Generate autounattend.xml files for Windows 10/11 | Hacker News Reader

Generate autounattend.xml files for Windows 10/11

schneegans.de

224 pointsnixass79 comments

My favorite trick is to install with English (World) language to avoid auto-install of all sorts of crap. Windows Store won't work in this mode, but it's just a matter of reverting to your preferred language after first boot.

https://www.reddit.com/r/Windows11/comments/15gk07n/english_...

Edit: in my experience, changing the language to something else immediately after install is done still adds the crapware automatically. I think I needed to reboot once or twice for whatever post-install service Windows runs to no longer get executed.

For all of Windows faults, one thing I love about it is that (with persistence and skill) you can usually bang and hammer it into whatever shape you need it to be. Someone got XP running on a 486 using only a handful of MB memory recently.

The millions of registry options are not for joke, I guess

Yep, mostly thanks to enterprise. There's a group policy for just about anything you could ever imagine you'd want Windows to do (or not do).

Granted, a lot of it isn't super discoverable, or exposed to the user in a pretty GUI (it mostly lives deep within the registry, a good chunk undocumented), but it truly is a general purpose OS in every sense of the word.

Unlike most here I actually like and enjoy using Windows (doubly so with WSLv2 and the new windows terminal), although I'll admit since WSL I pretty much use Windows as if it were another Linux distro. But over the years I've come to learn a lot of the ins and outs of what it can do.

That said, if Microsoft continues down this MS account, consumer hostile behavior even more it's going to be time for me to say my goodbyes to windows.

> My favorite trick is to install with English (World) language to avoid auto-install of all sorts of crap.

Edit: This sounded neat so I tried it. I just loaded up a physical box from a 24H2 ISO on a thumb drive (booted from Ventoy with no special options loaded to bypass the Microsoft Account requirement).

I got an oddball "Something went wrong" / "You can try again, or skip for now" / "OOBEREGION" window with a silly and wholly inappropriate for a corporate-targeted OSA depiction of a dropped ice cream cone (pink flavor, by the look of it). I've definitely never seen this one before.

I clicked "Skip" and then it proceeded thru the OOBE as I'd expect, including demanding an Internet connection.

I added "BypassNRO" to the registry, rebooted, and completed the OOBE with a local account (seeing the same silly ice cream cone again).

Once I got into Windows I found the Start menu looked a little emptier than normal. Memory usage seems a little lower than I'd expect. The running process list is still ridiculously long.

I connected the Ethernet to a network with Internet access and didn't see a huge change.

The Store app doesn't work. It returns "Sorry about that!" / "Something went wrong...".

The Co-Pilot pinned shortcut returns a blue modal error dialog in the Windows 8 style saying "Search Support" / "Something happened on our end ... 0x87E10BC6".

Installing this way definitely did something. I'm just not sure exactly what. It'll be interesting to see what happens when the machine updates. I already see it loading drivers and doing device detects.

Screenshots and step-by-step of the process also here: https://www.wired.com/story/how-to-clean-install-windows-11

Update on this machine: After applying all pending updates to-date it has remained clean and runs about 2.7GB memory used at the desktop with nothing foreground open. While that offends my sensibilities in the general sense (remembering running Linux w/ X and Netscape in 8MB of RAM, or Windows XP in 128MB) that doesn't seem bad for what it is.

The level of workarounds that windows requires never cease to amaze me.

it's not just windows. every OS has "secret" options that a power user can use if only they knew about them.

Definitely. I have a script I run on new Macs to turn on/off various features, mostly using "defaults write".

Mind sharing it?

Workarounds to what?

Windows, just like any other operating system, has its set of contrivances for different functions (in this case automated installation). Having used RedHat Kickstart I don't see it as hugely different.

I assume this is being posted/upvoted in terms of “workaround for Microsoft Account requirement”. I actually mostly like Windows, but that particular thing they're pushing is more infuriating than any other, and there have been lots of others.

