NT AUTHORITY\SYSTEM alias
LocalSystem,
it violates the minimum requirements of the almost
30 (in words: thirty) years old
Designed for Windows
specification, and it doesn’t follow best practices as well as
many security recommendations.
Short8.3 Filenames, but
LongPathnames
… Short
8.3 filenames are a
completely superfluous cruft from the past of
MS-DOS …
DIR "%SystemDrive%\??????~?.*" /A /S /X
…
REGEDIT4
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"NTFSDisable8dot3NameCreation"=dword:00000001
"Win95TruncatedExtensions"=dword:00000000… Windows PE …
Setup.exe /NoReboot FSUtil.exe 8Dot3Name Strip /F /L ‹drive letter›:\Windows\Temp\FSUtil.log /S ‹drive letter›:\ FSUtil.exe 8Dot3Name Set ‹drive letter›: 1FSUtil 8dot3Name
The length limitation of pathnames to 259 alias
MAX_PATH − 1 characters is another cruft from the
past …
REGEDIT4
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"LongPathsEnabled"=dword:00000001 Activate the builtin Administrator user account, as
documented in the
TechNet
article
Enable and Disable the Built-in Administrator Account,
then demote the user account created during
Windows Setup from (protected) administrator
to
(unprivileged) standard user
:
"%SystemRoot%\System32\Net.exe" USER Administrator /Active:Yes /PasswordReq:Yes "%SystemRoot%\System32\Net.exe" LOCALGROUP Administrators "%USERNAME%" /Delete "%SystemRoot%\System32\Net.exe" LOCALGROUP Users "%USERNAME%" /AddNet user Net localgroup
No
qUACkery
any more – disable (automatic) silent elevation of
applications under the user
(protected) administrator
account created during
Windows Setup, and disable prompted elevation in
(unprivileged) standard
user accounts, as documented in the
TechNet
article
UAC Group Policy Settings and Registry Key Settings:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000002
"ConsentPromptBehaviorUser"=dword:00000000 Block (unprivileged) standard
user accounts from logging on
in Safe Mode
, as documented in the
MSKB
article
977542:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"SafeModeBlockNonAdmins"=dword:00000001 Set the attributes hidden
, read-only
and system
on the system’s (shared) Temp
directory
%SystemRoot%\Temp\ as well as the base
directories %SystemRoot%\System32\Tasks\ and
%SystemRoot%\SysWoW64\Tasks\ of the
Task Scheduler to prevent
File Explorer from trying to
perform the permanent damage documented in the
MSKB
article
950934:
For %? In ("%SystemRoot%\System32\Tasks"
"%SystemRoot%\SysWOw64\Tasks"
"%SystemRoot%\Temp") Do "%SystemRoot%\System32\Attrib.exe" +H +R +S "%~?"
Separate the system’s user-writable (shared) TEMP
directory %SystemRoot%\Temp\ from that of the
NT AUTHORITY\SYSTEM alias
LocalSystem
user account:
MkDir "%SystemRoot%\System32\Config\SystemProfile\AppData\Local\Temp" If Exist "%SystemRoot%\SysWoW64\Config\SystemProfile" MkDir "%SystemRoot%\SysWoW64\Config\SystemProfile\AppData\Local\Temp" "%SystemRoot%\System32\SetX.exe" TEMP "%%USERPROFILE%%\AppData\Local\Temp" /M "%SystemRoot%\System32\SetX.exe" TMP "%%USERPROFILE%%\AppData\Local\Temp" /M
Enable SAFER – either AppLocker or Software Restriction Policies – to prevent execution of user-writable files.
Note: my separate articles One-Click Setup for AppLocker Policy and Stop Mal(icious Soft)ware with Software Restriction Policies alias SAFER provide detailed instructions and background information.
