jacob.b.nelson2
e4741ccc96
Fully unattended Windows 11 Pro build using Autounattend.xml, swtpm for TPM 2.0 emulation, and VirtIO drivers. Five PowerShell provisioners strip bloatware, telemetry, unused services, and apply performance tuning for a resource-constrained host. Output is a compressed QCOW2 image. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
287 lines
11 KiB
XML
287 lines
11 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<unattend xmlns="urn:schemas-microsoft-com:unattend">
|
|
|
|
<!-- ================================================================
|
|
Pass 1: windowsPE — runs inside WinPE before installation begins
|
|
================================================================ -->
|
|
<settings pass="windowsPE">
|
|
|
|
<component name="Microsoft-Windows-International-Core-WinPE"
|
|
processorArchitecture="amd64"
|
|
publicKeyToken="31bf3856ad364e35"
|
|
language="neutral"
|
|
versionScope="nonSxS"
|
|
xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
|
|
<SetupUILanguage>
|
|
<UILanguage>en-US</UILanguage>
|
|
</SetupUILanguage>
|
|
<InputLocale>en-US</InputLocale>
|
|
<SystemLocale>en-US</SystemLocale>
|
|
<UILanguage>en-US</UILanguage>
|
|
<UserLocale>en-US</UserLocale>
|
|
</component>
|
|
|
|
<!-- Inject VirtIO SCSI storage driver so the virtio-scsi disk is visible.
|
|
Packer mounts three CD-ROMs (Windows ISO, Autounattend CD, VirtIO ISO)
|
|
in unspecified order; searching D-G covers all practical assignments. -->
|
|
<component name="Microsoft-Windows-PnpCustomizationsWinPE"
|
|
processorArchitecture="amd64"
|
|
publicKeyToken="31bf3856ad364e35"
|
|
language="neutral"
|
|
versionScope="nonSxS"
|
|
xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
|
|
<DriverPaths>
|
|
<PathAndCredentials wcm:action="add" wcm:keyValue="D">
|
|
<Path>D:\amd64\w11</Path>
|
|
</PathAndCredentials>
|
|
<PathAndCredentials wcm:action="add" wcm:keyValue="E">
|
|
<Path>E:\amd64\w11</Path>
|
|
</PathAndCredentials>
|
|
<PathAndCredentials wcm:action="add" wcm:keyValue="F">
|
|
<Path>F:\amd64\w11</Path>
|
|
</PathAndCredentials>
|
|
<PathAndCredentials wcm:action="add" wcm:keyValue="G">
|
|
<Path>G:\amd64\w11</Path>
|
|
</PathAndCredentials>
|
|
</DriverPaths>
|
|
</component>
|
|
|
|
<component name="Microsoft-Windows-Setup"
|
|
processorArchitecture="amd64"
|
|
publicKeyToken="31bf3856ad364e35"
|
|
language="neutral"
|
|
versionScope="nonSxS"
|
|
xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
|
|
|
|
<!-- Bypass Secure Boot and RAM requirements.
|
|
TPM 2.0 is provided by swtpm so no TPM bypass is needed.
|
|
OVMF_CODE.fd does not emulate Secure Boot; bypass prevents setup from blocking. -->
|
|
<RunSynchronousCommands wcm:action="add">
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>1</Order>
|
|
<Path>cmd.exe /c reg add "HKLM\SYSTEM\Setup\LabConfig" /v BypassSecureBootCheck /t REG_DWORD /d 1 /f</Path>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>2</Order>
|
|
<Path>cmd.exe /c reg add "HKLM\SYSTEM\Setup\LabConfig" /v BypassRAMCheck /t REG_DWORD /d 1 /f</Path>
|
|
</RunSynchronousCommand>
|
|
</RunSynchronousCommands>
|
|
|
|
<AcceptEula>true</AcceptEula>
|
|
|
|
<!-- Select Windows 11 Pro by name (safer than index, which varies between ISOs) -->
|
|
<ImageInstall>
|
|
<OSImage>
|
|
<InstallFrom>
|
|
<MetaData wcm:action="add">
|
|
<Key>/IMAGE/NAME</Key>
|
|
<Value>Windows 11 Pro</Value>
|
|
</MetaData>
|
|
</InstallFrom>
|
|
<InstallTo>
|
|
<DiskID>0</DiskID>
|
|
<PartitionID>3</PartitionID>
|
|
</InstallTo>
|
|
<WillShowUI>OnError</WillShowUI>
|
|
</OSImage>
|
|
</ImageInstall>
|
|
|
|
<!-- Generic KMS client key for Windows 11 Pro — allows installation to proceed.