See the page's description for “Allow Windows 11 to be installed without internet connection”:

> This effectively runs the oobe\BypassNRO.cmd command, which was discovered by Reddit user AveYo. You still have to click the I don't have internet button during Windows Setup.

> Only check this option if your computer really does not have internet access. If you just want to create local (“offline”) user accounts in Windows 11, you can always do so in the _User accounts_ section of this form.

Thanks for that. I didn't even think about the whole Microsoft Account requirement in the context of unattended installs.

I like Windows quite a bit. I get unreasonably angry when the ability to see the source code would be useful, or when I can't minimize irritations by recompiling. I feel that way about all closed-source software, though. By and large I'm happy to use it for some things. I've used it a long time. I don't dislike it.

What's happening w/ Windows, though, fills me with frustration and sadness. The Microsoft Account requirement is absolutely asinine. The Windows 10 and later UI changes are ridiculous. The continued push to take away user rights on computers they own, by sinking DRM tendrils deeper into the OS, is frustrating.

It feels like developers w/ little to no real world experience using Windows and who have no ability to stand up to the whims of UI "designers" (who also don't seem to acutally use Windows), sales and marketing, and the copyright cartels have been put in charge of Windows.

These are commercial decisions, taken way above product people in most cases. Exploitative and user-hostile management occasionally drops their mask of serene and paternalistic benevolence, revealing the ugly truth of cut-throat corporate life.

It’s not an asinine requirement when you think of how users would otherwise have to store Bitlocker recovery keys. Microsoft would have to give up device encryption for the masses if there was no automatic off-device key storage.

For those that truly care to use a local account, there’s a SKU for that.

> For those that truly care to use a local account, there’s a SKU for that.

Curious if you mean LTSC or Enterprise or something else? https://learn.microsoft.com/en-us/dotnet/api/microsoft.power...

The problem with a lot of the other SKUs is the lack of a good way to buy a single license legitimately from Microsoft: https://old.reddit.com/r/Windows10LTSC/wiki/acquisition

I have used grey-market sellers in the past and had a great experience buying working individual licenses of Visual Studio, Office, Windows Server (I set up a domain so I could get my Group Policy on and kill the crap that way), and Windows 10 Enterprise (minimum SKU where the Telemetry-disabling GPO does anything). I only ever had one code that didn't work, and the seller immediately replaced it with one that did. Yes I know they're probably all bought with stolen credit cards, but once you activate it they don't take it back so I don't care lol

I haven't attempted to use Windows 11 at all though so I dunno if Windows 11 Enterprise would let me join my domain without Microsoft Account like 10 Enterprise does. I have zero desire to find out even once the 10 “““EOL””” date comes :(

> The problem with a lot of the other SKUs is the lack of a good way to buy a single license legitimately from Microsoft

because the higher ups at microsoft deems these SKUs not suitable for the average pleb on a home computer. They're intended for a fleet of commercial computers (like schools, libraries, offices etc), and priced to match the expected sale.

For home use, microsoft wants the user to be an obedient sheep, and gobble up whatever that is fed through the pipe. Soon enough, this will make the computer more of an appliance, than a computer - like a washing machine or TV, instead of a general machine capable of doing whatever the user commands.

FWIW, your Enterprise key for Win10 should also work to install Win11 enterprise (the MAK keys for the two versions are identical, even), so you can test this fairly easily if you're inclined. That said, I can aver that domain-joining in Win11 doesn't require an MS account - corporations would flip out if that requirement was extended to them.

Again: preferring a default is not a reason to take away an important choice.

I can see the argument for bitlocker for laptops, due to easier theft, but for desktops the tradeoff against being able to swap disks is one to consider.

(I'm in an odd position: I tried to avoid using my Microsoft account for a new PC, gave up and logged in, then it decided the account was somehow unsuitable and gave me the local account I wanted anyway.)

