Timmy
c84e18bd9d
把分散在 unattend.xml inline 的網路相依步驟（OpenSSH/Telegram/RemoveAI）和 新加入的 10 個 post-install 動作整合進獨立的 Setup.ps1，由 FirstLogonCommands Order 4 從 Ventoy USB（/ventoy/script/Setup.ps1）掃磁碟複製到 C:\Scripts\， Order 5 執行。腳本分兩 phase： Phase 1（不需網路）：SSH 22 防火牆、RDP+3389、ICMP Echo、WinRM TrustedHosts=*、 移 OneDrive、關 Cortana/WebSearch、套 UI/IME 預設到 Default profile、user→User 改名 + 從登入畫面隱藏 Admin。 Phase 2（要網路，wait-network 後）：OpenSSH Server FoD、KMS 啟用（先試 $InternalKmsServers 後 fallback 公開 KMS）、winget Chrome、RemoveWindowsAI、 Win11Debloat、22 個 UWP 移除、Telegram、刪 Panther 殘留。 每段以 Section 包裝寫獨立 START/DONE/ERR 到 C:\Windows\Temp\setup.log，方便逐段 重跑與排查。 文件全部同步：DEPLOY/QUICKSTART/SUMMARY/README/CLAUDE 都加上 Setup.ps1 的 USB 部署、cp 步驟、Order 表、排查指引。 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
198 lines
8.9 KiB
XML
198 lines
8.9 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
||
<unattend xmlns="urn:schemas-microsoft-com:unattend"
|
||
xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
|
||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
|
||
|
||
<!-- Pass 1: windowsPE — 安裝前的基本設定 -->
|
||
<settings pass="windowsPE">
|
||
<component name="Microsoft-Windows-International-Core-WinPE"
|
||
processorArchitecture="amd64"
|
||
publicKeyToken="31bf3856ad364e35"
|
||
language="neutral"
|
||
versionScope="nonSxS">
|
||
<SetupUILanguage>
|
||
<UILanguage>zh-TW</UILanguage>
|
||
</SetupUILanguage>
|
||
<InputLocale>0404:00000404</InputLocale> <!-- 繁體中文鍵盤 -->
|
||
<SystemLocale>zh-TW</SystemLocale>
|
||
<UILanguage>zh-TW</UILanguage>
|
||
<UserLocale>zh-TW</UserLocale>
|
||
</component>
|
||
|
||
<component name="Microsoft-Windows-Setup"
|
||
processorArchitecture="amd64"
|
||
publicKeyToken="31bf3856ad364e35"
|
||
language="neutral"
|
||
versionScope="nonSxS">
|
||
<!-- 磁碟分割（UEFI + GPT）。Ventoy 變數：避開 Ventoy USB 自己，挑第一顆非-Ventoy 磁碟 -->
|
||
<DiskConfiguration>
|
||
<Disk wcm:action="add">
|
||
<DiskID>$$VT_WINDOWS_DISK_1ST_NONVTOY$$</DiskID>
|
||
<WillWipeDisk>true</WillWipeDisk>
|
||
<CreatePartitions>
|
||
<CreatePartition wcm:action="add">
|
||
<Order>1</Order><Type>EFI</Type><Size>500</Size>
|
||
</CreatePartition>
|
||
<CreatePartition wcm:action="add">
|
||
<Order>2</Order><Type>MSR</Type><Size>128</Size>
|
||
</CreatePartition>
|
||
<CreatePartition wcm:action="add">
|
||
<Order>3</Order><Type>Primary</Type><Extend>true</Extend>
|
||
</CreatePartition>
|
||
</CreatePartitions>
|
||
<ModifyPartitions>
|
||
<ModifyPartition wcm:action="add">
|
||
<Order>1</Order><PartitionID>1</PartitionID>
|
||
<Format>FAT32</Format><Label>System</Label>
|
||
</ModifyPartition>
|
||
<ModifyPartition wcm:action="add">
|
||
<Order>2</Order><PartitionID>3</PartitionID>
|
||
<Format>NTFS</Format><Label>Windows</Label><Letter>C</Letter>
|
||
</ModifyPartition>
|
||
</ModifyPartitions>
|
||
</Disk>
|
||
</DiskConfiguration>
|
||
|
||
<ImageInstall>
|
||
<OSImage>