Disable network access to the Service Control Manager:
REGEDIT4
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]
"DisableRemoteSCMEndpoints"=dword:00000001… MSKB articles 147706 239869, 272129 305379 820281 823659, 954387 960859, 968389 973811 and 2793313, plus the TechNet article Configuring Additional LSA Protection …
REGEDIT4
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA]
; Disable insecure 'LAN Manager' authentication
; 0: send LM and NTLMv1 responses; never use NTLMv2 security
; 1: send LM and NTLMv1 responses; use NTLMv2 if negotiated
; 2: send NTLMv1 response only
; 3: send NTLMv2 response only; still accept both LM and NTLMv1 challenges
; 4: send NTLMv2 response only; refuse LM challenge, accept both NTLMv1 and NTLMv2 challenges
; 5: send NTLMv2 response only; refuse LM and NTLMv1 challenges, accept NTLMv2 challenge only
"LMCompatibilityLevel"=dword:00000005
"NoLMHash"=dword:00000001
"RunAsPPL"=dword:00000001 …
MSKB
article
2264107
and the MSDN
article
NeedCurrentDirectoryForExePath()
…
REGEDIT4
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"CWDIllegalInDLLSearch"=dword:ffffffff
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment]
"NoDefaultCurrentDirectoryInExePath"="*"… MSKB article 2893294, the security bulletin MS13-098 and the security advisory Changes in Windows Authenticode Signature Verification …
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\WinTrust\Config]
"EnableCertPaddingCheck"="1""%SystemRoot%\System32\Reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\WinTrust\Config" /V "EnableCertPaddingCheck" /T REG_SZ /F /D "1" /REG:64 "%SystemRoot%\System32\Reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\WinTrust\Config" /V "EnableCertPaddingCheck" /T REG_SZ /F /D "1" /REG:32
�
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System]
"ProfileErrorAction"=dword:00000001REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device]
"DevicePasswordLessBuildVersion"=dword:00000000Disable user authentication via Microsoft Accounts:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MicrosoftAccount]
"DisableUserAuth"=dword:00000001Disable automatic device encryption:
REGEDIT4
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BitLocker]
"PreventDeviceEncryption"=dword:00000001Log the command line with process creation events:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit]
"ProcessCreationIncludeCmdLine_Enabled"=dword:00000001 Relocate the Network Database
files from the directory
%SystemRoot%\System32\Drivers\Etc\ to the directory
%ProgramData%\Microsoft\Network\Database\ and create
hardlinks to the files below the %SystemRoot%\WinSxS\
directory in the former:
MkDir "%ProgramData%\Microsoft\Network\Database" && (
Move "%SystemRoot%\System32\Drivers\Etc\*" "%ProgramData%\Microsoft\Network\Database"
For %! In ("%ProgramData%\Microsoft\Network\Database\*") Do @(
For /D /R "%SystemRoot%\WinSxS" %? In (*) Do @(
If Exist "%?\%~nx!" MkLink /H "%SystemRoot%\System32\Drivers\Etc\%~nx!" "%?\%~nx!"))
"%SystemRoot%\System32\Reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters" /V "DataBasePath" /T REG_SZ /F /D "%ProgramData%\Microsoft\Network\Database")
Relocate the
Task Scheduler
log file from %SystemRoot%\Tasks\SchedLgU.txt to
%SystemRoot%\System32\LogFiles\Scheduler.log:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SchedulingAgent]
;"LogPath"=expand:"%SystemRoot%\\System32\\LogFiles\\Scheduler.log"
"LogPath"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73,74,65,6d,33,32,5c,4c,6f,67,46,69,6c,65,73,5c,53,63,68,65,64,75,6c,65,72,2e,6c,6f,67,00Although the NT Virtual DOS Machine is an optional component since Windows 8.1, it gets installed on-demand as soon as a 16-bit DOS or legacy Windows application is executed.
See the MSDN article Windows components installed on demand for details.
On 32-bit editions, disable the NTVDM subsystem for 16-bit applications:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat]
"VDMDisallowed"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WoW]
"DisallowedPolicyDefault"=dword:00000001Optionally place future user profiles on another physical disk:
"%SystemRoot%\System32\XCopy.exe" "%SystemDrive%\Users\Desktop?.ini" "‹drive letter›:\Users" /F /H /I /K /O /R /V /X "%SystemRoot%\System32\Reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /V "ProfilesDirectory" /T REG_SZ /F /D "‹drive letter›:\Users"
Disable the ms-appinstaller
URL protocol
handler:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\URLBlockList]
"0"="ms-appinstaller:*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppInstaller]
"EnableMSAppInstallerProtocol"=dword:00000000 Disable execution of AutoRun
commands by the
Command Processor
Cmd.exe when starting
batch scripts per double-click:
FTYPE batfile=%COMSPEC% /D /C "%L" %* FTYPE cmdfile=%COMSPEC% /D /C "%L" %* ASSOC batfile\shell\runas\command=%COMSPEC% /D /C "%L" %* ASSOC cmdfile\shell\runas\command=%COMSPEC% /D /C "%L" %*
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\Shell\Open\Command]
@="C:\\Windows\\System32\\Cmd.exe /D /C \"%L\" %*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\Shell\RunAs]
"HasLUAShield"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\Shell\RunAs\Command]
@="C:\\Windows\\System32\\Cmd.exe /D /C \"%L\" %*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\Shell\Open\Command]
@="C:\\Windows\\System32\\Cmd.exe /D /C \"%L\" %*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\Shell\RunAs]
"HasLUAShield"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\Shell\RunAs\Command]
@="C:\\Windows\\System32\\Cmd.exe /D /C \"%L\" %*"thanksto the Merged View of HKEY_CLASSES_ROOT introduced with Windows 2000 this fix but fails if the unnamed default registry entry with the default command line template
"%1" %* is present in the
corresponding registry key
HKEY_CURRENT_USER\Software\Classes\‹file type›\Shell\‹verb›\Command
of a user account!
