2415e6cfd6
FirstLogonCommands Order 1 was `shutdown -a`, and it protected nothing. The reboot it was aimed at is the one provtool schedules when the provisioning package is applied - and Start-BulkEnrollOrchestrator.ps1 already aborts that itself, on the line straight after provtool returns, with its own `shutdown /a` and the comment "Abort the reboot that the provisioning package scheduled". Our copy runs at logon, before the orchestrator has applied the package, so at the moment it executes there is nothing pending to abort. The reboot that actually interrupts first-logon work is the orchestrator's own `shutdown /r /t 0 /f` at the end of its run. That one is immediate, so it has no pending-shutdown window for `shutdown /a` to cancel, and it is deliberate - the Entra ID join needs it. So the entry was a no-op that read like protection. It cost real time this week: its presence was taken as evidence that first-logon work was being guarded when it was not. Removing it changes no behaviour. What it was reaching for - first-logon work surviving a mid-logon reboot - needs resumability instead, which is what the retired Office payload now does and what zscaler.bat still lacks. Order 2 (zscaler) is left numbered 2; FirstLogonCommands execute in ascending Order and gaps are legal, so renumbering would be churn for no gain. Live gea-standard and gea-engineer updated to match. lint-unattend.py passes clean on all three live files and both repo copies. gea-shopfloor never had this entry.
293 lines
15 KiB
XML
293 lines
15 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<unattend xmlns="urn:schemas-microsoft-com:unattend"
|
|
xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
|
|
|
|
<!-- 1. windowsPE is intentionally empty -->
|
|
<settings pass="windowsPE" />
|
|
|
|
<!-- 2. Offline servicing (drivers) -->
|
|
<settings pass="offlineServicing">
|
|
<component name="Microsoft-Windows-PnpCustomizationsNonWinPE"
|
|
processorArchitecture="amd64"
|
|
publicKeyToken="31bf3856ad364e35"
|
|
language="neutral"
|
|
versionScope="nonSxS">
|
|
<DriverPaths>
|
|
<PathAndCredentials wcm:action="add" wcm:keyValue="1">
|
|
<Path>W:\Drivers</Path>
|
|
</PathAndCredentials>
|
|
<PathAndCredentials wcm:action="add" wcm:keyValue="2">
|
|
<Path>W:\Deploy\Applications\extra\printdrivers\BROTHER\UNIV-PS-01181\PS\64</Path>
|
|
</PathAndCredentials>
|
|
<PathAndCredentials wcm:action="add" wcm:keyValue="3">
|
|
<Path>W:\Deploy\Applications\extra\printdrivers\HP</Path>
|
|
</PathAndCredentials>
|
|
<PathAndCredentials wcm:action="add" wcm:keyValue="4">
|
|
<Path>W:\Deploy\Applications\extra\printdrivers\XEROX\UNIV_5.1035.2.0_PS_x64_Driver</Path>
|
|
</PathAndCredentials>
|
|
</DriverPaths>
|
|
</component>
|
|
</settings>
|
|
|
|
<!-- 3. specialize: computer naming + RunSynchronous all in ONE component -->
|
|
<settings pass="specialize">
|
|
<!-- 3a. Shell-Setup for naming/owner/org -->
|
|
<component name="Microsoft-Windows-Shell-Setup"
|
|
processorArchitecture="amd64"
|
|
publicKeyToken="31bf3856ad364e35"
|
|
language="neutral"
|
|
versionScope="nonSxS">
|
|
<ComputerName>H%serialnumber%</ComputerName>
|
|
<RegisteredOrganization>GE Aerospace</RegisteredOrganization>
|
|
<RegisteredOwner>GE</RegisteredOwner>
|
|
<TimeZone>Eastern Standard Time</TimeZone>
|
|
</component>
|
|
|
|
<!-- 3b. RunSynchronous for all of your installers, copies, etc. -->
|
|
<component name="Microsoft-Windows-Deployment"
|
|
processorArchitecture="amd64"
|
|
publicKeyToken="31bf3856ad364e35"
|
|
language="neutral"
|
|
versionScope="nonSxS">
|
|
<RunSynchronous>
|
|
<!-- EAP-PEAP MSI -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>1</Order>
|
|
<Path>msiexec /i "C:\Deploy\Applications\extra\wireless\EAP-PEAP.msi" /quiet /norestart</Path>
|
|
<Description>Install EAP-PEAP</Description>
|
|
</RunSynchronousCommand>
|
|
|
|
<!-- Wi-Fi profiles -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>2</Order>