|
||
<InstallTo>
|
||
<DiskID>$$VT_WINDOWS_DISK_1ST_NONVTOY$$</DiskID><PartitionID>3</PartitionID>
|
||
</InstallTo>
|
||
<InstallToAvailablePartition>false</InstallToAvailablePartition>
|
||
</OSImage>
|
||
</ImageInstall>
|
||
|
||
<!-- 產品序號：Windows 11/10 專業版 GVLK（KMS 用戶端一般大量授權金鑰）。
|
||
來源：https://learn.microsoft.com/zh-tw/windows-server/get-started/kms-client-activation-keys
|
||
作用：用來選擇 ISO 內的版本（Pro），並讓 Setup 略過「輸入序號」畫面。
|
||
注意：這不是零售金鑰，只有連到 KMS 主機才會真正啟用；獨立機器會進 30 天寬限期再出現浮水印。 -->
|
||
<UserData>
|
||
<ProductKey>
|
||
<Key>W269N-WFGWX-YVC9B-4J6C9-T83GX</Key>
|
||
<WillShowUI>OnError</WillShowUI>
|
||
</ProductKey>
|
||
<AcceptEula>true</AcceptEula>
|
||
<FullName>IT Department</FullName>
|
||
<Organization>YourCompany</Organization>
|
||
</UserData>
|
||
</component>
|
||
</settings>
|
||
|
||
<!-- Pass 2: specialize — 電腦名稱、時區、網域 -->
|
||
<settings pass="specialize">
|
||
<component name="Microsoft-Windows-Shell-Setup"
|
||
processorArchitecture="amd64"
|
||
publicKeyToken="31bf3856ad364e35"
|
||
language="neutral"
|
||
versionScope="nonSxS">
|
||
<ComputerName>*</ComputerName>
|
||
<TimeZone>Taipei Standard Time</TimeZone>
|
||
<RegisteredOwner>IT Department</RegisteredOwner>
|
||
<RegisteredOrganization>YourCompany</RegisteredOrganization>
|
||
</component>
|
||
</settings>
|
||
|
||
<!-- Pass 3: oobeSystem — 首次啟動 OOBE 與帳號建立 -->
|
||
<settings pass="oobeSystem">
|
||
<component name="Microsoft-Windows-International-Core"
|
||
processorArchitecture="amd64"
|
||
publicKeyToken="31bf3856ad364e35"
|
||
language="neutral"
|
||
versionScope="nonSxS">
|
||
<InputLocale>0404:00000404</InputLocale>
|
||
<SystemLocale>zh-TW</SystemLocale>
|
||
<UILanguage>zh-TW</UILanguage>
|
||
<UserLocale>zh-TW</UserLocale>
|
||
</component>
|
||
|
||
<component name="Microsoft-Windows-Shell-Setup"
|
||
processorArchitecture="amd64"
|
||
publicKeyToken="31bf3856ad364e35"
|
||
language="neutral"
|
||
versionScope="nonSxS">
|
||
|
||
<!-- 略過所有 OOBE 畫面 -->
|
||
<OOBE>
|
||
<HideEULAPage>true</HideEULAPage>
|
||
<HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
|
||
<HideOnlineAccountScreens>true</HideOnlineAccountScreens>
|
||
<HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
|
||
<NetworkLocation>Work</NetworkLocation>
|
||
<ProtectYourPC>3</ProtectYourPC>
|
||
<SkipMachineOOBE>true</SkipMachineOOBE>
|
||
<SkipUserOOBE>true</SkipUserOOBE>
|
||
</OOBE>
|
||
|
||
<!-- 建立本機管理員帳號 -->
|
||
<UserAccounts>
|
||
<LocalAccounts>
|
||
<LocalAccount wcm:action="add">
|
||
<Name>Admin</Name>
|
||
<DisplayName>Administrator</DisplayName>
|
||
<Group>Administrators</Group>
|
||
<Password>
|
||
<Value>P@ssw0rd!</Value>
|
||
<PlainText>true</PlainText>
|
||
</Password>
|
||
</LocalAccount>
|
||
</LocalAccounts>
|
||
</UserAccounts>
|
||
|
||
<AutoLogon>
|
||
<Username>Admin</Username>
|
||
<Enabled>true</Enabled>
|
||
<LogonCount>1</LogonCount>
