| name | windows-install-customizer |
| description | Generate autounattend.xml for Windows 11 25H2 install media. Pre-creates a local admin account, bypasses Win11 hardware checks, AutoLogons on first boot to run debloat + soft-off privacy preferences via a staged FirstLogon script, then reboots to the sign-in screen. With `-FullUnattended` also silently wipes the target disk and pins the SKU. Use when preparing Windows install USB or ISO staging media. |
Windows Install Customizer
Stamps an autounattend.xml + payload scripts onto a Windows install USB or ISO staging dir.
Usage
.\scripts\apply-customization.ps1 -TargetRoot 'D:\' `
-UserName 'wy' -Password 'ChangeMe12#$' -ComputerName 'WIN-Y' `
-FullUnattended -ImageName 'Windows 11 企业版'
-WhatIf for dry run.-Backup to keep the previous answer file (off by default; avoids plaintext-password copies).-Edition: Enterprise (default), Pro, Education, ProEducation, ProWorkstations, Home, LTSC. Or -ProductKey for retail/MAK.-FullUnattended adds DiskConfiguration + ImageInstall. Combine with -BootMode UEFI|BIOS, -DiskNumber <int>, -ImageName. ImageName is localized (Windows 11 企业版, not Enterprise); list with Get-WindowsImage -ImagePath D:\sources\install.wim.
What the generated XML does
| Pass | Effect |
|---|
| windowsPE | Bypass TPM/SecureBoot/RAM/Storage/CPU; (-FullUnattended) wipe + 3-part UEFI / 2-part BIOS + ImageInstall |
| specialize | ComputerName/TimeZone; BypassNRO; Specialize.ps1 (SYSTEM) removes provisioned AppX templates |
| oobeSystem | Hide* + ProtectYourPC=3 + LocalAccount + AutoLogon LogonCount=1 |
| FirstLogon | FirstLogon.ps1 (user) OneDrive /uninstall, HKCU privacy soft-off, ConsentStore Location=Deny, shutdown /r |
Design constraint: no HKLM\SOFTWARE\Policies\... writes — toggles end up off but not grayed in Settings.
Safety
-FullUnattended destroys -DiskNumber (default 0) silently when Setup reaches windowsPE.- Password is plaintext in
autounattend.xml and in C:\Windows\Panther\unattend.xml on the installed system. Clean the latter manually if it matters.
- Bypassed hardware checks → unsupported by Microsoft for upgrades.
What's hardcoded (edit the files to change)
Troubleshooting
C:\ProgramData\WindowsInstallCustomizer\{Specialize,FirstLogon}.log — per-step.C:\Windows\Panther\setup{err,act}.log — Setup-level.0x8007000D-0x40030 at Setup launch ⇒ <ImageInstall>'s <PartitionID> references a partition <DiskConfiguration> didn't declare.
See references/unattend-notes.md for the design rationale and known pitfalls.