|
|
<Path>cmd /c netsh wlan add profile filename="C:\Deploy\Applications\extra\wireless\BLUESSO.xml" user=all</Path>
|
|
<Description>Add BLUESSO WiFi profile</Description>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>3</Order>
|
|
<Path>cmd /c netsh wlan add profile filename="C:\Deploy\Applications\extra\wireless\WiFi-Profile.xml" user=all</Path>
|
|
<Description>Add generic WiFi profile</Description>
|
|
</RunSynchronousCommand>
|
|
|
|
<!-- Certificates -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>4</Order>
|
|
<Path>cmd /c certutil -addstore Root "C:\Deploy\Applications\GE_External_Root_CA_2_1.cer"</Path>
|
|
<Description>Install External Root Certificate</Description>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>5</Order>
|
|
<Path>cmd /c certutil -addstore CA "C:\Deploy\Applications\GE_External_Intermediate_CA_2_1.cer"</Path>
|
|
<Description>Install External Intermediate Certificate</Description>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>6</Order>
|
|
<Path>cmd /c certutil -addstore Root "C:\Deploy\Applications\GE_Enterprise_Root_CA_2_1.cer"</Path>
|
|
<Description>Install Enterprise Root Certificate</Description>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>7</Order>
|
|
<Path>cmd /c certutil -addstore CA "C:\Deploy\Applications\GE_Enterprise_Device_Issuing_CA_2_1.cer"</Path>
|
|
<Description>Install Enterprise Device Issuing Certificate</Description>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>8</Order>
|
|
<Path>cmd /c certutil -addstore CA "C:\Deploy\Applications\GE_Enterprise_Server_Issuing_CA_2_1.cer"</Path>
|
|
<Description>Install Enterprise Server Issuing Certificate</Description>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>9</Order>
|
|
<Path>cmd /c certutil -addstore CA "C:\Deploy\Applications\GE_Enterprise_Smart_Card_Issuing_CA_2_1.cer"</Path>
|
|
<Description>Install SmartCard Issuing Certificate</Description>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>10</Order>
|
|
<Path>cmd /c certutil -addstore CA "C:\Deploy\Applications\GE_Enterprise_User_Issuing_CA_2_1.cer"</Path>
|
|
<Description>Install User Issuing Certificate</Description>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>11</Order>
|
|
<Path>cmd /c certutil -addstore Root "C:\Deploy\Applications\GE_Aerospace_Enterprise_Root_CA_1.cer"</Path>
|
|
<Description>Install Aerospace Enterprise Root CA</Description>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>12</Order>
|
|
<Path>cmd /c certutil -addstore Root "C:\Deploy\Applications\ZscalerCommercialCertificate-2048-SHA256.crt"</Path>
|
|
<Description>Install Zscaler Certificate</Description>
|
|
</RunSynchronousCommand>
|
|
|
|
<!-- Fonts -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>13</Order>
|
|
<Path>cmd /c copy "C:\Deploy\Applications\extra\fonts\3OF9.TTF" "%WINDIR%\Fonts\" /Y</Path>
|
|
<Description>Copy 3OF9 Font</Description>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>14</Order>
|
|
<Path>cmd /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "3 of 9 Barcode" /t REG_SZ /d "3OF9.TTF" /f</Path>
|
|
<Description>Register 3OF9 Barcode Font</Description>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>15</Order>
|
|
<Path>cmd /c copy "C:\Deploy\Applications\extra\fonts\Code39AzaleaNarrow3.ttf" "%WINDIR%\Fonts\" /Y</Path>
|
|
<Description>Copy Code39 Azalea Narrow Font</Description>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>16</Order>
|
|
<Path>cmd /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Code39AzaleaNarrow3" /t REG_SZ /d "Code39AzaleaNarrow3.ttf" /f</Path>
|
|
<Description>Register Code39 Azalea Narrow Font</Description>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>17</Order>
|
|
<Path>cmd /c copy "C:\Deploy\Applications\extra\fonts\Code39Azalea.ttf" "%WINDIR%\Fonts\" /Y</Path>
|
|
<Description>Copy Code39 Azalea Font</Description>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>18</Order>
