707 lines
34 KiB
XML
707 lines
34 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
|
|
<!--https://schneegans.de/windows/unattend-generator/?LanguageMode=Unattended&UILanguage=en-US&Locale=en-US&Keyboard=00000409&GeoLocation=244&ProcessorArchitecture=amd64&BypassRequirementsCheck=true&BypassNetworkCheck=true&ComputerNameMode=Random&TimeZoneMode=Implicit&PartitionMode=Unattended&PartitionLayout=GPT&EspSize=300&RecoveryMode=Folder&WindowsEditionMode=Unattended&WindowsEdition=pro&UserAccountMode=Unattended&AccountName0=Sweetcade&AccountPassword0=Sw33tc%40de&AccountGroup0=Administrators&AccountName1=&AccountName2=&AccountName3=&AccountName4=&AutoLogonMode=Own&ObscurePasswords=true&PasswordExpirationMode=Unlimited&LockoutMode=Disabled&HideFiles=None&ShowFileExtensions=true&DisableWidgets=true&ClassicContextMenu=true&ShowAllTrayIcons=true&DisableDefender=true&DisableDefenderPE=true&DisableUac=true&DisableSac=true&DisableFastStartup=true&EnableLongPaths=true&EnableRemoteDesktop=true&AllowPowerShellScripts=true&DisableLastAccess=true&DisableAppSuggestions=true&PreventDeviceEncryption=true&WifiMode=Skip&ExpressSettings=DisableAll&Remove3DViewer=true&RemoveBingSearch=true&RemoveCalculator=true&RemoveCamera=true&RemoveClipchamp=true&RemoveClock=true&RemoveCopilot=true&RemoveCortana=true&RemoveDevHome=true&RemoveFamily=true&RemoveFeedbackHub=true&RemoveGetHelp=true&RemoveInternetExplorer=true&RemoveMailCalendar=true&RemoveMaps=true&RemoveMathInputPanel=true&RemoveZuneVideo=true&RemoveNews=true&RemoveNotepadClassic=true&RemoveNotepad=true&RemoveOffice365=true&RemoveOneDrive=true&RemoveOneNote=true&RemoveOpenSSHClient=true&RemoveOutlook=true&RemovePaint=true&RemovePaint3D=true&RemovePeople=true&RemovePhotos=true&RemovePowerAutomate=true&RemovePowerShellISE=true&RemoveQuickAssist=true&RemoveSkype=true&RemoveSnippingTool=true&RemoveSolitaire=true&RemoveStepsRecorder=true&RemoveStickyNotes=true&RemoveTeams=true&RemoveGetStarted=true&RemoveToDo=true&RemoveVoiceRecorder=true&RemoveWeather=true&RemoveWindowsMediaPlayer=true&RemoveZuneMusic=true&RemoveWindowsTerminal=true&RemoveWordPad=true&RemoveXboxApps=true&RemoveYourPhone=true&WdacMode=Skip-->
|
|
<settings pass="offlineServicing"></settings>
|
|
<settings pass="windowsPE">
|
|
<component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
|
|
<SetupUILanguage>
|
|
<UILanguage>en-US</UILanguage>
|
|
</SetupUILanguage>
|
|
<InputLocale>0409:00000409</InputLocale>
|
|
<SystemLocale>en-US</SystemLocale>
|
|
<UILanguage>en-US</UILanguage>
|
|
<UserLocale>en-US</UserLocale>
|
|
</component>
|
|
<component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
|
|
<ImageInstall>
|
|
<OSImage>
|
|
<InstallTo>
|
|
<DiskID>0</DiskID>
|
|
<PartitionID>3</PartitionID>
|
|
</InstallTo>
|
|
</OSImage>
|
|
</ImageInstall>
|
|
<UserData>
|
|
<ProductKey>
|
|
<Key>VK7JG-NPHTM-C97JM-9MPGT-3V66T</Key>
|
|
</ProductKey>
|
|
<AcceptEula>true</AcceptEula>
|
|
</UserData>
|
|
<RunSynchronous>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>1</Order>
|
|
<Path>cmd.exe /c ">>"X:\diskpart.txt" echo SELECT DISK=0"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>2</Order>
|
|
<Path>cmd.exe /c ">>"X:\diskpart.txt" echo CLEAN"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>3</Order>
|
|
<Path>cmd.exe /c ">>"X:\diskpart.txt" echo CONVERT GPT"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>4</Order>
|
|
<Path>cmd.exe /c ">>"X:\diskpart.txt" echo CREATE PARTITION EFI SIZE=300"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>5</Order>
|
|
<Path>cmd.exe /c ">>"X:\diskpart.txt" echo FORMAT QUICK FS=FAT32 LABEL="System""</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>6</Order>
|
|
<Path>cmd.exe /c ">>"X:\diskpart.txt" echo CREATE PARTITION MSR SIZE=16"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>7</Order>
|
|
<Path>cmd.exe /c ">>"X:\diskpart.txt" echo CREATE PARTITION PRIMARY"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>8</Order>
|
|
<Path>cmd.exe /c ">>"X:\diskpart.txt" echo FORMAT QUICK FS=NTFS LABEL="Windows""</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>9</Order>
|
|