Disable execution of .hta
files, as documented in the
MSKB
article
5022289,
and introduced with security update
5018410
for Windows 10 21H2 and with security update
5018418
for Windows 11 21H2:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\HTA]
"DisableHTMLApplication"=dword:00000001 Disable
Windows Script Host
and with it execution of
JScript
as well as
VBScript
files, typically .js,
.jse,
.vbs,
.vbe,
.wsf
and
.wsh:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings]
"Enabled"=dword:00000000
"IgnoreUserSettings"=dword:00000001
"LogSecurityFailures"=dword:00000001
"LogSecuritySuccesses"=dword:00000000
"Remote"=dword:00000000
"TrustPolicy"=dword:00000002
"UseWinSAFER"=dword:00000001Disable JScript and VBScript in all URL security zones of Internet Explorer for every user account:
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\LockDown_Zones\0]
"140C"=dword:00000003
"140D"=dword:00000003
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\LockDown_Zones\1]
"140C"=dword:00000003
"140D"=dword:00000003
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\LockDown_Zones\2]
"140C"=dword:00000003
"140D"=dword:00000003
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\LockDown_Zones\3]
"140C"=dword:00000003
"140D"=dword:00000003
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\LockDown_Zones\4]
"140C"=dword:00000003
"140D"=dword:00000003
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
"140C"=dword:00000003
"140D"=dword:00000003
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
"140C"=dword:00000003
"140D"=dword:00000003
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
"140C"=dword:00000003
"140D"=dword:00000003
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
"140C"=dword:00000003
"140D"=dword:00000003
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
"140C"=dword:00000003
"140D"=dword:00000003Enable TLS 1.3:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings]
; 00000020 ; SSL 3.0
; 00000080 ; TLS 1.0
; 00000200 ; TLS 1.1
; 00000800 ; TLS 1.2
; 00002000 ; TLS 1.3
"SecureProtocols"=dword:00002a00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SChannel\Protocols\TLS 1.3\Client]
"DisabledByDefault"=dword:00000000
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SChannel\Protocols\TLS 1.3\Server]
"DisabledByDefault"=dword:00000000
"Enabled"=dword:00000001Enable BitLocker without Trusted Platform Module:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE]
"EnableBDEWithNoTPM"=dword:00000001
"UseAdvancedStartup"=dword:00000001Manage-BDE.exe -protectors -get "%SystemDrive%"
Manage-BDE.exe -protectors -add ‹drive letter’: .sid "%USERDOMAIN%\%USERNAME%"
�
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AdvertisingInfo]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo]
"DisabledByGroupPolicy"=dword:00000001�
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge]
"AllowGamesMenu"=dword:00000000
"AlternateErrorPagesEnabled"=dword:00000000
"AutoImportAtFirstRun"=dword:00000004
"BuiltInDNSClientEnabled"=dword:00000000
"DefaultBrowserSettingEnabled"=dword:00000000
"DefaultBrowserSettingsCampaignEnabled"=dword:00000000
"DiagnosticData"=dword:00000000
"EdgeShoppingAssistantEnabled"=dword:00000000