|
|
<Path>cmd /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Code39Azalea" /t REG_SZ /d "Code39Azalea.ttf" /f</Path>
|
|
<Description>Register Code39 Azalea Font</Description>
|
|
</RunSynchronousCommand>
|
|
|
|
<!-- OpenText installers -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>19</Order>
|
|
<Path>cmd /c "C:\Deploy\Applications\extra\opentext\Setup-OpenText.cmd"</Path>
|
|
<Description>Install OpenText HostExplorer SP1 (shopfloor method)</Description>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>20</Order>
|
|
<Path>C:\Deploy\Applications\extra\opentext\J2SE_Runtime_Environment_1.6.0_22_Static_Config_V2_Co-Exist.EXE /silent /norestart</Path>
|
|
<Description>Install J2SE Runtime Environment 1.6.0_22</Description>
|
|
</RunSynchronousCommand>
|
|
|
|
<!-- Adobe -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>22</Order>
|
|
<Path>msiexec /i "C:\Deploy\Applications\extra\adobe\AcroRead.msi" TRANSFORMS="C:\Deploy\Applications\extra\adobe\AcroRead.mst" /quiet /norestart</Path>
|
|
<Description>Install Adobe</Description>
|
|
</RunSynchronousCommand>
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>23</Order>
|
|
<Path>msiexec /p "C:\Deploy\Applications\extra\adobe\AcroRdrDCUpd2500120531.msp" /quiet /norestart</Path>
|
|
<Description>Apply Adobe Reader Update</Description>
|
|
</RunSynchronousCommand>
|
|
|
|
<!-- Java JRE 8 Enterprise Installation -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>26</Order>
|
|
<Path>C:\Deploy\Applications\extra\java\jre-8u441-windows-i586.exe /s INSTALLDIR="C:\Program Files (x86)\Java\jre1.8.0_441" STATIC=1 AUTO_UPDATE=0 REBOOT=0 SPONSORS=0 WEB_JAVA=0 /L "C:\Windows\Logs\java-install.log"</Path>
|
|
<Description>Install Java JRE 8 Update 441 with Enterprise Settings and Logging</Description>
|
|
</RunSynchronousCommand>
|
|
|
|
<!-- Disable Java Auto Updates via Registry (64-bit) -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>27</Order>
|
|
<Path>cmd /c reg add "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v EnableJavaUpdate /t REG_DWORD /d 0 /f</Path>
|
|
<Description>Disable Java Auto Updates (64-bit)</Description>
|
|
</RunSynchronousCommand>
|
|
|
|
<!-- Disable Java Auto Updates via Registry (32-bit) -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>28</Order>
|
|
<Path>cmd /c reg add "HKLM\SOFTWARE\Wow6432Node\JavaSoft\Java Update\Policy" /v EnableJavaUpdate /t REG_DWORD /d 0 /f</Path>
|
|
<Description>Disable Java Auto Updates (32-bit)</Description>
|
|
</RunSynchronousCommand>
|
|
|
|
<!-- Disable Java Auto Update Check (64-bit) -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>29</Order>
|
|
<Path>cmd /c reg add "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v EnableAutoUpdateCheck /t REG_DWORD /d 0 /f</Path>
|
|
<Description>Disable Java Auto Update Check (64-bit)</Description>
|
|
</RunSynchronousCommand>
|
|
|
|
<!-- Disable Java Auto Update Check (32-bit) -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>30</Order>
|
|
<Path>cmd /c reg add "HKLM\SOFTWARE\Wow6432Node\JavaSoft\Java Update\Policy" /v EnableAutoUpdateCheck /t REG_DWORD /d 0 /f</Path>
|
|
<Description>Disable Java Auto Update Check (32-bit)</Description>
|
|
</RunSynchronousCommand>
|
|
|
|
<!-- Disable Cortana -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>31</Order>
|
|
<Path>cmd /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowCortana /t REG_DWORD /d 0 /f</Path>
|
|
<Description>Disable Cortana</Description>
|
|
</RunSynchronousCommand>
|
|
|
|
<!-- Disable Web Search in Start Menu -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>33</Order>
|
|
<Path>cmd /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v DisableWebSearch /t REG_DWORD /d 1 /f</Path>
|
|
<Description>Disable Web Search in Start Menu</Description>
|
|
</RunSynchronousCommand>
|
|
|
|
<!-- Disable Bing / web search suggestions in Start menu.
