Home 零对冲(ZeroHedge)每日HackerNews

生成适用于 Windows 10/11 的 autounattend.xml 文件
Generate autounattend.xml files for Windows 10/11

原始链接: https://schneegans.de/windows/unattend-generator/

本文件描述了一个工具，用于通过 `autounattend.xml` 文件创建自动化的 Windows 安装配置。它允许自定义安装过程的各个方面，包括语言和区域设置、分区和格式化、Windows 版本选择以及用户帐户设置。 主要功能包括设置计算机名称（随机或指定）、配置精简操作系统、指定时区、分区磁盘、输入产品密钥以及配置本地用户帐户。它提供选项来删除臃肿软件，自定义开始菜单和任务栏，禁用 Windows Defender 和更新，调整文件资源管理器设置以及调整视觉效果。 该工具能够绕过 Windows 11 的要求，在没有互联网连接的情况下安装，并在安装的不同阶段执行自定义脚本。高级选项包括配置 Windows Defender 应用控制 (WDAC)、安装虚拟机的访客添加、设置 Wi-Fi 和调整隐私设置。您可以将配置下载为 `autounattend.xml` 文件，可以直接用于 Windows 安装程序。

Hacker News 最新 | 过去 | 评论 | 提问 | 展示 | 招聘 | 提交 登录 生成 Windows 10/11 的 autounattend.xml 文件 (schneegans.de) nixass 1小时前 6 分 | 隐藏 | 过去 | 收藏 | 讨论 加入我们，参加 6 月 16-17 日在旧金山举办的 AI 初创公司学校！ 指南 | 常见问题 | 列表 | API | 安全 | 法律 | 申请 YC | 联系我们 搜索：
相关文章
原文
Region and language settings:
Choose language preferences and keyboard layouts Select one or more languages in order of preference. The first language will also determine the initial regional format, which defines how numbers, dates, times and currency are formatted. You can change the regional format later.
Processor architectures:

When you select multiple processor architectures, a single autounattend.xml file will be created that is applicable to all of these architectures.

Setup settings:
This effectively runs the oobe\BypassNRO.cmd command, which was discovered by Reddit user AveYo. You still have to click the I don't have internet button during Windows Setup.

Only check this option if your computer really does not have internet access. If you just want to create local (“offline”) user accounts in Windows 11, you can always do so in the User accounts section of this form.

This makes Windows Setup look for a folder named $OEM$ in the root of the drive where your autounattend.xml file is located and copy its contents to the target partition. By default, PowerShell scripts that run during Windows Setup will have a visible window. This makes debugging easier and lets you use interactive prompts in your scripts, but also carries the risk that this window gets inadvertently or deliberately closed, which would kill the script. If you choose to hide PowerShell windows, any PowerShell scripts during Windows Setup will be run with the -WindowStyle Hidden switch. Computer name:

Your script will be evaluated during Windows Setup. The script must return a single string, which must be a valid computer name. You can also use a script such as return Read-Host -Prompt 'Enter computer name'; to create an interactive prompt.

Compact OS: Time zone:
This is useful when your country or region spans multiple time zones, like Australia or the United States.
Partitioning and formatting:
Choose partition layout
The GPT partition layout must be used for UEFI systems. Set the size of the EFI System Partition (ESP) to MB.
MBR The MBR-based partition layout must be used for legacy BIOS systems.
Choose how to install Windows RE
Create a separate partition with a size of MB and install Windows RE to it.
This will install Windows RE in C:\Recovery. No recovery partition will be created. This will delete the C:\Recovery folder and thus free about 600 MB of disk space. No recovery partition will be created. Windows 24H2 seems to ignore this setting and will always create a recovery partition with a minimum size of 600 MB.

If your disk is already partitioned and formatted, enter a diskpart command that has no effect, like REM or SELECT DISK=0. Also note that drive letter assignments (e.g. ASSIGN LETTER=R) will not persist.

Choose partition to install Windows to after script has run

When you let Windows Setup partition your disks unattendedly, there is a risk they were assigned unexpected index numbers. In rare cases, disk 0 does not refer to your primary hard drive, but rather your USB thumb drive. You can therefore provide VBScript code to check the assigned disk index numbers before diskpart is run. If your script returns with WScript.Quit 1, Windows Setup will halt to avoid data loss.

Windows edition:
Such a key can be used to install Windows, but will not activate it. You can change the product key later.
You can also enter your key in the autounattend.xml file yourself to avoid disclosing it. To do so, find the <Key>00000-00000-00000-00000-00000</Key> element and replace the text with your own key. Choose this if your computer came pre-installed with Windows and you want to reuse that license. User accounts:

Leave Display name empty unless you want it to be different from Account name.

First logon

Several settings will only be applied when an administrator logs on for the first time. You should therefore let Windows log you on to an administrator account once – this does not affect subsequent logons. Choose which account to use for this:

The installation ends with the sign-in screen being shown.
Password expiration: This is in accordance to NIST guidelines that no longer recommend password expiration. Passwords expire after 42 days.
Passwords expire after days.

These settings only apply to local accounts. Also, the password of the built-in account Administrator never expires.