"HideFirstRunExperience"=dword:00000001
"HubsSidebarEnabled"=dword:00000000
"Microsoft365CopilotChatIconEnabled"=dword:00000000
"MicrosoftEdgeInsiderPromotionEnabled"=dword:00000000
"NewTabPageBingChatEnabled"=dword:00000000
"NewTabPageContentEnabled"=dword:00000000
"NewTabPageHideDefaultTopSites"=dword:00000001
"NewTabPageSearchBox"="redirect"
"ShowMicrosoftRewards"=dword:00000000
"ShowPDFDefaultRecommendationsEnabled"=dword:00000000
"ShowRecommendationsEnabled"=dword:00000000
"SpotlightExperiencesAndRecommendationsEnabled"=dword:00000000
"StartupBoostEnabled"=dword:00000000
"TabServicesEnabled"=dword:00000000
"TextPredictionEnabled"=dword:00000000
"VisualSearchEnabled"=dword:00000000
"WebToBrowserSignInEnabled"=dword:00000000�
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowCortanaButton"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search]
"AllowCortana"=dword:00000000
"AllowSearchToUseLocation"=dword:00000000
"BingSearchEnabled"=dword:00000000
"ConnectedSearchPrivacy"=dword:00000003
"ConnectedSearchUseWeb"=dword:00000000
"ConnectedSearchUseWebOverMeteredConnections"=dword:00000000
"CortanaConsent"=dword:00000000
"DisableWebSearch"=dword:00000001
"SearchBoxTaskbarMode"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search]
"AllowCortana"=dword:00000000
"ConnectedSearchUseWeb"=dword:00000000
"ConnectedSearchUseWebOverMeteredConnections"=dword:00000000
"DisableWebSearch"=dword:00000001
"EnableDynamicContentInWSB"=dword:00000000Disable OneDrive notifications:
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSyncProviderNotifications"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\StorageSense\Parameters\BackupReminder]
"BackupReminderToastCount"=dword:00000003Unless you definitively want to use OneDrive and store your personal documents on other people’s computers, create the following Registry entries to disable its client:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OneDrive]
"PreventNetworkTrafficPreUserSignIn"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\OneDrive]
"DisableFileSync"=dword:00000001
"DisableFileSyncNGSC"=dword:00000001
"DisableLibrariesDefaultSaveToOneDrive"=dword:00000001
"DisableMeteredNetworkFileSync"=dword:00000001OneDriveSetup.exe
from the Default user’s registry hive before the
first user login to prevent the installation of the
outdated OneDrive Client shipped with
Windows in every user profile (where
it is unprotected against tampering and can be overwritten).
"%SystemRoot%\System32\Reg.exe" LOAD "HKEY_USERS\DEFAULT" "%SystemDrive%\Users\Default\NTUSER.DAT" "%SystemRoot%\System32\Reg.exe" DELETE "HKEY_USERS\DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run" /V "OneDriveSetup" /F "%SystemRoot%\System32\Reg.exe" UNLOAD "HKEY_USERS\DEFAULT"Note: optionally run the command line
%SystemRoot%\System32\OneDriveSetup.exe /AllUsers on
32-bit systems respectively
%SystemRoot%\SysWoW64\OneDriveSetup.exe /AllUsers on
64-bit systems to perform a per-machine installation of the
OneDrive Client.
Install the sync app per-machine
Download OneDrive
Additionally delete the installation program
%SystemRoot%\System32\OneDriveSetup.exe on 32-bit
systems respectively
%SystemRoot%\SysWoW64\OneDriveSetup.exe on 64-bit
systems.