<Path>cmd.exe /c "diskpart.exe /s "X:\diskpart.txt" >>"X:\diskpart.log" || ( type "X:\diskpart.log" & echo diskpart encountered an error. & pause & exit /b 1 )"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>10</Order>
|
|
<Path>reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassTPMCheck /t REG_DWORD /d 1 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>11</Order>
|
|
<Path>reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassSecureBootCheck /t REG_DWORD /d 1 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>12</Order>
|
|
<Path>reg.exe add "HKLM\SYSTEM\Setup\LabConfig" /v BypassRAMCheck /t REG_DWORD /d 1 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>13</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo @ECHO OFF"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>14</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo SET file=C:\$Windows.~BT\NewOS\Windows\System32\config\SYSTEM"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>15</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo FOR /L ^%^%i IN (0) DO ("</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>16</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo CALL :sleep"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>17</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo IF EXIST ^%file^% ("</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>18</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo CALL :load"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>19</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo FOR ^%^%s IN (Sense WdBoot WdFilter WdNisDrv WdNisSvc WinDefend) DO reg.exe ADD HKLM\mount\ControlSet001\Services\^%^%s /v Start /t REG_DWORD /d 4 /f"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>20</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo reg.exe UNLOAD HKLM\mount"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>21</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo EXIT ) )"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>22</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo GOTO :eof"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>23</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo :load"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>24</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo reg.exe LOAD HKLM\mount ^%file^%"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>25</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo IF ^%errorlevel^% GTR 0 GOTO load"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>26</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo GOTO :eof"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>27</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo :sleep"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>28</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo ping.exe -n 1 127.0.0.1 ^> NUL"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>29</Order>
|
|
<Path>cmd.exe /c ">>"X:\disable-defender.cmd" echo GOTO :eof"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>30</Order>
|
|
<Path>cmd.exe /c "start /MIN X:\disable-defender.cmd"</Path>
|
|
</RunSynchronousCommand>
|
|
</RunSynchronous>
|
|
</component>
|
|
</settings>
|
|
<settings pass="generalize"></settings>
|
|
<settings pass="specialize">
|
|
<component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
|
|
<RunSynchronous>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>1</Order>
|
|
<Path>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>2</Order>
|
|
<Path>reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>3</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "UninstallCopilot" /t REG_SZ /d "powershell.exe -NoProfile -Command \"Get-AppxPackage -Name 'Microsoft.Windows.Ai.Copilot.Provider' | Remove-AppxPackage;\"" /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>4</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Policies\Microsoft\Windows\WindowsCopilot" /v TurnOffWindowsCopilot /t REG_DWORD /d 1 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>5</Order>
|
|
<Path>reg.exe unload "HKU\DefaultUser"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>6</Order>
|
|