Account Lockout policy: By default, Windows will lock out an account after 10 failed logon attempts (threshold) within 10 minutes (window). After 10 minutes (duration), the account is unlocked automatically. Disabling Account Lockout might leave your computer vulnerable to brute-force attacks.
Lock out an account after failed logon attempts within minutes. After minutes, unlock the account automatically.
File Explorer tweaks:
Choose which files are hidden in File Explorer This will hide any file that has the Hidden attribute set. This will only hide files that have both the Hidden and the System attribute set. This setting is recommended for advanced users.
By default, File Explorer would hide extensions for known file types. Start menu and taskbar:
Choose how to display the search box in the taskbar
Choose icons to display in the taskbar
See Microsoft's documentation for more examples.
This hides the news and weather widget in the lower-left corner in Windows 11. On Windows 10, this will simply set the EnableAutoTray registry value. On Windows 11, this will create a scheduled task that runs periodically in the background and sets all tray icons visible.
Windows 10

Configure the tiles that are initially shown in the Windows 10 Start menu. You can add or remove tiles later. On Windows 11, this setting is simply ignored.

If you select apps in the Remove bloatware section below, Windows 10 will automatically remove their tiles from the Start menu.
Windows 11

Configure the pins that are initially shown in the Windows 11 Start menu. You can add or remove pins later. On Windows 10, this setting is simply ignored.

Avoid this setting if you select apps in the Remove bloatware section below, as Windows 11 will deceptively retain their pins in the Start menu.
System tweaks:
This disables certain services (Sense, WdBoot, WdFilter, WdNisDrv, WdNisSvc, WinDefend) during the Windows PE stage of Windows Setup and thus prevents the MsMpEng.exe process from running. This method was adapted from an article by Rudy Mens.
This will create a scheduled task (named PauseWindowsUpdate) that pauses updates for one week again and again. If you want to run Windows Update for once, click Resume updates in Settings. If you want to enable Windows Update permanently, disable or delete that task.
This turns Smart App Control off in Windows 11. Note that you will not be able to turn it back on. Windows will not create restore points for drive C: and thus use less disk space. This sets the LongPathsEnabled registry value, which enables several programs (including PowerShell, 7-Zip and TreeSize) to use long paths with up to 32,767 characters without resorting to the \\?\ prefix. This removes write permissions on C:\ for the Authenticated Users group. In particular, this prevents unprivileged users from creating bogus folders such as C:\Windows . This runs the command Set-ExecutionPolicy -ExecutionPolicy 'RemoteSigned', which allows the execution of unsigned .ps1 files. This runs the command fsutil.exe behavior set disableLastAccess 1, which can improve file system performance. This creates a scheduled task that periodically moves your active hours, tricking Windows into thinking your device is in use all the time. This changes the sound scheme from Windows Default to No sounds for all users. This sets several registry values that prevent the silent download and installation of suggested apps. Note that as a side effect this will also disable the Manage devices button in the Mobile devices section in Settings. If this bothers you, change the value of DisableWindowsConsumerFeatures to 0. Windows 11 would otherwise enable BitLocker encryption automatically. This will modify the C:\Windows\System32\IntegratedServicesRegionPolicySet.json file such that Edge can be uninstalled even outside the European Economic Area. Note that Windows Update will eventually reset the file to its original state. Therefore, if you want to uninstall Edge, do so right after Windows has been installed. Also, you might see an error 0x80070306 when installing a cumulative update (such as KB5048667), but this should get resolved when you repeat the installation of that update. This may be useful for players of first-person shooters.
Each time a new process is created, Windows writes an event to the Security log. This is a powerful tool for troubleshooting.
Visual effects:

Desktop icons:

Virtual machine support:

Make sure to check the usage notes for how to properly configure your VM.

WLAN / Wi-Fi setup: Choose this if you have a wired connection to the internet.

If both your Wi-Fi router and your computer's Wi-Fi adapter support it, make sure to select WPA3. Otherwise, Windows Setup will try to switch from WPA2 to WPA3 and require manual interaction.

You should not enter your actual Wi-Fi password here. Once you have downloaded the autounattend.xml file, find the password enclosed in <keyMaterial>…</keyMaterial> and adjust it.

Express settings: Windows will not send diagnostic data, personalized input or your location history to Microsoft. Choose this if you value privacy. Windows will send data to Microsoft to provide location-based services, improve language recognition, and show personalized ads. This lets you enable some settings while disabling others. Lock key settings:
Key Initial state When pressed
Caps Lock
Num Lock
Scroll Lock

This will affect all users and also the login screen.

Personalization settings:

These settings are particularly useful if you want to use Windows without activation when the Personalization settings page is not available.

Colors
Desktop wallpaper

Your script will be evaluated during Windows Setup, after your computer has connected to a network. The script must return a byte[] value, which must contain the image data. For example, you can download an image from the internet, locate an image file on a removable drive or a network share and load it via [IO.File]::ReadAllBytes, or provide the image data directly via [convert]::FromBase64String.

Remove bloatware:

Windows comes with several apps that many users do not want or do not need. Check all the apps you want removed during Windows Setup:

Bloatware removal works best with the original Windows 10 and 11 .iso images downloaded from Microsoft. I did not perform any tests with custom images.

Run custom scripts:

You may want to take a look at some sample scripts first.

Scripts to run in the system context, before user accounts are created
  1. Run