Unless you definitively want to use the Malicious Software Removal Tool, create the following Registry entries to block its automatic monthly (re)installation via Windows Update and disable its reporting feature, as documented in the MSKB articles 890830 and 891716:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT]
"DontOfferThroughWUAU"=dword:00000001
"DontReportInfectionInformation"=dword:00000001 Disable the Get Even More Out of Windows
screen:
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UserProfileEngagement]
"ScOoBESystemSettingEnabled"=dword:00000009Disable Game Bar tipps:
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\GameBar]
"ShowStartupPanel"=dword:00000000Disable the Lock Screen:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization]
"NoLockScreen"=dword:00000001 4027690
Show Command Prompt
instead of PowerShell
on the
Start Menu, and Start Command Prompt here
instead of Start PowerShell here
on the
Context Menu of directories and drives, for all or just
selected users:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"DontUsePowerShellOnWinX"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"DontUsePowerShellOnWinX"=dword:00000001 Show more details in the Copy
dialog box:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\OperationStatusManager]
"EnthusiastMode"=dword:00000001Configure Automatic Updates using Registry Editor Disable automatic reboot while users are logged on after (automatic) installation of updates, as documented in the TechNet article Configure Automatic Updates in a Non–Active Directory Environment:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
;"ActiveHoursStart"=dword:00000000
;"ActiveHoursEnd"=dword:00000017
"SetActiveHours"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"AUOptions"=dword:00000005
"IncludeRecommendedUpdates"=dword:00000000
"NoAutoRebootWithLoggedOnUsers"=dword:00000001 Disable automatic installation of suggested Apps
,
Windows App Store Suggestions
and other gimmicks:
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager]
"ContentDeliveryAllowed"=dword:00000000
"FeatureManagementEnabled"=dword:00000000
"OEMPreInstalledAppsEnabled"=dword:00000000
"PreInstalledAppsEnabled"=dword:00000000
"PreInstalledAppsEverEnabled"=dword:00000000
"SilentInstalledAppsEnabled"=dword:00000000
"SoftLandingEnabled"=dword:00000000
"SubscribedContentEnabled"=dword:00000000
"SubscribedContent-310093Enabled"=dword:00000000
"SubscribedContent-338387Enabled"=dword:00000000
"SubscribedContent-338388Enabled"=dword:00000000
"SubscribedContent-338389Enabled"=dword:00000000
"SubscribedContent-338393Enabled"=dword:00000000
"SystemPaneSuggestionsEnabled"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PenWorkspace]
"PenWorkspaceAppSuggestionsEnabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent]
"ConfigureWindowsSpotlight"=dword:00000002
"DisableSoftLanding"=dword:00000001
"DisableSpotlightCollectionOnDesktop"=dword:00000001
"DisableTailoredExperiencesWithDiagnosticData"=dword:00000001
"DisableThirdPartySuggestions"=dword:00000001
"DisableWindowsConsumerFeatures"=dword:00000001
"DisableWindowsSpotlightFeatures"=dword:00000001
"DisableWindowsSpotlightOnActionCenter"=dword:00000001
"DisableWindowsSpotlightOnSettings"=dword:00000001
"DisableWindowsSpotlightWindowsWelcomeExperience"=dword:00000001
"IncludeEnterpriseSpotlight"=dword:00000000Disable automatic changes of the desktop background, i.e. the wallpaper:
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Settings]
"EnabledState"=dword:00000000Disable Online Help & Tips in the Immersive Control Panel and the News & Interests icon on the Taskbar:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"AllowOnlineTips"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Feeds]
"EnableFeeds"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Feeds]
"ShellFeedsTaskbarViewMode"=dword:00000002 Disable Fast Startup
:
REGEDIT4
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power]
"HiberBootEnabled"=dword:00000000Disable automatic login (to the lock screen) after reboot:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableAutomaticRestartSignOn"=dword:00000001Disable search results from the Internet:
REGEDIT4
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer]
"DisableSearchBoxSuggestions"=dword:00000001Disable creation of the desktop icon for Edge Chromium:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\EdgeUpdate]
"CreateDesktopShortcutDefault"=dword:00000000 Unless you intend to join an Active Directory Domain
and also operate the computer with permanent network connectivity to
the domain controllers, run the following command line to modify the
start/stop trigger of the W32Time service, as
documented in the
MSKB
article
2385818:
"%SystemRoot%\System32\SC.exe" TriggerInfo W32Time Start/NetworkOn Stop/NetworkOff
�
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer]
"NoUseStoreOpenWith"=dword:00000001�
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore]
"AutoDownload"=dword:00000002
"DisableStoreApps"=dword:00000001
"RemoveWindowsStore"=dword:00000001 Remove provisioned Apps
:
"%SystemRoot%\System32\DISM.exe" /Online /Get-ProvisionedAppxPackages /Format:Table | "%SystemRoot%\System32\FindStr.exe" /B /C:"PackageName: " 1>"%TMP%\Nine.tmp"
For /F "Tokens=2 UseBackQ" %? In ("%TMP%\Nine.tmp") Do "%SystemRoot%\System32\DISM.exe" /Online /Remove-ProvisionedAppxPackage /PackageName:%?