|
|
BingSearchEnabled is documented at HKCU\Software\Microsoft\Windows\CurrentVersion\Search
|
|
(not HKLM), so the old HKLM policy placement was a no-op. The current documented
|
|
suppression is DisableSearchBoxSuggestions=1 at Software\Policies\Microsoft\Windows\Explorer.
|
|
Writing it into the Default User hive so every newly-created account inherits it. -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>34</Order>
|
|
<Path>cmd /c reg load HKU\TempDU C:\Users\Default\NTUSER.DAT & reg add "HKU\TempDU\Software\Policies\Microsoft\Windows\Explorer" /v DisableSearchBoxSuggestions /t REG_DWORD /d 1 /f & reg unload HKU\TempDU</Path>
|
|
<Description>Disable Bing/web search suggestions (Default User hive)</Description>
|
|
</RunSynchronousCommand>
|
|
|
|
<!-- Disable Search Web when searching Windows -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>35</Order>
|
|
<Path>cmd /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v ConnectedSearchUseWeb /t REG_DWORD /d 0 /f</Path>
|
|
<Description>Disable Connected Search Use Web</Description>
|
|
</RunSynchronousCommand>
|
|
|
|
<!-- Disable Cortana Speech Recognition -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>36</Order>
|
|
<Path>cmd /c reg add "HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization" /v AllowInputPersonalization /t REG_DWORD /d 0 /f</Path>
|
|
<Description>Disable Cortana Speech Recognition</Description>
|
|
</RunSynchronousCommand>
|
|
|
|
<!-- Disable Search Highlights (news/trending) -->
|
|
<RunSynchronousCommand wcm:action="add">
|
|
<Order>38</Order>
|
|
<Path>cmd /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v EnableDynamicContentInWSB /t REG_DWORD /d 0 /f</Path>
|
|
<Description>Disable Search Highlights</Description>
|
|
</RunSynchronousCommand>
|
|
</RunSynchronous>
|
|
</component>
|
|
</settings>
|
|
|
|
<!-- 4. oobeSystem: hide OEM/EULA screens -->
|
|
<settings pass="oobeSystem">
|
|
<component name="Microsoft-Windows-Shell-Setup"
|
|
processorArchitecture="amd64"
|
|
publicKeyToken="31bf3856ad364e35"
|
|
language="neutral"
|
|
versionScope="nonSxS">
|
|
<OOBE>
|
|
<HideEULAPage>true</HideEULAPage>
|
|
<HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
|
|
<HideOnlineAccountScreens>false</HideOnlineAccountScreens>
|
|
<HideWirelessSetupInOOBE>false</HideWirelessSetupInOOBE>
|
|
<HideLocalAccountScreen>true</HideLocalAccountScreen>
|
|
<NetworkLocation>Work</NetworkLocation>
|
|
<ProtectYourPC>3</ProtectYourPC>
|
|
<SkipUserOOBE>false</SkipUserOOBE>
|
|
<SkipMachineOOBE>false</SkipMachineOOBE>
|
|
</OOBE>
|
|
<FirstLogonCommands>
|
|
|
|
<!-- Install Zscaler -->
|
|
<SynchronousCommand wcm:action="add">
|
|
<Order>2</Order>
|
|
<CommandLine>C:\Deploy\Applications\extra\zscaler\zscaler.bat</CommandLine>
|
|
<Description>Install Zscaler Client Connector</Description>
|
|
</SynchronousCommand>
|
|
|
|
<!-- Install Microsoft Office -->
|
|
</FirstLogonCommands>
|
|
</component>
|
|
</settings>
|
|
|
|
</unattend>
|