windows-install-customizer

name

windows-install-customizer

description

Generate autounattend.xml for Windows 11 25H2 install media. Pre-creates a local admin account, bypasses Win11 hardware checks, AutoLogons on first boot to run debloat + soft-off privacy preferences via a staged FirstLogon script, then reboots to the sign-in screen. With `-FullUnattended` also silently wipes the target disk and pins the SKU. Use when preparing Windows install USB or ISO staging media.

Windows Install Customizer

Stamps an autounattend.xml + payload scripts onto a Windows install USB or ISO staging dir.

Usage

.\scripts\apply-customization.ps1 -TargetRoot 'D:\' `
    -UserName 'wy' -Password 'ChangeMe12#$' -ComputerName 'WIN-Y' `
    -FullUnattended -ImageName 'Windows 11 企业版'

• -WhatIf for dry run.
• -Backup to keep the previous answer file (off by default; avoids plaintext-password copies).
• -Edition: Enterprise (default), Pro, Education, ProEducation, ProWorkstations, Home, LTSC. Or -ProductKey for retail/MAK.
• -FullUnattended adds DiskConfiguration + ImageInstall. Combine with -BootMode UEFI|BIOS, -DiskNumber <int>, -ImageName. ImageName is localized (Windows 11 企业版, not Enterprise); list with Get-WindowsImage -ImagePath D:\sources\install.wim.

What the generated XML does

Pass	Effect
windowsPE	Bypass TPM/SecureBoot/RAM/Storage/CPU; (-FullUnattended) wipe + 3-part UEFI / 2-part BIOS + ImageInstall
specialize	ComputerName/TimeZone; BypassNRO; Specialize.ps1 (SYSTEM) removes provisioned AppX templates
oobeSystem	Hide* + ProtectYourPC=3 + LocalAccount + AutoLogon LogonCount=1
FirstLogon	FirstLogon.ps1 (user) OneDrive /uninstall, HKCU privacy soft-off, ConsentStore Location=Deny, shutdown /r

Design constraint: no HKLM\SOFTWARE\Policies\... writes — toggles end up off but not grayed in Settings.

Safety

• -FullUnattended destroys -DiskNumber (default 0) silently when Setup reaches windowsPE.
• Password is plaintext in autounattend.xml and in C:\Windows\Panther\unattend.xml on the installed system. Clean the latter manually if it matters.
• Bypassed hardware checks → unsupported by Microsoft for upgrades.

What's hardcoded (edit the files to change)

• Locale (4× zh-CN + InputLocale=0804:00000804;0409:00000409) in assets/templates/autounattend.xml. LCID list: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-lcid/a9eac961-e77d-41a6-90a5-ce1a8b0cdb9c.
• OOBE Hide-block + ProtectYourPC=3 + the 5 Bypass reg adds — same file.
• Debloat regex in Specialize.ps1.
• HKCU privacy/taskbar prefs in FirstLogon.ps1.

Troubleshooting

• C:\ProgramData\WindowsInstallCustomizer\{Specialize,FirstLogon}.log — per-step.
• C:\Windows\Panther\setup{err,act}.log — Setup-level.
• 0x8007000D-0x40030 at Setup launch ⇒ <ImageInstall>'s <PartitionID> references a partition <DiskConfiguration> didn't declare.

See references/unattend-notes.md for the design rationale and known pitfalls.