REGEDIT4
; Disable (re)installation of (de)provisioned 'Apps'
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.3DBuilder_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.549981C3F5F10_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.BingWeather_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.GetHelp_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Getstarted_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.HEIFImageExtension_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Messaging_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MixedReality.Portal_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MSPaint_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Office.OneNote_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.OneConnect_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Outlook.DesktopIntegrationServices_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.People_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Print3D_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ScreenSketch_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.SkypeApp_kzf8qxf38zg5c]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.StorePurchaseApp_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.VCLibs.140.00_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Wallet_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WebMediaExtensions_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WebpImageExtension_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.Photos_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsAlarms_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCamera_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCommunicationsApps_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsMaps_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsStore_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Xbox.TCUI_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxApp_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxGameOverlay_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.YourPhone_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneMusic_8wekyb3d8bbwe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe]Prevent the installation of Outlook for Windows with cumulative updates in 2025:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe]
"BlockedOobeUpdaters"="[\"MS_Outlook\"]"Fix MIME content type registration …
REGEDIT4
[HKEY_CLASSES_ROOT\.acm]
"Content Type"="application/vnd.microsoft.portable-executable"
[HKEY_CLASSES_ROOT\.ax]
"Content Type"="application/vnd.microsoft.portable-executable"
[HKEY_CLASSES_ROOT\.cab]
"Content Type"="application/vnd.ms-cab-compressed"
[HKEY_CLASSES_ROOT\.com]
"Content Type"="application/vnd.microsoft.portable-executable"
[HKEY_CLASSES_ROOT\.cpl]
"Content Type"="application/vnd.microsoft.portable-executable"
[HKEY_CLASSES_ROOT\.dll]
"Content Type"="application/vnd.microsoft.portable-executable"
[HKEY_CLASSES_ROOT\.drv]
"Content Type"="application/vnd.microsoft.portable-executable"
[HKEY_CLASSES_ROOT\.efi]
"Content Type"="application/vnd.microsoft.portable-executable"
[HKEY_CLASSES_ROOT\.exe]
"Content Type"="application/vnd.microsoft.portable-executable"
[HKEY_CLASSES_ROOT\.ime]
"Content Type"="application/vnd.microsoft.portable-executable"
[HKEY_CLASSES_ROOT\.mui]
"Content Type"="application/vnd.microsoft.portable-executable"
[HKEY_CLASSES_ROOT\.msu]
"Content Type"="application/vnd.ms-cab-compressed"
[HKEY_CLASSES_ROOT\.ocx]
"Content Type"="application/vnd.microsoft.portable-executable"
[HKEY_CLASSES_ROOT\.scr]
"Content Type"="application/vnd.microsoft.portable-executable"
[HKEY_CLASSES_ROOT\.sys]
"Content Type"="application/vnd.microsoft.portable-executable"
[HKEY_CLASSES_ROOT\.tsp]
"Content Type"="application/vnd.microsoft.portable-executable"
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\ascii]
"AliasForCharSet"=-
"CodePage"=dword:00004E9F ; 20127
"InternetEncoding"=dword:00004E9F
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\csASCII]