|
||
<Password>
|
||
<Value>P@ssw0rd!</Value>
|
||
<PlainText>true</PlainText>
|
||
</Password>
|
||
</AutoLogon>
|
||
|
||
<!-- 首次登入執行的自訂腳本
|
||
|
||
前 4 條為「不需網路、可獨立成功」的本機指令；
|
||
Order 5 從 Ventoy USB 把 Setup.ps1 複製到 C:\Scripts\，
|
||
Order 6 跑 Setup.ps1（13 項 post-install 動作集中在那裡），
|
||
Order 7 重開機。
|
||
|
||
各條都會寫獨立 log 到 C:\Windows\Temp\，方便排查無聲失敗。 -->
|
||
<FirstLogonCommands>
|
||
<SynchronousCommand wcm:action="add">
|
||
<Order>1</Order>
|
||
<CommandLine>cmd.exe /c net accounts /maxpwage:unlimited</CommandLine>
|
||
<Description>密碼永不過期</Description>
|
||
</SynchronousCommand>
|
||
<SynchronousCommand wcm:action="add">
|
||
<Order>2</Order>
|
||
<CommandLine>powershell.exe -NoProfile -Command "Rename-Computer -NewName ('PC-' + (Get-Random -Minimum 10000 -Maximum 100000)) -Force"</CommandLine>
|
||
<Description>主機名改成 PC-XXXXX（重開後生效）</Description>
|
||
</SynchronousCommand>
|
||
<SynchronousCommand wcm:action="add">
|
||
<Order>3</Order>
|
||
<CommandLine>cmd.exe /c "net user user 1234 /add & net user user /logonpasswordchg:yes"</CommandLine>
|
||
<Description>建立本機帳號 user（密碼 1234，首次登入強制改密；之後 Setup.ps1 會把它改名成 User）</Description>
|
||
<RequiresUserInput>false</RequiresUserInput>
|
||
</SynchronousCommand>
|
||
<SynchronousCommand wcm:action="add">
|
||
<Order>4</Order>
|
||
<CommandLine>powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$log='C:\Windows\Temp\firstlogon-copysetup.log'; New-Item -ItemType Directory -Force -Path C:\Scripts | Out-Null; $src=$null; foreach ($d in (Get-PSDrive -PSProvider FileSystem -EA 0).Root) { $cand=Join-Path $d 'ventoy\script\Setup.ps1'; if (Test-Path $cand) { $src=$cand; break } }; if ($src) { Copy-Item $src 'C:\Scripts\Setup.ps1' -Force; ('OK from ' + $src + ' at ' + (Get-Date -Format o)) | Out-File $log -Append } else { ('NOT FOUND at ' + (Get-Date -Format o)) | Out-File $log -Append }"</CommandLine>
|
||
<Description>從 Ventoy USB 的 \ventoy\script\Setup.ps1 複製到 C:\Scripts\（log: firstlogon-copysetup.log）</Description>
|
||
<RequiresUserInput>false</RequiresUserInput>
|
||
</SynchronousCommand>
|
||
<SynchronousCommand wcm:action="add">
|
||
<Order>5</Order>
|
||
<CommandLine>cmd.exe /c "if exist C:\Scripts\Setup.ps1 (powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Scripts\Setup.ps1) else (echo SETUP_NOT_FOUND %DATE% %TIME% > C:\Windows\Temp\firstlogon-runsetup.log)"</CommandLine>
|
||
<Description>執行 Setup.ps1（13 項 post-install：SSH/RDP/WinRM/KMS/Chrome/Debloat/Telegram/RemoveAI/UI/IME/重命名帳號…，log: C:\Windows\Temp\setup.log）</Description>
|
||
<RequiresUserInput>false</RequiresUserInput>
|
||
</SynchronousCommand>
|
||
<SynchronousCommand wcm:action="add">
|
||
<Order>6</Order>
|
||
<CommandLine>shutdown /r /t 5</CommandLine>
|
||
<Description>完成後重開機</Description>
|
||
</SynchronousCommand>
|
||
</FirstLogonCommands>
|
||
</component>
|
||
</settings>
|
||
|
||
</unattend>
|