W:\Drivers H%serialnumber% GE Aerospace GE Eastern Standard Time 1 powershell.exe -ExecutionPolicy Bypass -Command "Import-Certificate -FilePath 'C:\Deploy\Applications\GE_External_Root_CA_2_1.cer' -CertStoreLocation 'Cert:\LocalMachine\Root'" Install External Root Certificate 2 powershell.exe -ExecutionPolicy Bypass -Command "Import-Certificate -FilePath 'C:\Deploy\Applications\GE_External_Intermediate_CA_2_1.cer' -CertStoreLocation 'Cert:\LocalMachine\CA'" Install External Intermediate Certificate 3 powershell.exe -ExecutionPolicy Bypass -Command "Import-Certificate -FilePath 'C:\Deploy\Applications\GE_Enterprise_Root_CA_2_1.cer' -CertStoreLocation 'Cert:\LocalMachine\Root'" Install Enterprise Root Certificate 4 powershell.exe -ExecutionPolicy Bypass -Command "Import-Certificate -FilePath 'C:\Deploy\Applications\GE_Enterprise_Device_Issuing_CA_2_1.cer' -CertStoreLocation 'Cert:\LocalMachine\CA'" Install Enterprise Device Issuing Certificate 5 powershell.exe -ExecutionPolicy Bypass -Command "Import-Certificate -FilePath 'C:\Deploy\Applications\GE_Enterprise_Server_Issuing_CA_2_1.cer' -CertStoreLocation 'Cert:\LocalMachine\CA'" Install Enterprise Server Issuing Certificate 6 powershell.exe -ExecutionPolicy Bypass -Command "Import-Certificate -FilePath 'C:\Deploy\Applications\GE_Enterprise_Smart_Card_Issuing_CA_2_1.cer' -CertStoreLocation 'Cert:\LocalMachine\CA'" Install Enterprise SmartCard Issuing Certificate 7 powershell.exe -ExecutionPolicy Bypass -Command "Import-Certificate -FilePath 'C:\Deploy\Applications\GE_Enterprise_User_Issuing_CA_2_1.cer' -CertStoreLocation 'Cert:\LocalMachine\CA'" Install Enterprise User Issuing Certificate 8 powershell.exe -ExecutionPolicy Bypass -Command "Import-Certificate -FilePath 'C:\Deploy\Applications\GE_Aerospace_Enterprise_Root_CA_1.cer' -CertStoreLocation 'Cert:\LocalMachine\Root'" Install Aerospace Enterprise Root Certificate 9 powershell.exe -ExecutionPolicy Bypass -Command "Import-Certificate -FilePath 'C:\Deploy\Applications\ZscalerCommercialCertificate-2048-SHA256.crt' -CertStoreLocation 'Cert:\LocalMachine\Root'" Install Zscaler Commercial Certificate reg.exe add "HKLM\System\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f Disable Network Windows 10 11 netsh wlan add profile filename="C:\Deploy\Applications\extra\wireless\WiFi-Profile.xml" user=all Install INTERNETACCESS WiFi Profile 12 powershell.exe -ExecutionPolicy Bypass -Command "Enable-PSRemoting -Force -SkipNetworkProfileCheck" Enable WinRM 13 reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f Bypass OOBE network requirement 14 reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v SkipMachineOOBE /t REG_DWORD /d 1 /f Skip machine OOBE phase 15 reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v SkipUserOOBE /t REG_DWORD /d 1 /f Skip user OOBE phase 17 reg.exe load HKU\TempDefault C:\Users\Default\NTUSER.DAT Load Default User registry hive 18 reg.exe add "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v StartupDelayInMSec /t REG_DWORD /d 0 /f Disable startup delay for all new users 19 reg.exe add "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v WaitForIdleState /t REG_DWORD /d 0 /f Disable wait for idle state for all new users 20 reg.exe add "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartShownOnUpgrade /t REG_DWORD /d 1 /f Prevent Start menu from opening on first login 21 reg.exe unload HKU\TempDefault Unload Default User registry hive 22 reg add HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /t REG_DWORD /d 1 /f Disable automatic Windows updates (NoAutoUpdate) 23 reg add HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /t REG_DWORD /d 1 /f Disable automatic Windows updates (AUOptions) 24 reg.exe add "HKLM\Software\Microsoft\Command Processor" /v AutoRun /t REG_SZ /d "doskey vanilla=powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Deploy\Applications\BPRT\Show-VanillaConfirmation.ps1" /f Define vanilla CMD alias for manual OOBE fallback via Shift+F10 25 reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices" /v Deny_All /t REG_DWORD /d 1 /f Block all removable media reads to prevent PPKG auto-detection at OOBE en-US en-US en-US en-US true true true true true 3 Pa55word true</PlainText> </Password> <Name>SupportUser</Name> <Group>Administrators</Group> <DisplayName>SupportUser</DisplayName> </LocalAccount> </LocalAccounts> </UserAccounts> <AutoLogon> <Password> <Value>Pa55word</Value> <PlainText>true</PlainText> </Password> <Enabled>true</Enabled> <Username>SupportUser</Username> <LogonCount>12</LogonCount> </AutoLogon> <FirstLogonCommands> <SynchronousCommand wcm:action="add"> <Order>1</Order> <CommandLine>cmd.exe /c powercfg /change monitor-timeout-ac 0 &amp; powercfg /change monitor-timeout-dc 0 &amp; powercfg /change standby-timeout-ac 0 &amp; powercfg /change standby-timeout-dc 0</CommandLine> <Description>Disable display and sleep timeout during setup</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>2</Order> <CommandLine>powershell.exe -ExecutionPolicy Bypass -Command "Get-NetAdapter -Physical | Where-Object { $_.InterfaceDescription -match 'Wi-Fi|Wireless' } | Set-NetIPInterface -InterfaceMetric 10; Get-NetAdapter -Physical | Where-Object { $_.InterfaceDescription -notmatch 'Wi-Fi|Wireless' } | Set-NetIPInterface -InterfaceMetric 100"</CommandLine> <Description>Prioritize WiFi over ethernet</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>3</Order> <CommandLine>powershell.exe -ExecutionPolicy Bypass -Command "Get-NetConnectionProfile | Set-NetConnectionProfile -NetworkCategory Private"</CommandLine> <Description>Set network profile to Private</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>4</Order> <CommandLine>powershell.exe -ep Bypass -Command "net use Z: \\172.16.9.1\enrollment /user:pxe-upload pxe; robocopy Z:\shopfloor-setup C:\Enrollment Fetch-StagingPayload.ps1 Verify-And-Heal-Staging.ps1 /R:2 /W:2; robocopy Z:\scripts C:\Enrollment run-enrollment.ps1 wait-for-internet.ps1 migrate-to-wifi.ps1 /R:2 /W:2"</CommandLine> <Description>Bootstrap self-heal: pull Fetch/Verify-Heal + enrollment scripts from the PXE share so Order 5/6 run after an early WinPE staging failure.</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>5</Order> <CommandLine>powershell.exe -ExecutionPolicy Bypass -File "C:\Enrollment\Fetch-StagingPayload.ps1"</CommandLine> <Description>Fetch bulk staging (shopfloor-setup tree + preinstall bundle) from the PXE share on a fresh mount, BEFORE the production-network switch takes the bay off the imaging LAN. Detailed log at C:\Logs\Fetch\.</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>6</Order> <CommandLine>powershell.exe -ExecutionPolicy Bypass -File "C:\Enrollment\Verify-And-Heal-Staging.ps1"</CommandLine> <Description>Verify + re-pull any missing imaging payload from the PXE share (CMM/Keyence/WaxTrace bundles + bay backup) on the imaging LAN before the production-network switch. Log C:\Logs\Fetch.</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>7</Order> <CommandLine>powershell.exe -ExecutionPolicy Bypass -File "C:\Enrollment\wait-for-internet.ps1"</CommandLine> <Description>Prompt to connect production network then wait for TCP 443 connectivity</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>8</Order> <CommandLine>powershell.exe -ExecutionPolicy Bypass -File "C:\Enrollment\migrate-to-wifi.ps1"</CommandLine> <Description>Migrate from wired to WiFi if WiFi adapter present, else stay on wired</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>9</Order> <CommandLine>msiexec.exe /i "C:\PreInstall\installers\powershell7\PowerShell-7.5.4-win-x64.msi" /qn /norestart ADD_PATH=1 USE_MU=0 ENABLE_MU=0 DISABLE_TELEMETRY=1</CommandLine> <Description>Install PowerShell 7 BEFORE PPKG so Intune SetupCredentials Win32App finds pwsh.exe (race fix)</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>10</Order> <CommandLine>powershell.exe -ExecutionPolicy Bypass -File "C:\Enrollment\run-enrollment.ps1"</CommandLine> <!-- run-enrollment.ps1 lives in C:\Enrollment: startnet stages it and the .ppkg there. The earlier C:\run-enrollment.ps1 path pointed at a file that never existed, so this step silently did nothing. Keep prose in comments - Description is capped at 256 chars and an over-length one invalidates the whole answer file for its pass. --> <Description>Run GCCH Enrollment</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>11</Order> <CommandLine>powershell.exe -ExecutionPolicy Bypass -File "C:\Enrollment\Run-ShopfloorSetup.ps1"</CommandLine> <Description>Run shopfloor PC type setup</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <CommandLine>cmd /c sc config wuauserv start= disabled</CommandLine> <Description>disable windows update</Description> <Order>12</Order> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <CommandLine>cmd /c sc stop wuauserv</CommandLine> <Description>disable windows update</Description> <Order>13</Order> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <CommandLine>reg.exe load HKU\TempDefault C:\Users\Default\NTUSER.DAT</CommandLine> <Description>Load Default User registry hive to reverse startup delay</Description> <Order>14</Order> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <CommandLine>reg.exe delete "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v StartupDelayInMSec /f</CommandLine> <Description>Remove startup delay override from Default User</Description> <Order>15</Order> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <CommandLine>reg.exe delete "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v WaitForIdleState /f</CommandLine> <Description>Remove wait for idle state override from Default User</Description> <Order>16</Order> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <CommandLine>reg.exe unload HKU\TempDefault</CommandLine> <Description>Unload Default User registry hive</Description> <Order>17</Order> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <CommandLine>reg.exe delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices" /v Deny_All /f</CommandLine> <Description>Restore removable media access after OOBE PPKG block</Description> <Order>18</Order> </SynchronousCommand> </FirstLogonCommands> <TimeZone>Eastern Standard Time</TimeZone> </component> </settings> </unattend>