The masses don't "swap disks" and it isn't like desktops aren't stolen, as well.

have you tried installing win11 and creating an account without internet access?

After their most recent shenanigans, the writing is on the wall, the nails are in the coffin - https://www.pcgamer.com/software/operating-systems/microsoft...

They've disabled the ability to finish Windows installation without having an internet connection and connecting your Microsoft account.

> According to a Windows Insider blog post announcing Preview build 26200.5516 (KB5054687) the bypassnro.cmd script has been removed in order to "enhance security and user experience of Windows 11."

> "This change ensures that all users exit setup with internet connectivity and a Microsoft Account."

lol.

Never been a better time to jump ship to Linux, honestly. I held out for ages because I was a princess and wanted everything to be perfect. I used Linux 24x7 as an admin and developer, but from afar and never locally as my daily driver. Finally bit the bullet July '23 and it has been nothing but smooth sailing.

I just deployed three new Windows 11 Pro machines yesterday (two HP, one Dell) with local accounts. The HP OEM image was pre-24H2 so it doesn't count, but the Dell machine was 24H2.

I booted to the OOBE, hit <SHIFT>-<F10>, ran:

   REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\OOBE /v BypassNRO /t REG_DWORD /d 1

   shutdown -r -t 1 -f

Waited for the machine to reboot and ran thru the OOBE w/o connecting to a network. Once I got logged-on w/ my local account connected to the Wi-Fi and joined the Active Directory domain.

Sorry to be blunt, but if this is not a workaround, then I don't know what is.

Yes-- that particular procedure is a workaround. My first post was asking why unattended installation, arguably a feature, is some kind of "workaround".

Does pro not have the “domain join instead” option in OOBE anymore? It definitely used to, and Enterprise does.

I don’t understand how you’d domain join otherwise.

Pro doesn't have an option to join a domain in the default OOBE. I think that went away in some iteration of 10.

Pro definitely doesn't because the above procedure is what I always have to do to get joined to a domain without creating or using a Microsoft Account. (And then I've got a local account to clean up.)

It does, I just made a Windows 11 Pro 24H2 VM for testing (with the stock ISO) and used the "domain join" option to make a local account.

With an unattended install, sure. The OOBE doesn't give you that option by default.

I got that option via OOBE, not automated install.

I don't think this is the way it should be, but just to answer your question, you'd go through the normal setup for a single user PC, then join AD in the Settings app.

Older versions of Windows allowed domain join in the OOBE. It was handy.

you can also do ipconfig /release in some contexts (works in hyperv but never in the real world for some reason sigh)

Hold on.

They're saying with a straight face that connecting to the Internet is required in order to enhance security?

Workarounds on Linux systems are necessary for possible hardware compatibility issues or bugs which are not intentional.

Workarounds for commercial OSes are necessary to avoid user-hostile behaviors that are completely intentional and likely to get worse over time.

I just stick to qubes, thanks but nothanks. To treat every OS as hostile seems to be the sane solution these days.

Why should I treat my Arch installation as hostile? Seems unreasonably paranoid.

In case of supply chain attacks? Running a minimal OS that then runs everything else in VMs seems an effective way to minimise damage.

Using Qubes is orthogonal to what operating systems you're running as guests within it. Every OS is hostile, if only passively (leaking information to the network in the myriad of ways that have become acceptable today, for example).

Yeah, but it's a breeze compared to making GNOME usable; hamburger menus everywhere!!11!

Wait is there a way to turn those back into regular menu bars?

ya it's called KDE

Hmm, I've a deja-vu... My mind tells me I've read these three comments before on a different topic... If I don't forget, I'll have to check tomorrow on a real PC.

I've been using XFCE ever since Ubuntu decided the future of desktop computing was to imagine that your monitor was an iPhone, and GNOME inexplicably decided that they needed to copy that approach as soon as possible.

I thought that way too (even having gone to tiling windows managers), but gnome is fine and way usable than macOS. The few applications where I use the menu still have it, and so far I’m only using one extension (for clipboard managememt).

