diff --git a/playbook/FlatUnattendW10-engineer.xml b/playbook/FlatUnattendW10-engineer.xml
new file mode 100644
index 0000000..9508df7
--- /dev/null
+++ b/playbook/FlatUnattendW10-engineer.xml
@@ -0,0 +1,384 @@
+
+
+
+
+
+
+
+
+
+
+
+ W:\Drivers
+
+
+ W:\Deploy\Applications\extra\printdrivers\BROTHER\UNIV-PS-01181\PS\64
+
+
+ W:\Deploy\Applications\extra\printdrivers\HP
+
+
+ W:\Deploy\Applications\extra\printdrivers\XEROX\UNIV_5.1035.2.0_PS_x64_Driver
+
+
+
+
+
+
+
+
+
+ H%serialnumber%
+ GE Aerospace
+ GE
+ Eastern Standard Time
+
+
+
+
+
+
+
+ 1
+ msiexec /i "C:\Deploy\Applications\extra\wireless\EAP-PEAP.msi" /quiet /norestart
+ Install EAP-PEAP
+
+
+
+
+ 2
+ cmd /c netsh wlan add profile filename="C:\Deploy\Applications\extra\wireless\BLUESSO.xml" user=all
+ Add BLUESSO WiFi profile
+
+
+ 3
+ cmd /c netsh wlan add profile filename="C:\Deploy\Applications\extra\wireless\WiFi-Profile.xml" user=all
+ Add generic WiFi profile
+
+
+
+
+ 4
+ cmd /c certutil -addstore Root "C:\Deploy\Applications\GE_External_Root_CA_2_1.cer"
+ Install External Root Certificate
+
+
+ 5
+ cmd /c certutil -addstore CA "C:\Deploy\Applications\GE_External_Intermediate_CA_2_1.cer"
+ Install External Intermediate Certificate
+
+
+ 6
+ cmd /c certutil -addstore Root "C:\Deploy\Applications\GE_Enterprise_Root_CA_2_1.cer"
+ Install Enterprise Root Certificate
+
+
+ 7
+ cmd /c certutil -addstore CA "C:\Deploy\Applications\GE_Enterprise_Device_Issuing_CA_2_1.cer"
+ Install Enterprise Device Issuing Certificate
+
+
+ 8
+ cmd /c certutil -addstore CA "C:\Deploy\Applications\GE_Enterprise_Server_Issuing_CA_2_1.cer"
+ Install Enterprise Server Issuing Certificate
+
+
+ 9
+ cmd /c certutil -addstore CA "C:\Deploy\Applications\GE_Enterprise_Smart_Card_Issuing_CA_2_1.cer"
+ Install SmartCard Issuing Certificate
+
+
+ 10
+ cmd /c certutil -addstore CA "C:\Deploy\Applications\GE_Enterprise_User_Issuing_CA_2_1.cer"
+ Install User Issuing Certificate
+
+
+ 11
+ cmd /c certutil -addstore Root "C:\Deploy\Applications\GE_Aerospace_Enterprise_Root_CA_1.cer"
+ Install Aerospace Enterprise Root CA
+
+
+ 12
+ cmd /c certutil -addstore Root "C:\Deploy\Applications\ZscalerCommercialCertificate-2048-SHA256.crt"
+ Install Zscaler Certificate
+
+
+
+
+ 13
+ cmd /c copy "C:\Deploy\Applications\extra\fonts\3OF9.TTF" "%WINDIR%\Fonts\" /Y
+ Copy 3OF9 Font
+
+
+ 14
+ cmd /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "3 of 9 Barcode" /t REG_SZ /d "3OF9.TTF" /f
+ Register 3OF9 Barcode Font
+
+
+ 15
+ cmd /c copy "C:\Deploy\Applications\extra\fonts\Code39AzaleaNarrow3.ttf" "%WINDIR%\Fonts\" /Y
+ Copy Code39 Azalea Narrow Font
+
+
+ 16
+ cmd /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Code39AzaleaNarrow3" /t REG_SZ /d "Code39AzaleaNarrow3.ttf" /f
+ Register Code39 Azalea Narrow Font
+
+
+ 17
+ cmd /c copy "C:\Deploy\Applications\extra\fonts\Code39Azalea.ttf" "%WINDIR%\Fonts\" /Y
+ Copy Code39 Azalea Font
+
+
+ 18
+ cmd /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Code39Azalea" /t REG_SZ /d "Code39Azalea.ttf" /f
+ Register Code39 Azalea Font
+
+
+
+
+ 19
+ cmd /c "C:\Deploy\Applications\extra\opentext\Setup-OpenText.cmd"
+ Install OpenText HostExplorer SP1 (shopfloor method)
+
+
+ 20
+ C:\Deploy\Applications\extra\opentext\J2SE_Runtime_Environment_1.6.0_22_Static_Config_V2_Co-Exist.EXE /silent /norestart
