From ad075c255c507859ec1a2140df4b4956b217f35b Mon Sep 17 00:00:00 2001 From: cproudlock Date: Wed, 19 Aug 2026 16:04:56 -0400 Subject: [PATCH] Actually deploy INTERNETACCESS, and skip the OOBE network page INTERNETACCESS has never been deployed. wlansvc ships Manual/Stopped on Windows 11, nothing in the unattend started it, and `netsh wlan add profile` refuses to run without it: The Wireless AutoConfig Service (wlansvc) is not running. exit=1 Reproduced in the win11 VM. So specialize was adding no wireless profile at all, and every bay reached OOBE with no known network - which is exactly the wifi/network selection the tech has been clicking through. Fixed by starting the service first. `net start`, NOT `sc start`: sc is asynchronous and returns START_PENDING, and the VM showed netsh losing that race and still reporting the service as not running. The command is idempotent and always exits 0, so a machine with no wireless hardware is unaffected. With the profile genuinely landing, HideWirelessSetupInOOBE is now true. Dropped EAP-PEAP and BLUESSO from specialize while here. Both are installed by the MCL ppkg - Install-GEWirelessSettings.ps1, with byte-identical EAP-PEAP.msi (sha d90f2489045b6fdb) and BLUESSO.xml (sha d8d886db37a40054) - and BLUESSO could never have bootstrapped anything: hidden SSID, connectionMode=manual, eapGtc with passwordFromUser. INTERNETACCESS is the bootstrap path and it is WPA2PSK with connectionMode=auto, so it needs no EAP module and no certificate. The eight GE certificates at Orders 4-11 are also duplicated by the ppkg (as Certificates_*.provxml runtime entries) and are left in place for now: that is a separate cut, and the case for removing them rests on the pre-ppkg token fetch being publicly signed, which is true today (mcl.dwcdn.geaerospace.com is issued by Google Trust Services) but is not ours to depend on. lint-unattend.py passes clean on all three live files and all three repo copies. --- playbook/FlatUnattendW10-engineer.xml | 13 ++++--------- playbook/FlatUnattendW10.xml | 13 ++++--------- 2 files changed, 8 insertions(+), 18 deletions(-) diff --git a/playbook/FlatUnattendW10-engineer.xml b/playbook/FlatUnattendW10-engineer.xml index 9508df7..df3a639 100644 --- a/playbook/FlatUnattendW10-engineer.xml +++ b/playbook/FlatUnattendW10-engineer.xml @@ -52,17 +52,12 @@ versionScope="nonSxS"> - - 1 - msiexec /i "C:\Deploy\Applications\extra\wireless\EAP-PEAP.msi" /quiet /norestart - Install EAP-PEAP - - 2 - cmd /c netsh wlan add profile filename="C:\Deploy\Applications\extra\wireless\BLUESSO.xml" user=all - Add BLUESSO WiFi profile + 1 + cmd /c sc config wlansvc start= auto & net start wlansvc & exit /b 0 + Start WLAN AutoConfig so the WiFi profile can be added 3 @@ -319,7 +314,7 @@ true true false - false + true true Work 3 diff --git a/playbook/FlatUnattendW10.xml b/playbook/FlatUnattendW10.xml index cce77af..77cf446 100644 --- a/playbook/FlatUnattendW10.xml +++ b/playbook/FlatUnattendW10.xml @@ -52,17 +52,12 @@ versionScope="nonSxS"> - - 1 - msiexec /i "C:\Deploy\Applications\extra\wireless\EAP-PEAP.msi" /quiet /norestart - Install EAP-PEAP - - 2 - cmd /c netsh wlan add profile filename="C:\Deploy\Applications\extra\wireless\BLUESSO.xml" user=all - Add BLUESSO WiFi profile + 1 + cmd /c sc config wlansvc start= auto & net start wlansvc & exit /b 0 + Start WLAN AutoConfig so the WiFi profile can be added 3 @@ -319,7 +314,7 @@ true true false - false + true true Work 3