Fine is how I describe most things which are disappointing me.

There's just no reason given the architecture of it that the hamburger menus shouldnt be toggleable to just be menu bars. And menubars were a perfectly good solution for mouse interaction.

The menu bar is a useful pattern, but a lot of applications don't need it. Especially if the focus is on a single task. In this case it's preferable to have a few buttons that are always useful, a handful of options tucked away, and a settings dialog for configuring the behavior of the software. And for the software that don't fit in this category (LibreOffice, GIMP, Audacity,...), they can still have the menu bar.

The menu bar isn't obtrusive, but for a lot of software, it's just quick access to common settings (VLC).

My favorite is that even Microsoft themselves maintain MIT licensed debloat scripts of their own software.

https://github.com/microsoft/windows-dev-box-setup-scripts/b...

I really gotta ask Microsoft about that beer they owe me :)

That's wild. They should at least give you some Microsoft dollars for their company store :)

This is the best joke I have seen in a while.

Since i‘ve been doing this sort of thing for many years here are some basic rules: - Get LTSC (W10) or IoT/Enterprise (W11) images to begin with - Get https://www.ntlite.com/ .. you won‘t find any other tool which does a better job at removing packages, adding drivers, etc. Worth every penny with great support. - Use GroupPolicies to configure your system. Take the time and download them for Office, Edge, Chrome, Firefox and update those that come with Windows. - Integrate drivers not only for the base image but also in the recovery and setup image. - Install a firewall (binisoft is fine) - Use NextDNS - If you don’t mind the security implications: Disable Defender, SmartScreen, BootGuard and VBS (use bcdedit) - Disable Microcode loading (delete the DLL) - Disable Spectre/Meltdown mitigations - If you need Office: Use the LTSC version

Most third party tools are outdated or do stupid stuff which isn’t needed. You can silence Windows with the right GroupPolicies quite easy.

No one should follow those suggestions. They’re wholly unnecessary and plain bad security practices. You make yourself/users significantly more vulnerable with these suggestions for no gain.

Disable all antivirsus capabilities, microcode and spectre/meltdown mitigations...

Can't believe NSO group is here doing some weird psyop. Very funny.

Exactly what is this trying to achieve? Running a third party tool to modify the OS, disabling security features, using "downloaded" group policies (what policies?), and sending all your DNS traffic to a third party (when on PC it's possible to just modify the etc/hosts file) -- these aren't exactly the best security practices. The only reasonable suggestion is the IoT Windows version.

Agreed with the "what does this achieve". In Corporate environments you would use SCCM or simply the Windows ADK plus WDS.

Installing a custom Firewall and Antivirus ist straight counteproductive, as ist disabling security features... obvisouly.

Downloading and installing group policies however is often required and a typical enterprise scenario.

Whenever I hear people praise these kind of things I know they don't really have any professional knowledge. It's fine to configure your own system, but suggesting these things SHOULD be done pisses me off to no end.

Seems i lack a lot of professional knowledge so please enlighten me on how you would do it.

Why use ADK or SCCM for a personal install?

The custom firewall is just a frontend for the builtin firewall.

GP reg keys are used by many third party tools to alter the system. So why use extra software if you can get this directly from the vendor?

And also a rant about anti virus: What do think is the first thing malware does? How does your system get infected if you are using an updated browser, open mails in it and use it for viewing attachments like PDF? Maybe there is even malware out there that does take advantage of high jacking the anti virus and its system priviliges? But who knows… it always depends on the user and the use case.

Make the system need way less ressouces and get way more raw compute power.

There‘s a reason i wrote a hint about the security. If you keep this in mind and know what you are doing (like take such a setup as a base for VMs) this totally fine.

I am also not aware of any Spectre/Meltdown exploits ever to be found in the wild. If you are not running on a shared system i don’t see a need for those mitigations.