+ Install J2SE Runtime Environment 1.6.0_22
+
+
+
+
+ 22
+ msiexec /i "C:\Deploy\Applications\extra\adobe\AcroRead.msi" TRANSFORMS="C:\Deploy\Applications\extra\adobe\AcroRead.mst" /quiet /norestart
+ Install Adobe
+
+
+ 23
+ msiexec /p "C:\Deploy\Applications\extra\adobe\AcroRdrDCUpd2500120531.msp" /quiet /norestart
+ Apply Adobe Reader Update
+
+
+
+
+ 26
+ C:\Deploy\Applications\extra\java\jre-8u441-windows-i586.exe /s INSTALLDIR="C:\Program Files (x86)\Java\jre1.8.0_441" STATIC=1 AUTO_UPDATE=0 REBOOT=0 SPONSORS=0 WEB_JAVA=0 /L "C:\Windows\Logs\java-install.log"
+ Install Java JRE 8 Update 441 with Enterprise Settings and Logging
+
+
+
+
+ 27
+ cmd /c reg add "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v EnableJavaUpdate /t REG_DWORD /d 0 /f
+ Disable Java Auto Updates (64-bit)
+
+
+
+
+ 28
+ cmd /c reg add "HKLM\SOFTWARE\Wow6432Node\JavaSoft\Java Update\Policy" /v EnableJavaUpdate /t REG_DWORD /d 0 /f
+ Disable Java Auto Updates (32-bit)
+
+
+
+
+ 29
+ cmd /c reg add "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v EnableAutoUpdateCheck /t REG_DWORD /d 0 /f
+ Disable Java Auto Update Check (64-bit)
+
+
+
+
+ 30
+ cmd /c reg add "HKLM\SOFTWARE\Wow6432Node\JavaSoft\Java Update\Policy" /v EnableAutoUpdateCheck /t REG_DWORD /d 0 /f
+ Disable Java Auto Update Check (32-bit)
+
+
+
+
+ 31
+ cmd /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowCortana /t REG_DWORD /d 0 /f
+ Disable Cortana
+
+
+
+
+ 33
+ cmd /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v DisableWebSearch /t REG_DWORD /d 1 /f
+ Disable Web Search in Start Menu
+
+
+
+
+ 34
+ cmd /c reg load HKU\TempDU C:\Users\Default\NTUSER.DAT & reg add "HKU\TempDU\Software\Policies\Microsoft\Windows\Explorer" /v DisableSearchBoxSuggestions /t REG_DWORD /d 1 /f & reg unload HKU\TempDU
+ Disable Bing/web search suggestions (Default User hive)
+
+
+
+
+ 35
+ cmd /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v ConnectedSearchUseWeb /t REG_DWORD /d 0 /f
+ Disable Connected Search Use Web
+
+
+
+
+ 36
+ cmd /c reg add "HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization" /v AllowInputPersonalization /t REG_DWORD /d 0 /f
+ Disable Cortana Speech Recognition
+
+
+
+
+ 38
+ cmd /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v EnableDynamicContentInWSB /t REG_DWORD /d 0 /f
+ Disable Search Highlights
+
+
+
+ 39
+ powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Deploy\Applications\BPRT\Register-BulkEnrollTask-Standard.ps1"
+ Add bulk enrollment orchestrator to Run key
+
+
+ 40
+ reg.exe load HKU\TempDefault C:\Users\Default\NTUSER.DAT
+ Load Default User registry hive
+
+
+ 41
+ reg.exe add "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v StartupDelayInMSec /t REG_DWORD /d 0 /f
+ Disable startup delay for all new users
+
+
+ 42
+ reg.exe add "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v WaitForIdleState /t REG_DWORD /d 0 /f
+ Disable wait for idle state for all new users
+
+
+ 43
+ reg.exe add "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartShownOnUpgrade /t REG_DWORD /d 1 /f
+ Prevent Start menu from opening on first login
+
+
+ 44
+ reg.exe unload HKU\TempDefault
+ Unload Default User registry hive
+
+
+ 45
+ reg add HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /t REG_DWORD /d 1 /f
+ Disable automatic Windows updates (NoAutoUpdate)