"AliasForCharSet"=-
"CodePage"=dword:00004E9F ; 20127
"InternetEncoding"=dword:00004E9F
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\csISOLatin1]
"AliasForCharSet"="iso-8859-1"
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\csISOLatin3]
"AliasForCharSet"="iso-8859-3"
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\csISOLatin6]
"AliasForCharSet"="iso-8859-10"
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\csISOLatin7]
"AliasForCharSet"="iso-8859-13"
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\csISOLatin8]
"AliasForCharSet"="iso-8859-14"
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\csISOLatin9]
"AliasForCharSet"="iso-8859-15"
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\csISOLatin10]
"AliasForCharSet"="iso-8859-16"
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\iso-8859-1]
"CodePage"=dword:00006FAF ; 28591
"InternetEncoding"=dword:00006FAF
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\iso-8859-2]
"CodePage"=dword:00006FB0 ; 28592
"InternetEncoding"=dword:00006FB0
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\iso-8859-3]
"CodePage"=dword:00006FB1 ; 28593
"InternetEncoding"=dword:00006FB1
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\iso-8859-4]
"CodePage"=dword:00006FB2 ; 28594
"InternetEncoding"=dword:00006FB2
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\iso-8859-5]
"CodePage"=dword:00006FB3 ; 28595
"InternetEncoding"=dword:00006FB3
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\iso-8859-6]
"CodePage"=dword:00006FB4 ; 28596
"InternetEncoding"=dword:00006FB4
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\iso-8859-7]
"CodePage"=dword:00006FB5 ; 28597
"InternetEncoding"=dword:00006FB5
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\iso-8859-8]
"CodePage"=dword:00006FB6 ; 28598
"InternetEncoding"=dword:00006FB6
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\iso-8859-9]
"CodePage"=dword:00006FB7 ; 28599
"InternetEncoding"=dword:00006FB7
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\iso-8859-10]
"CodePage"=dword:00006FB8 ; 28600
"InternetEncoding"=dword:00006FB8
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\iso-8859-11]
"AliasForCharSet"=-
"CodePage"=dword:00006FB9 ; 28601
"InternetEncoding"=dword:00006FB9
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\iso-8859-12]
"CodePage"=dword:00006FBA ; 28602
"InternetEncoding"=dword:00006FBA
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\iso-8859-13]
"CodePage"=dword:00006FBB ; 28603
"InternetEncoding"=dword:00006FBB
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\iso-8859-14]
"CodePage"=dword:00006FBC ; 28604
"InternetEncoding"=dword:00006FBC
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\iso-8859-15]
"CodePage"=dword:00006FBD ; 28605
"InternetEncoding"=dword:00006FBD
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\iso-8859-16]
"CodePage"=dword:00006FBE ; 28606
"InternetEncoding"=dword:00006FBE
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\ISO646-US]
"AliasForCharSet"=-
"CodePage"=dword:00004E9F ; 20127
"InternetEncoding"=dword:00004E9F
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\ISO_646.irv:1991]
"AliasForCharSet"=-
"CodePage"=dword:00004E9F ; 20127
"InternetEncoding"=dword:00004E9F
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\l1]
"AliasForCharSet"="iso-8859-1"
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\x-cp1252]
"AliasForCharSet"="windows-1252"
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\x-cp1253]
"AliasForCharSet"="windows-1253"
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\x-cp1254]
"AliasForCharSet"="windows-1254"
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\x-cp1255]
"AliasForCharSet"="windows-1255"
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\x-cp1256]
"AliasForCharSet"="windows-1256"
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\x-cp1257]
"AliasForCharSet"="windows-1257"
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\x-cp1258]
"AliasForCharSet"="windows-1258"
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\us]