Regarding the third party tool: NTlite uses `dism` under the hood with which you can achieve the same results. You are already sending your DNS to a third party (like your ISP).

You also should never ever alter the hosts file and abuse it for ad blocking and such.

Microsoft supplies the latest group policies for their software. Or how else do you handle those on a local system?

I never said my post was about security but on how to alter your local system in a „more correct“ way with a clear hint about security. If you don’t know what you are doing then you should think twice when touching your system.

Doing things for many years doesnt mean you are experienced. Half the stuff you recommend would land straight in the bin of any person who truly has some idea of security, not speaking of true professionals.

> Always show file extensions; Use classic context (right-click) menu; Show End task command in the taskbar; Hide search box; Do not show Bing results when searching; Enable long paths; Prevent Windows Update from rebooting your computer; ...

I'd definitely love a .reg file generator website like this one, to apply some of these settings after the fact!

Check WinAero tweaker. I don't remember it creating a .reg file but it can export & import the tweaks you've applied.

Hmm, no way to turn off the sticky keys shortcuts and similar; I hit those by accident _constantly_ on new machines.

You could achieve this with the “Run Custom Scripts” option and the appropriate Registry values:

    HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys\Flags="506"

    HKEY_CURRENT_USER\Control Panel\Accessibility\MouseKeys\Flags="58"

    HKEY_CURRENT_USER\Control Panel\Accessibility\ToggleKeys\Flags="58"

See here for more a much more detailed example: https://github.com/dreikanter/win-tweaks/blob/master/complet...

I recently used this generator to deploy a fleet of Windows 11 Enterprise virtual machines in VMWare Workstation. Very nice.

We need one of these for .debs. The answer files are easy to generate after installing once but it would be better to have an HTML ui that catered for every annoying .deb that can't think up sensible defaults for itself.

For Debian it's trivial to do so. `debconf-set-selections` is your friend, if you want something for unattended installations you can embed that into `live-boot` or into FAI.

[1] https://manpages.debian.org/testing/debconf/debconf-set-sele...

I could have definitely used this a few weeks ago! Very nice.

I could have used it a decade ago!

Now could someone please fix the BCD store mess?

Unattend has been part of windows setup for way longer than a decade.

The current form of it was introduced in Vista.

The same concept existed before, but I know less about how it worked back then.

Even without unattend, something I think people don't realize is that you can install windows on the command line. Diskpart to partition, dism /apply-image to extract files, then bcdboot to install the bootloader.

So have I, having failed to manage installing Win 11 without a MS account in the end. Actually I only wanted to complete a dual-boot Win 10/11 setup without having to haphazardly install Win 11 on top later, not actually use Win 11.

I've used unattend.xml to put C:\Users on a hard drive, leaving the rest on a SSD, so I don't need to think about what files go where. Documentation specifically warns against doing it that way, but I ran Windows 7 and 10 that way for over 12 years with precisely 0 issues with it.

Now I run Linux with / on a hard drive and /usr on SSD.

Normally on Linux you'd put /home on a different drive/partition, which I do mainly for upgrade purposes (I upgrade my root filesystem to a new distro/distro version and then mount my home dir on the fresh install)

GP's just returning to the Unix style, though they typically had /usr on NAS (which is why some things were in /bin instead of /usr/bin, for example.)

I love the option for "Use a solid color background:" is Windows 95 background color. I love that color.

This talks about unattended installs yada yada. I go to CostCo, I buy a Windows 11 laptop, I turn it on. Does this xml file help me with this? I've done the "no internet" trick before, but does that still work?

This would not help you unless you were planning to reimage the laptop. It’s a tool that makes it easier to build custom images, which are usually deployed at scale in enterprise environments.

Does anyone know if it’s possible to disable autopilot/mdm with this?

could you please add enterprise iot versions? it looks great :)

Or you know, use the Windows ADK and do it like a pro. Sigh... This is a completely useless tool...

Reply on news.ycombinator.com