|
|
This is NOT an activation key; activate Windows separately after build. -->
|
|
<UserData>
|
|
<AcceptEula>true</AcceptEula>
|
|
<FullName>Administrator</FullName>
|
|
<Organization>Lab</Organization>
|
|
<ProductKey>
|
|
<Key>W269N-WFGWX-YVC9B-4J6C9-T83GX</Key>
|
|
<WillShowUI>OnError</WillShowUI>
|
|
</ProductKey>
|
|
</UserData>
|
|
|
|
<!-- GPT partition layout for UEFI boot -->
|
|
<DiskConfiguration>
|
|
<Disk wcm:action="add">
|
|
<DiskID>0</DiskID>
|
|
<WillWipeDisk>true</WillWipeDisk>
|
|
<CreatePartitions>
|
|
<CreatePartition wcm:action="add">
|
|
<Order>1</Order>
|
|
<Type>EFI</Type>
|
|
<Size>100</Size>
|
|
</CreatePartition>
|
|
<CreatePartition wcm:action="add">
|
|
<Order>2</Order>
|
|
<Type>MSR</Type>
|
|
<Size>16</Size>
|
|
</CreatePartition>
|
|
<CreatePartition wcm:action="add">
|
|
<Order>3</Order>
|
|
<Type>Primary</Type>
|
|
<Extend>true</Extend>
|
|
</CreatePartition>
|
|
</CreatePartitions>
|
|
<ModifyPartitions>
|
|
<ModifyPartition wcm:action="add">
|
|
<Order>1</Order>
|
|
<PartitionID>1</PartitionID>
|
|
<Label>System</Label>
|
|
<Format>FAT32</Format>
|
|
</ModifyPartition>
|
|
<ModifyPartition wcm:action="add">
|
|
<Order>2</Order>
|
|
<PartitionID>2</PartitionID>
|
|
</ModifyPartition>
|
|
<ModifyPartition wcm:action="add">
|
|
<Order>3</Order>
|
|
<PartitionID>3</PartitionID>
|
|
<Label>Windows</Label>
|
|
<Format>NTFS</Format>
|
|
<Letter>C</Letter>
|
|
</ModifyPartition>
|
|
</ModifyPartitions>
|
|
</Disk>
|
|
</DiskConfiguration>
|
|
|
|
</component>
|
|
</settings>
|
|
|
|
<!-- ================================================================
|
|
Pass 4: specialize — first boot of the installed OS, pre-OOBE
|
|
================================================================ -->
|
|
<settings pass="specialize">
|
|
|
|
<component name="Microsoft-Windows-Shell-Setup"
|
|
processorArchitecture="amd64"
|
|
publicKeyToken="31bf3856ad364e35"
|
|
language="neutral"
|
|
versionScope="nonSxS"
|
|
xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
|
|
<ComputerName>WINDOWS11-LITE</ComputerName>
|
|
<TimeZone>UTC</TimeZone>
|
|
</component>
|
|
|
|
<component name="Microsoft-Windows-Security-SPP-UX"
|
|
processorArchitecture="amd64"
|
|
publicKeyToken="31bf3856ad364e35"
|
|
language="neutral"
|
|
versionScope="nonSxS"
|
|
xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
|
|
<SkipAutoActivation>true</SkipAutoActivation>
|
|
</component>
|
|
|
|
<component name="Microsoft-Windows-SQMApi"
|
|
processorArchitecture="amd64"
|
|
publicKeyToken="31bf3856ad364e35"
|
|
language="neutral"
|
|
versionScope="nonSxS"
|
|
xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
|
|
<CEIPEnabled>0</CEIPEnabled>
|
|
</component>
|
|
|
|
</settings>
|
|
|
|
<!-- ================================================================
|
|
Pass 7: oobeSystem — OOBE configuration and first-logon commands
|
|
================================================================ -->
|
|
<settings pass="oobeSystem">
|
|
|
|
<component name="Microsoft-Windows-International-Core"
|
|
processorArchitecture="amd64"
|
|
publicKeyToken="31bf3856ad364e35"
|
|
language="neutral"
|
|
versionScope="nonSxS"
|