+
+
+ 46
+ reg add HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /t REG_DWORD /d 1 /f
+ Disable automatic Windows updates (AUOptions)
+
+
+ 47
+ reg.exe add "HKLM\Software\Microsoft\Command Processor" /v AutoRun /t REG_SZ /d "doskey vanilla=powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Deploy\Applications\BPRT\Show-VanillaConfirmation.ps1" /f
+ Define vanilla CMD alias for manual OOBE fallback via Shift+F10
+
+
+ 48
+ reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices" /v Deny_All /t REG_DWORD /d 1 /f
+ Block all removable media reads to prevent PPKG auto-detection at OOBE
+
+
+
+
+
+
+
+
+
+ true
+ true
+ false
+ false
+ true
+ Work
+ 3
+ false
+ false
+
+
+
+
+
+
+
+ cmd /c sc config wuauserv start= disabled
+ disable windows update
+ 4
+
+
+ cmd /c sc stop wuauserv
+ disable windows update
+ 5
+
+
+ reg.exe load HKU\TempDefault C:\Users\Default\NTUSER.DAT
+ Load Default User registry hive to reverse startup delay
+ 6
+
+
+ reg.exe delete "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v StartupDelayInMSec /f
+ Remove startup delay override from Default User
+ 7
+
+
+ reg.exe delete "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v WaitForIdleState /f
+ Remove wait for idle state override from Default User
+ 8
+
+
+ reg.exe unload HKU\TempDefault
+ Unload Default User registry hive
+ 9
+
+
+ reg.exe delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices" /v Deny_All /f
+ Restore removable media access after OOBE PPKG block
+ 10
+
+
+ 11
+ powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Deploy\Applications\extra_engineering\Install-EngineeringLayer.ps1"
+
+ Engineering Layer: stage payload out of C:\Deploy then install
+
+
+
+
+
+
diff --git a/playbook/FlatUnattendW10.xml b/playbook/FlatUnattendW10.xml
index 5e24175..cce77af 100644
--- a/playbook/FlatUnattendW10.xml
+++ b/playbook/FlatUnattendW10.xml
@@ -253,7 +253,58 @@
cmd /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v EnableDynamicContentInWSB /t REG_DWORD /d 0 /f
Disable Search Highlights
-
+
+
+ 39
+ powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Deploy\Applications\BPRT\Register-BulkEnrollTask-Standard.ps1"
+ Add bulk enrollment orchestrator to Run key
+
+
+ 40
+ reg.exe load HKU\TempDefault C:\Users\Default\NTUSER.DAT
+ Load Default User registry hive
+
+
+ 41
+ reg.exe add "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v StartupDelayInMSec /t REG_DWORD /d 0 /f
+ Disable startup delay for all new users
+
+
+ 42
+ reg.exe add "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v WaitForIdleState /t REG_DWORD /d 0 /f
+ Disable wait for idle state for all new users
+
+
+ 43
+ reg.exe add "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartShownOnUpgrade /t REG_DWORD /d 1 /f
+ Prevent Start menu from opening on first login
+
+
+ 44
+ reg.exe unload HKU\TempDefault
+ Unload Default User registry hive
+
+
+ 45
+ reg add HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /t REG_DWORD /d 1 /f
+ Disable automatic Windows updates (NoAutoUpdate)
+
+
+ 46
+ reg add HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /t REG_DWORD /d 1 /f
+ Disable automatic Windows updates (AUOptions)
+
+
+ 47
+ reg.exe add "HKLM\Software\Microsoft\Command Processor" /v AutoRun /t REG_SZ /d "doskey vanilla=powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Deploy\Applications\BPRT\Show-VanillaConfirmation.ps1" /f