<Path>reg.exe delete "HKLM\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\DevHomeUpdate" /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>7</Order>
|
|
<Path>reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>8</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Notepad" /v ShowStoreBanner /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>9</Order>
|
|
<Path>reg.exe unload "HKU\DefaultUser"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>10</Order>
|
|
<Path>cmd.exe /c "del "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk""</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>11</Order>
|
|
<Path>cmd.exe /c "del "C:\Windows\System32\OneDriveSetup.exe""</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>12</Order>
|
|
<Path>cmd.exe /c "del "C:\Windows\SysWOW64\OneDriveSetup.exe""</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>13</Order>
|
|
<Path>reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>14</Order>
|
|
<Path>reg.exe delete "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveSetup /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>15</Order>
|
|
<Path>reg.exe unload "HKU\DefaultUser"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>16</Order>
|
|
<Path>reg.exe delete "HKLM\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\OutlookUpdate" /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>17</Order>
|
|
<Path>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Communications" /v ConfigureChatAutoInstall /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>18</Order>
|
|
<Path>powershell.exe -NoProfile -Command "$xml = [xml]::new(); $xml.Load('C:\Windows\Panther\unattend.xml'); $sb = [scriptblock]::Create( $xml.unattend.Extensions.ExtractScript ); Invoke-Command -ScriptBlock $sb -ArgumentList $xml;"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>19</Order>
|
|
<Path>powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Temp\remove-packages.ps1' -Raw | Invoke-Expression;"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>20</Order>
|
|
<Path>powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Temp\remove-caps.ps1' -Raw | Invoke-Expression;"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>21</Order>
|
|
<Path>powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Temp\remove-features.ps1' -Raw | Invoke-Expression;"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>22</Order>
|
|
<Path>reg.exe add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Start" /v ConfigureStartPins /t REG_SZ /d "{ \"pinnedList\": [] }" /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>23</Order>
|
|
<Path>reg.exe add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Start" /v ConfigureStartPins_ProviderSet /t REG_DWORD /d 1 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>24</Order>
|
|
<Path>reg.exe add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Start" /v ConfigureStartPins_WinningProvider /t REG_SZ /d B5292708-1619-419B-9923-E5D9F3925E71 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>25</Order>
|
|
<Path>reg.exe add "HKLM\SOFTWARE\Microsoft\PolicyManager\providers\B5292708-1619-419B-9923-E5D9F3925E71\default\Device\Start" /v ConfigureStartPins /t REG_SZ /d "{ \"pinnedList\": [] }" /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>26</Order>
|
|
<Path>reg.exe add "HKLM\SOFTWARE\Microsoft\PolicyManager\providers\B5292708-1619-419B-9923-E5D9F3925E71\default\Device\Start" /v ConfigureStartPins_LastWrite /t REG_DWORD /d 1 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>27</Order>
|
|
<Path>net.exe accounts /lockoutthreshold:0</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>28</Order>
|
|
<Path>net.exe accounts /maxpwage:UNLIMITED</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>29</Order>
|
|
<Path>reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>30</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>31</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d 1 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>32</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 1 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>33</Order>
|
|
<Path>reg.exe unload "HKU\DefaultUser"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>34</Order>