|
xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
|
|
<InputLocale>en-US</InputLocale>
|
|
<SystemLocale>en-US</SystemLocale>
|
|
<UILanguage>en-US</UILanguage>
|
|
<UILanguageFallback>en-US</UILanguageFallback>
|
|
<UserLocale>en-US</UserLocale>
|
|
</component>
|
|
|
|
<component name="Microsoft-Windows-Shell-Setup"
|
|
processorArchitecture="amd64"
|
|
publicKeyToken="31bf3856ad364e35"
|
|
language="neutral"
|
|
versionScope="nonSxS"
|
|
xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
|
|
|
|
<OOBE>
|
|
<HideEULAPage>true</HideEULAPage>
|
|
<HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
|
|
<HideOnlineAccountScreens>true</HideOnlineAccountScreens>
|
|
<HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
|
|
<NetworkLocation>Work</NetworkLocation>
|
|
<ProtectYourPC>3</ProtectYourPC>
|
|
<SkipUserOOBE>true</SkipUserOOBE>
|
|
<SkipMachineOOBE>true</SkipMachineOOBE>
|
|
</OOBE>
|
|
|
|
<!-- Enable the built-in Administrator account with a known password.
|
|
The password here must match the winrm_password Packer variable. -->
|
|
<UserAccounts>
|
|
<AdministratorPassword>
|
|
<Value>Packer1234!</Value>
|
|
<PlainText>true</PlainText>
|
|
</AdministratorPassword>
|
|
</UserAccounts>
|
|
|
|
<AutoLogon>
|
|
<Password>
|
|
<Value>Packer1234!</Value>
|
|
<PlainText>true</PlainText>
|
|
</Password>
|
|
<Enabled>true</Enabled>
|
|
<LogonCount>8</LogonCount>
|
|
<Username>Administrator</Username>
|
|
</AutoLogon>
|
|
|
|
<FirstLogonCommands>
|
|
<SynchronousCommand wcm:action="add">
|
|
<Order>1</Order>
|
|
<CommandLine>cmd.exe /c net user administrator /active:yes</CommandLine>
|
|
</SynchronousCommand>
|
|
<!-- Allow OOBE to complete without a network connection (Windows 11 22H2+) -->
|
|
<SynchronousCommand wcm:action="add">
|
|
<Order>2</Order>
|
|
<CommandLine>cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f</CommandLine>
|
|
</SynchronousCommand>
|
|
<!-- WinRM setup so Packer provisioners can connect -->
|
|
<SynchronousCommand wcm:action="add">
|
|
<Order>3</Order>
|
|
<CommandLine>cmd.exe /c winrm quickconfig -q</CommandLine>
|
|
</SynchronousCommand>
|
|
<SynchronousCommand wcm:action="add">
|
|
<Order>4</Order>
|
|
<CommandLine>cmd.exe /c winrm set winrm/config/service @{AllowUnencrypted="true"}</CommandLine>
|
|
</SynchronousCommand>
|
|
<SynchronousCommand wcm:action="add">
|
|
<Order>5</Order>
|
|
<CommandLine>cmd.exe /c winrm set winrm/config/service/auth @{Basic="true"}</CommandLine>
|
|
</SynchronousCommand>
|
|
<SynchronousCommand wcm:action="add">
|
|
<Order>6</Order>
|
|
<CommandLine>cmd.exe /c winrm set winrm/config/winrs @{MaxMemoryPerShellMB="512"}</CommandLine>
|
|
</SynchronousCommand>
|
|
<SynchronousCommand wcm:action="add">
|
|
<Order>7</Order>
|
|
<CommandLine>cmd.exe /c netsh advfirewall firewall add rule name="WinRM-HTTP" protocol=TCP dir=in localport=5985 action=allow</CommandLine>
|
|
</SynchronousCommand>
|
|
<SynchronousCommand wcm:action="add">
|
|
<Order>8</Order>
|
|
<CommandLine>cmd.exe /c sc config winrm start= auto</CommandLine>
|
|
</SynchronousCommand>
|
|
</FirstLogonCommands>
|
|
|
|
</component>
|
|
</settings>
|
|
|
|
</unattend>
|