+ Define vanilla CMD alias for manual OOBE fallback via Shift+F10
+
+
+ 48
+ reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices" /v Deny_All /t REG_DWORD /d 1 /f
+ Block all removable media reads to prevent PPKG auto-detection at OOBE
+
+
@@ -277,15 +328,45 @@
-
-
- 2
- C:\Deploy\Applications\extra\zscaler\zscaler.bat
- Install Zscaler Client Connector
-
-
+
+
+ cmd /c sc config wuauserv start= disabled
+ disable windows update
+ 4
+
+
+ cmd /c sc stop wuauserv
+ disable windows update
+ 5
+
+
+ reg.exe load HKU\TempDefault C:\Users\Default\NTUSER.DAT
+ Load Default User registry hive to reverse startup delay
+ 6
+
+
+ reg.exe delete "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v StartupDelayInMSec /f
+ Remove startup delay override from Default User
+ 7
+
+
+ reg.exe delete "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v WaitForIdleState /f
+ Remove wait for idle state override from Default User
+ 8
+
+
+ reg.exe unload HKU\TempDefault
+ Unload Default User registry hive
+ 9
+
+
+ reg.exe delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices" /v Deny_All /f
+ Restore removable media access after OOBE PPKG block
+ 10
+
+
diff --git a/playbook/pxe_server_setup.yml b/playbook/pxe_server_setup.yml
index d80e87f..7abe5b6 100644
--- a/playbook/pxe_server_setup.yml
+++ b/playbook/pxe_server_setup.yml
@@ -735,17 +735,28 @@
loop: "{{ shopfloor_types }}"
ignore_errors: yes
- # gea-standard (Win11) + gea-engineer (Win10) + ge-standard/engineer all use
- # the same unattend. force: yes because drift between this file and the
- # shared copies is what caused the Win10/Win11 search-cleanup regression
- # earlier this session (d49f516) — prefer repo as source of truth.
- - name: "Deploy standard/engineer unattend.xml"
+ # gea-standard and gea-engineer each get their OWN unattend. They are not
+ # interchangeable: the engineer file carries FirstLogonCommands Order 11,
+ # which installs the Engineering Layer, and nothing else differs. Deploying
+ # one shared template to both - which this task used to do - silently
+ # stripped that entry from gea-engineer on every playbook run.
+ #
+ # force: yes because drift between these files and the share is what caused
+ # the Win10/Win11 search-cleanup regression (d49f516). That only works if
+ # the repo copies are genuinely current: on 2026-08-19 this template was
+ # found to be missing specialize Orders 39-48 - including Order 39, which
+ # registers the bulk-enrollment orchestrator - so a playbook run would have
+ # removed enrollment from every standard and engineer bay. Both files are
+ # now reconciled against the live share. Re-check before trusting force: yes.
+ - name: "Deploy standard/engineer unattend.xml (per-type template)"
copy:
- src: "{{ usb_mount }}/FlatUnattendW10.xml"
- dest: "{{ samba_share }}/{{ item }}/Deploy/FlatUnattendW10.xml"
+ src: "{{ usb_mount }}/{{ item.src }}"
+ dest: "{{ samba_share }}/{{ item.dest }}/Deploy/FlatUnattendW10.xml"
mode: '0644'
force: yes
- loop: "{{ standard_types }}"
+ loop:
+ - { src: 'FlatUnattendW10.xml', dest: 'gea-standard' }
+ - { src: 'FlatUnattendW10-engineer.xml', dest: 'gea-engineer' }
ignore_errors: yes
- name: "Daily cron to create/refresh Media.tag for all images"