|
|
<Path>reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>35</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\Explorer" /v EnableAutoTray /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>36</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\Run" /v "ShowAllTrayIcons" /t REG_SZ /d "powershell.exe -NoProfile -Command \"Get-Content -LiteralPath 'C:\Windows\Setup\Scripts\ShowAllTrayIcons.ps1' -Raw | Invoke-Expression;\"" /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>37</Order>
|
|
<Path>reg.exe unload "HKU\DefaultUser"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>38</Order>
|
|
<Path>regini.exe "%TEMP%\disable-defender.ini"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>39</Order>
|
|
<Path>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy" /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>40</Order>
|
|
<Path>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>41</Order>
|
|
<Path>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v LongPathsEnabled /t REG_DWORD /d 1 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>42</Order>
|
|
<Path>netsh.exe advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>43</Order>
|
|
<Path>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>44</Order>
|
|
<Path>powershell.exe -NoProfile -Command "Set-ExecutionPolicy -Scope 'LocalMachine' -ExecutionPolicy 'RemoteSigned' -Force;"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>45</Order>
|
|
<Path>fsutil.exe behavior set disableLastAccess 1</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>46</Order>
|
|
<Path>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>47</Order>
|
|
<Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Dsh" /v AllowNewsAndInterests /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>48</Order>
|
|
<Path>reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>49</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>50</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>51</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>52</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>53</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>54</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>55</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>56</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>57</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>58</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>59</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>60</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>61</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>62</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>63</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>64</Order>
|
|
<Path>reg.exe unload "HKU\DefaultUser"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>65</Order>
|
|
<Path>reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 0 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>66</Order>
|
|
<Path>reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\BitLocker" /v "PreventDeviceEncryption" /t REG_DWORD /d 1 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>67</Order>
|
|
<Path>reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>68</Order>
|
|
<Path>reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "ClassicContextMenu" /t REG_SZ /d "reg.exe add \"HKCU\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32\" /ve /f" /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>69</Order>
|
|
<Path>reg.exe unload "HKU\DefaultUser"</Path>
|
|
</RunSynchronousCommand>
|
|
</RunSynchronous>
|
|
</component>
|
|
</settings>
|
|
<settings pass="auditSystem"></settings>
|
|
<settings pass="auditUser"></settings>
|
|
<settings pass="oobeSystem">
|
|
<component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
|
|
<InputLocale>0409:00000409</InputLocale>
|
|
<SystemLocale>en-US</SystemLocale>
|
|
<UILanguage>en-US</UILanguage>
|
|
<UserLocale>en-US</UserLocale>
|
|
</component>
|
|
<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
|
|
<UserAccounts>
|
|
<LocalAccounts>
|
|
<LocalAccount wcm:action="add">
