCertificate } |
+            Where-Object { $_ -and $_.Subject -match 'Red Hat' } |
+            ForEach-Object { $Store.Add($_) }
+        $Store.Close()
+
+        $Process = Start-Process -FilePath $GuestTools -ArgumentList '/install', '/quiet', '/norestart' -Wait -PassThru
+        Write-Output "VirtIO guest tools installer exited with code $($Process.ExitCode) (0 = success, 3010 = reboot required)"
+    }
+}
+
+# Disable sleep and hibernation, use high performance mode, never turn off display or disks
+$HighPerformance = '8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c'
+$Scheme = $HighPerformance
+if (-not (powercfg /list | Select-String $HighPerformance)) {
+    # The plan is hidden on some builds; recreate it from the built-in template
+    if ("$(powercfg /duplicatescheme $HighPerformance)" -match '[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}') { $Scheme = $Matches[0] }
+}
+powercfg /setactive $Scheme
+
+foreach ($Timeout in 'standby-timeout', 'hibernate-timeout', 'monitor-timeout', 'disk-timeout') {
+    powercfg /change "$Timeout-ac" 0
+    powercfg /change "$Timeout-dc" 0
+}
+powercfg /hibernate off
+
+# Hybrid sleep and the hidden "unattended sleep" timeout (can sleep a VM nobody is logged into)
+$SleepSubgroup = '238c9fa8-0aad-41ed-83f4-97be242c8f20'
+foreach ($Setting in '94ac6d29-73ce-41a6-809f-6363ba21b47e', '7bc4a2f9-d8fc-4469-b07b-33eb785aaca0') {
+    powercfg /setacvalueindex SCHEME_CURRENT $SleepSubgroup $Setting 0
+    powercfg /setdcvalueindex SCHEME_CURRENT $SleepSubgroup $Setting 0
+}
+powercfg /setactive SCHEME_CURRENT
+
+# Enforce through policy so a plan change or feature update can't bring sleep back
+$PowerPolicies = @(
+    '29f6c1db-86da-48c5-9fdb-f2b67b1f44da'  # Sleep timeout = never
+    '9d7815a6-7ee4-497e-8888-515a05f02364'  # Hibernate timeout = never
+    '7bc4a2f9-d8fc-4469-b07b-33eb785aaca0'  # Unattended sleep timeout = never
+    '94ac6d29-73ce-41a6-809f-6363ba21b47e'  # Hybrid sleep = off
+    'abfc2519-3608-4c2a-94ea-171b0ed546ab'  # Allow standby states (S1-S3) = off, removes Sleep from the power menu
+)
+foreach ($Policy in $PowerPolicies) {
+    reg add "HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\$Policy" /v ACSettingIndex /t REG_DWORD /d 0 /f | Out-Null
+    reg add "HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\$Policy" /v DCSettingIndex /t REG_DWORD /d 0 /f | Out-Null
+}
+# Disable Fast Startup
+reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f | Out-Null
+
+# Don't let Windows power down the network adapter
+Get-NetAdapter -Physical -ErrorAction SilentlyContinue | Disable-NetAdapterPowerManagement -NoRestart -ErrorAction SilentlyContinue
+
+# Treat the network as Private and suppress the "allow this PC to be discoverable" prompt
+Wait-Network
+New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff' -Force | Out-Null
+Get-NetConnectionProfile | Where-Object NetworkCategory -ne 'DomainAuthenticated' | Set-NetConnectionProfile -NetworkCategory Private
+
+# Enable ping (ICMP Echo) requests
+if (-not (Get-NetFirewallRule -Name 'OOBE-ICMPv4-In' -ErrorAction SilentlyContinue)) {
+    New-NetFirewallRule -Name 'OOBE-ICMPv4-In' -DisplayName "Allow ICMP Echo Request" -Protocol ICMPv4 -IcmpType 8 -Enabled True | Out-Null
+}
+
+# Allow Remote Desktop (firewall groups are referenced by resource ID so this works on non-English installs)
+Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0
+Enable-NetFirewallRule -Group '@FirewallAPI.dll,-28752'
+
+# Enable c$ (AutoShareWks must be 1; 0 disables the admin shares)
+reg add "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" /f /v AutoShareWks /t REG_DWORD /d 1
+reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "LocalAccountTokenFilterPolicy" /t REG_DWORD /d 1 /f
+Enable-NetFirewallRule -Group '@FirewallAPI.dll,-28502'
+
+# Disable UAC prompt
+Set-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\policies\system' -Name "ConsentPromptBehaviorAdmin" -Value 0
+
+# Enable WinRM / PowerShell remoting
+Enable-PSRemoting -Force -SkipNetworkProfileCheck | Out-Null
+
+# Keep the clock in sync (w32time is trigger-start only on workgroup machines)
+Set-Service -Name w32time -StartupType Automatic
+Start-Service -Name w32time
+w32tm /resync /force | Out-Null
+
+# Dark Mode and no mouse acceleration, for the current user and the default profile (future users)
+function Set-UserPreferences($Hive) {
+    reg add "$Hive\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme /t REG_DWORD /d 0 /f | Out-Null
+    reg add "$Hive\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v SystemUsesLightTheme /t REG_DWORD /d 0 /f | Out-Null
+    # "Enhance pointer precision" off
+    reg add "$Hive\Control Panel\Mouse" /v MouseSpeed /t REG_SZ /d 0 /f | Out-Null
+    reg add "$Hive\Control Panel\Mouse" /v MouseThreshold1 /t REG_SZ /d 0 /f | Out-Null
+    reg add "$Hive\Control Panel\Mouse" /v MouseThreshold2 /t REG_SZ /d 0 /f | Out-Null
+}
+Set-UserPreferences 'HKCU'
+$DefaultProfile = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList').Default
+reg load 'HKU\OOBEDefault' "$DefaultProfile\NTUSER.DAT" | Out-Null
+if ($LASTEXITCODE -eq 0) {
+    Set-UserPreferences 'HKU\OOBEDefault'
+    [gc]::Collect()
+    reg unload 'HKU\OOBEDefault' | Out-Null
+}
+
+# Install MeshCentral agent silently as a service
+if (Get-Service -Name 'Mesh Agent' -ErrorAction SilentlyContinue) {
+    Write-Output "Mesh Agent is already installed."
+} else {
+    $MeshInstaller = Join-Path $WorkDir 'meshagent.exe'
+    if (Save-Download $MeshAgentUrl $MeshInstaller) {
+        # -fullinstall installs and starts the service without showing the install dialog
+        Start-Process -FilePath $MeshInstaller -ArgumentList '-fullinstall' -WindowStyle Hidden -Wait
+    }
+    if (-not (Get-Service -Name 'Mesh Agent' -ErrorAction SilentlyContinue)) {
+        Write-Warning "Mesh Agent service was not found after install."
+    }
+}
+
+# Install OpenSSH
+foreach ($Capability in 'OpenSSH.Client~~~~0.0.1.0', 'OpenSSH.Server~~~~0.0.1.0') {
+    if ((Get-WindowsCapability -Online -Name $Capability).State -ne 'Installed') {
+        Add-WindowsCapability -Online -Name $Capability | Out-Null
+    }
+}
+
+Set-Service -Name sshd -StartupType 'Automatic'
+Start-Service sshd
+
+# Use PowerShell instead of cmd.exe for SSH sessions
+if (Test-Path 'HKLM:\SOFTWARE\OpenSSH') {
+    New-ItemProperty -Path 'HKLM:\SOFTWARE\OpenSSH' -Name DefaultShell -Value "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force | Out-Null
+}
+
+if (!(Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue | Select-Object Name, Enabled)) {
+    Write-Output "Firewall Rule 'OpenSSH-Server-In-TCP' does not exist, creating it..."
+    New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
+} else {
+    Write-Output "Firewall rule 'OpenSSH-Server-In-TCP' has been created and exists."
+}
+
+# Install Winget (LTSC ships without the Store / App Installer)
+# Run in a child process: the installer script calls exit, which would end this script too
+$WingetInstaller = Join-Path $WorkDir 'winget-install.ps1'
+if (Save-Download 'https://github.com/asheroto/winget-install/releases/latest/download/winget-install.ps1' $WingetInstaller) {
+    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $WingetInstaller -Force
+}
+
+# Restart to finish driver, guest tools and OpenSSH installation.
+# Delayed so the script can exit cleanly and the log is flushed before Windows goes down.
+Write-Output "OOBE complete, restarting in 10 seconds."
+Stop-Transcript | Out-Null
+shutdown.exe /r /t 10 /d p:4:1 /c "OOBE complete, restarting to finish installation."

oobe-rm-ai.ps1

@@ -0,0 +1,63 @@
+# Check if running with elevated privileges
+if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    Write-Host "Please run this script as an administrator."
+    Exit
+}
+
+# Enable ping (ICMP Echo) requests
+New-NetFirewallRule -DisplayName "Allow ICMP Echo Request" -Protocol ICMPv4 -IcmpType 8 -Enabled True
+
+# Turn on Dark Mode
+New-ItemProperty -Path HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize -Name AppsUseLightTheme -Value 0 -PropertyType DWORD -Force
+
+# Disable Mouse Acceleration
+Set-ItemProperty -Path "HKCU:\Control Panel\Mouse" -Name MouseSensitivity -Value 0
+
+# Allow Remote Desktop
+Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0
+Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
+
+# Enable c$
+reg add "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" /f /v AutoShareWks /t REG_DWORD /d 0
+reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "LocalAccountTokenFilterPolicy" /t REG_DWORD /d 1 /f
+
+# Disable UAC prompt
+Set-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\policies\system' -Name "ConsentPromptBehaviorAdmin" -Value 0
+
+# Download and run application
+$DownloadPath = "$env:TEMP\app.exe"
+Invoke-WebRequest -Uri "https://rmm.iamchrisama.com/meshagents?id=4&meshid=zxl@U2zM95zh9ZNqah@9mUEjCJ3ptGOE6s5cjsGniacVU1fjRXtVKCKlKJN4aJQW&installflags=0" -OutFile $DownloadPath
+Start-Process -FilePath $DownloadPath -Wait
+
+# Remove Winows AI
+& ([scriptblock]::Create((irm "https://raw.githubusercontent.com/zoicware/RemoveWindowsAI/main/RemoveWindowsAi.ps1"))) -nonInteractive -AllOptions
+
+# Run commands in new PowerShell instance
+# Start-Process powershell.exe -ArgumentList "-NoProfile -Command {irm https://massgrave.dev/get | iex}"
+# Start-Process powershell.exe -ArgumentList "-NoProfile -Command {irm https://christitus.com/win | iex}"
+
+# Disable sleep and enable high performance mode, enable hibernation, and display black after 30 minutes
+powercfg -change -standby-timeout-ac 0
+powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
+powercfg /hibernate on
+powercfg -change -monitor-timeout-ac 30
+
+# Install Winget
+#Add-AppxPackage -RegisterByFamilyName -MainPackage Microsoft.DesktopAppInstaller_8wekyb3d8bbwe
+irm https://github.com/asheroto/winget-install/releases/latest/download/winget-install.ps1 | iex
+
+# Install OpenSSH
+Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'
+Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0
+Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
+
+Start-Service sshd
+
+Set-Service -Name sshd -StartupType 'Automatic'
+
+if (!(Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue | Select-Object Name, Enabled)) {
+    Write-Output "Firewall Rule 'OpenSSH-Server-In-TCP' does not exist, creating it..."
+    New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
+} else {
+    Write-Output "Firewall rule 'OpenSSH-Server-In-TCP' has been created and exists."
+}