|
|
<Name>Sweetcade</Name>
|
|
<Group>Administrators</Group>
|
|
<Password>
|
|
<Value>UwB3ADMAMwB0AGMAQABkAGUAUABhAHMAcwB3AG8AcgBkAA==</Value>
|
|
<PlainText>false</PlainText>
|
|
</Password>
|
|
</LocalAccount>
|
|
</LocalAccounts>
|
|
</UserAccounts>
|
|
<AutoLogon>
|
|
<Username>Sweetcade</Username>
|
|
<Enabled>true</Enabled>
|
|
<LogonCount>1</LogonCount>
|
|
<Password>
|
|
<Value>UwB3ADMAMwB0AGMAQABkAGUAUABhAHMAcwB3AG8AcgBkAA==</Value>
|
|
<PlainText>false</PlainText>
|
|
</Password>
|
|
</AutoLogon>
|
|
<OOBE>
|
|
<ProtectYourPC>3</ProtectYourPC>
|
|
<HideEULAPage>true</HideEULAPage>
|
|
<HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
|
|
</OOBE>
|
|
<FirstLogonCommands>
|
|
<SynchronousCommand wcm:action="add">
|
|
<Order>1</Order>
|
|
<CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoLogonCount /t REG_DWORD /d 0 /f</CommandLine>
|
|
</SynchronousCommand>
|
|
</FirstLogonCommands>
|
|
</component>
|
|
</settings>
|
|
<Extensions xmlns="https://schneegans.de/windows/unattend-generator/">
|
|
<ExtractScript>
|
|
param(
|
|
[xml] $Document
|
|
);
|
|
|
|
$scriptsDir = 'C:\Windows\Setup\Scripts\';
|
|
foreach( $file in $Document.unattend.Extensions.File ) {
|
|
$path = [System.Environment]::ExpandEnvironmentVariables(
|
|
$file.GetAttribute( 'path' )
|
|
);
|
|
if( $path.StartsWith( $scriptsDir ) ) {
|
|
mkdir -Path $scriptsDir -ErrorAction 'SilentlyContinue';
|
|
}
|
|
$encoding = switch( [System.IO.Path]::GetExtension( $path ) ) {
|
|
{ $_ -in '.ps1', '.xml' } { [System.Text.Encoding]::UTF8; }
|
|
{ $_ -in '.reg', '.vbs', '.js' } { [System.Text.UnicodeEncoding]::new( $false, $true ); }
|
|
default { [System.Text.Encoding]::Default; }
|
|
};
|
|
[System.IO.File]::WriteAllBytes( $path, ( $encoding.GetPreamble() + $encoding.GetBytes( $file.InnerText.Trim() ) ) );
|
|
}
|
|
</ExtractScript>
|
|
<File path="C:\Windows\Temp\remove-packages.ps1">
|
|
$selectors = @(
|
|
'Microsoft.Microsoft3DViewer';
|
|
'Microsoft.BingSearch';
|
|
'Microsoft.WindowsCalculator';
|
|
'Microsoft.WindowsCamera';
|
|
'Clipchamp.Clipchamp';
|
|
'Microsoft.WindowsAlarms';
|
|
'Microsoft.549981C3F5F10';
|
|
'Microsoft.Windows.DevHome';
|
|
'MicrosoftCorporationII.MicrosoftFamily';
|
|
'Microsoft.WindowsFeedbackHub';
|
|
'Microsoft.GetHelp';
|
|
'Microsoft.Getstarted';
|
|
'microsoft.windowscommunicationsapps';
|
|
'Microsoft.WindowsMaps';
|
|
'Microsoft.BingNews';
|
|
'Microsoft.WindowsNotepad';
|
|
'Microsoft.MicrosoftOfficeHub';
|
|
'Microsoft.Office.OneNote';
|
|
'Microsoft.OutlookForWindows';
|
|
'Microsoft.Paint';
|
|
'Microsoft.MSPaint';
|
|
'Microsoft.People';
|
|
'Microsoft.Windows.Photos';
|
|
'Microsoft.PowerAutomateDesktop';
|
|
'MicrosoftCorporationII.QuickAssist';
|
|
'Microsoft.SkypeApp';
|
|
'Microsoft.ScreenSketch';
|
|
'Microsoft.MicrosoftSolitaireCollection';
|
|
'Microsoft.MicrosoftStickyNotes';
|
|
'MSTeams';
|
|
'Microsoft.Todos';
|
|
'Microsoft.WindowsSoundRecorder';
|
|
'Microsoft.BingWeather';
|
|
'Microsoft.WindowsTerminal';
|
|
'Microsoft.Xbox.TCUI';
|
|
'Microsoft.XboxApp';
|
|
'Microsoft.XboxGameOverlay';
|
|
'Microsoft.XboxGamingOverlay';
|
|
'Microsoft.XboxIdentityProvider';
|
|
'Microsoft.XboxSpeechToTextOverlay';
|
|
'Microsoft.GamingApp';
|
|
'Microsoft.YourPhone';
|
|
'Microsoft.ZuneMusic';
|
|
'Microsoft.ZuneVideo';
|
|
);
|
|
$getCommand = { Get-AppxProvisionedPackage -Online; };
|
|
$filterCommand = { $_.DisplayName -eq $selector; };
|
|
$removeCommand = {
|
|
[CmdletBinding()]
|
|
param(
|
|
[Parameter( Mandatory, ValueFromPipeline )]
|
|
$InputObject
|
|
);
|
|
process {
|
|
$InputObject | Remove-AppxProvisionedPackage -AllUsers -Online -ErrorAction 'Continue';
|
|
}
|
|
};
|
|
$type = 'Package';
|
|
$logfile = 'C:\Windows\Temp\remove-packages.log';
|
|
& {
|
|
$installed = & $getCommand;
|
|
foreach( $selector in $selectors ) {
|
|
$result = [ordered] @{
|
|
Selector = $selector;
|
|
};
|
|
$found = $installed | Where-Object -FilterScript $filterCommand;
|
|
if( $found ) {
|
|
$result.Output = $found | & $removeCommand;
|
|
if( $? ) {
|
|
$result.Message = "$type removed.";
|
|
} else {
|
|
$result.Message = "$type not removed.";
|
|
$result.Error = $Error[0];
|
|
}
|
|
} else {
|
|
$result.Message = "$type not installed.";
|
|
}
|
|
$result | ConvertTo-Json -Depth 3 -Compress;
|
|
}
|
|
} *>&1 >> $logfile;
|
|
</File>
|
|
<File path="C:\Windows\Temp\remove-caps.ps1">
|
|
$selectors = @(
|
|
'Browser.InternetExplorer';
|
|
'MathRecognizer';
|
|
'Microsoft.Windows.Notepad';
|
|
'OpenSSH.Client';
|
|
'Microsoft.Windows.MSPaint';
|
|
'Microsoft.Windows.PowerShell.ISE';
|
|
'App.Support.QuickAssist';
|
|
'Microsoft.Windows.SnippingTool';
|
|
'App.StepsRecorder';
|
|
'Media.WindowsMediaPlayer';
|
|
'Microsoft.Windows.WordPad';
|
|
);
|
|
$getCommand = { Get-WindowsCapability -Online; };
|
|
$filterCommand = { ($_.Name -split '~')[0] -eq $selector; };
|
|
$removeCommand = {
|
|
[CmdletBinding()]
|
|
param(
|
|
[Parameter( Mandatory, ValueFromPipeline )]
|
|
$InputObject
|
|
);
|
|
process {
|
|
$InputObject | Remove-WindowsCapability -Online -ErrorAction 'Continue';
|
|
}
|
|
};
|
|
$type = 'Capability';
|
|
$logfile = 'C:\Windows\Temp\remove-caps.log';
|
|
& {
|
|
$installed = & $getCommand;
|
|
foreach( $selector in $selectors ) {
|
|
$result = [ordered] @{
|
|
Selector = $selector;
|
|
};
|
|
$found = $installed | Where-Object -FilterScript $filterCommand;
|
|
if( $found ) {
|
|
$result.Output = $found | & $removeCommand;
|
|
if( $? ) {
|
|
$result.Message = "$type removed.";
|
|
} else {
|
|
$result.Message = "$type not removed.";
|
|
$result.Error = $Error[0];
|
|
}
|
|
} else {
|
|
$result.Message = "$type not installed.";
|
|
}
|
|
$result | ConvertTo-Json -Depth 3 -Compress;
|
|
}
|
|
} *>&1 >> $logfile;
|
|
</File>
|
|
<File path="C:\Windows\Temp\remove-features.ps1">
|
|
$selectors = @(
|
|
'Microsoft-SnippingTool';
|
|
);
|
|
$getCommand = { Get-WindowsOptionalFeature -Online; };
|
|
$filterCommand = { $_.FeatureName -eq $selector; };
|
|
$removeCommand = {
|
|
[CmdletBinding()]
|
|
param(
|
|
[Parameter( Mandatory, ValueFromPipeline )]
|
|
$InputObject
|
|
);
|
|
process {
|
|
$InputObject | Disable-WindowsOptionalFeature -Online -Remove -NoRestart -ErrorAction 'Continue';
|
|
}
|
|
};
|
|
$type = 'Feature';
|
|
$logfile = 'C:\Windows\Temp\remove-features.log';
|
|
& {
|
|
$installed = & $getCommand;
|
|
foreach( $selector in $selectors ) {
|
|
$result = [ordered] @{
|
|
Selector = $selector;
|
|
};
|
|
$found = $installed | Where-Object -FilterScript $filterCommand;
|
|
if( $found ) {
|
|
$result.Output = $found | & $removeCommand;
|
|
if( $? ) {
|
|
$result.Message = "$type removed.";
|
|
} else {
|
|
$result.Message = "$type not removed.";
|
|
$result.Error = $Error[0];
|
|
}
|
|
} else {
|
|
$result.Message = "$type not installed.";
|
|
}
|
|
$result | ConvertTo-Json -Depth 3 -Compress;
|
|
}
|
|
} *>&1 >> $logfile;
|
|
</File>
|
|
<File path="C:\Users\Default\AppData\Local\Microsoft\Windows\Shell\LayoutModification.xml"><![CDATA[
|
|
<LayoutModificationTemplate Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification">
|
|
<LayoutOptions StartTileGroupCellWidth="6" />
|
|
<DefaultLayoutOverride>
|
|
<StartLayoutCollection>
|
|
<StartLayout GroupCellWidth="6" xmlns="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" />
|
|
</StartLayoutCollection>
|
|
</DefaultLayoutOverride>
|
|
</LayoutModificationTemplate>
|
|
]]></File>
|
|
<File path="C:\Windows\Setup\Scripts\ShowAllTrayIcons.ps1">
|
|
Set-Location -LiteralPath 'HKCU:\';
|
|
Get-Item -Path 'HKCU:\Control Panel\NotifyIconSettings\*' -ErrorAction 'SilentlyContinue' | ForEach-Object -Process {
|
|
$_ | Set-ItemProperty -Name 'IsPromoted' -Value 1 -Type 'DWord';
|
|
};
|
|
</File>
|
|
<File path="%TEMP%\disable-defender.ini">
|
|
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sense
|
|
"Start" = REG_DWORD 4
|
|
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdBoot
|
|
"Start" = REG_DWORD 4
|
|
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdFilter
|
|
"Start" = REG_DWORD 4
|
|
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisDrv
|
|
"Start" = REG_DWORD 4
|
|
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisSvc
|
|
"Start" = REG_DWORD 4
|
|
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend
|
|
"Start" = REG_DWORD 4
|
|
</File>
|
|
</Extensions>
|
|
</unattend> |