"AliasForCharSet"=-
"CodePage"=dword:00004E9F ; 20127
"InternetEncoding"=dword:00004E9F
[HKEY_CLASSES_ROOT\MIME\Database\CharSet\us-ascii]
"AliasForCharSet"=-
"CodePage"=dword:00004E9F ; 20127
"InternetEncoding"=dword:00004E9F
[HKEY_CLASSES_ROOT\MIME\DataBase\CharSet\windows-1254]
"AliasForCharSet"=-
"CodePage"=dword:000004E6 ; 1254
"InternetEncoding"=dword:000004E6
[HKEY_CLASSES_ROOT\MIME\Database\CodePage\1250]
"BodyCharSet"="windows-1250"
[HKEY_CLASSES_ROOT\MIME\Database\CodePage\1251]
"BodyCharSet"="windows-1251"
[HKEY_CLASSES_ROOT\MIME\Database\CodePage\1252]
"BodyCharSet"="windows-1252"
"WebCharSet"="windows-1252"
[HKEY_CLASSES_ROOT\MIME\Database\CodePage\1253]
"BodyCharSet"="windows-1253"
[HKEY_CLASSES_ROOT\MIME\Database\CodePage\1254]
"BodyCharSet"="windows-1254"
"WebCharSet"="windows-1254"
[HKEY_CLASSES_ROOT\MIME\Database\CodePage\1255]
"BodyCharSet"="windows-1255"
[HKEY_CLASSES_ROOT\MIME\Database\CodePage\1256]
"BodyCharSet"="windows-1256"
[HKEY_CLASSES_ROOT\MIME\Database\CodePage\1257]
"BodyCharSet"="windows-1257"
[HKEY_CLASSES_ROOT\MIME\Database\CodePage\20127]
"BodyCharSet"="us-ascii"
"Description"="ASCII"
"Family"=dword:000004E4 ; 1252
"Level"=hex(3):01,01,00,00
[HKEY_CLASSES_ROOT\MIME\Database\CodePage\28591]
"BodyCharSet"="iso-8859-1"
"Description"="Western (ISO)"
"Family"=dword:000004E4 ; 1252
"Level"=hex(3):07,07,00,00
[HKEY_CLASSES_ROOT\MIME\Database\CodePage\28599]
"BodyCharSet"="iso-8859-9"
"Description"="Turkish (ISO)"
"Encoding"=hex(3):02,02,00,00
"Family"=dword:000004E6 ; 1254
"Level"=hex(3):07,07,00,00
[HKEY_CLASSES_ROOT\MIME\Database\CodePage\28600]
"BodyCharSet"="iso-8859-10"
"Description"="Nordic (ISO)"
"Family"=dword:000004E9 ; 1257
"Level"=hex(3):01,03,00,00
[HKEY_CLASSES_ROOT\MIME\Database\CodePage\28603]
"BodyCharSet"="iso-8859-13"
"Description"="Baltic (ISO)"
"Family"=dword:000004E9 ; 1257
"Level"=hex(3):01,03,00,00
[HKEY_CLASSES_ROOT\MIME\Database\CodePage\28604]
"BodyCharSet"="iso-8859-14"
"Description"="Celtic (ISO)"
"Family"=dword:000004E4 ; 1252
"Level"=hex(3):01,03,00,00
[HKEY_CLASSES_ROOT\MIME\Database\CodePage\28605]
"BodyCharSet"="iso-8859-15"
"Description"="Latin 9 (ISO)"
"Family"=dword:000004E4 ; 1252
"Level"=hex(3):07,07,00,00
[HKEY_CLASSES_ROOT\MIME\Database\CodePage\28606]
"BodyCharSet"="iso-8859-16"
"Description"="Latin 10 (ISO)"
"Family"=dword:000004E4 ; 1252
"Level"=hex(3):07,07,00,00
[HKEY_CLASSES_ROOT\MIME\DataBase\Content Type\application/vnd.microsoft.portable-executable]
;"Extension"=".exe"
[HKEY_CLASSES_ROOT\MIME\DataBase\Content Type\application/vnd.ms-cab-compressed]
;"Extension"=".cab"�
REGEDIT4
; Copyright © 2004-2026, Stefan Kanthak <stefan.kanthak@nexgo.de>
[HKEY_CLASSES_ROOT\MSI.Package\Shell\RunAs]
"HasLUAShield"=""
"MUIVerb"="@C:\\Windows\\System32\\MSIMsg.dll,-36"
[HKEY_CLASSES_ROOT\MSI.Package\Shell\RunAs\Command]
@="C:\\Windows\\System32\\MSIExec.exe /I \"%L\" %*"
[HKEY_CLASSES_ROOT\MSI.Patch\Shell\RunAs]
"HasLUAShield"=""
"MUIVerb"="@C:\\Windows\\System32\\MSIMsg.dll,-39"
[HKEY_CLASSES_ROOT\MSI.Patch\Shell\RunAs\Command]
@="C:\\Windows\\System32\\MSIExec.exe /P \"%L\" %*"
[HKEY_CLASSES_ROOT\MSI.Patch\Shell\RunAsUser]
@="@C:\\Windows\\System32\\Shell32.dll,-50944"
;@="@C:\\Windows\\System32\\TWinUI.dll,-8502" ; �
"Extended"=""
"SuppressionPolicyEx"="{F211AA05-D4DF-4370-A2A0-9F19C09756A7}"
[HKEY_CLASSES_ROOT\MSI.Patch\Shell\RunAsUser\Command]
"DelegateExecute"="{EA72D00E-4960-42FA-BA92-7792A7944C1D}"�
REGEDIT4
[HKEY_CLASSES_ROOT\.bmp]
@="PhotoViewer.FileAssoc.BitMap"
[HKEY_CLASSES_ROOT\.bmp\OpenWithProgIDs]
"PhotoViewer.FileAssoc.BitMap"=hex(0):
[HKEY_CLASSES_ROOT\.dib]
@="PhotoViewer.FileAssoc.BitMap"
[HKEY_CLASSES_ROOT\.dib\OpenWithProgIDs]
"PhotoViewer.FileAssoc.BitMap"=hex(0):
[HKEY_CLASSES_ROOT\.gif]
@="PhotoViewer.FileAssoc.GIF"
[HKEY_CLASSES_ROOT\.gif\OpenWithProgIDs]
"PhotoViewer.FileAssoc.GIF"=hex(0):
[HKEY_CLASSES_ROOT\.ico]
@="PhotoViewer.FileAssoc.BitMap"
[HKEY_CLASSES_ROOT\.ico\OpenWithProgIDs]
"PhotoViewer.FileAssoc.BitMap"=hex(0):
[HKEY_CLASSES_ROOT\.jfif]
@="PhotoViewer.FileAssoc.JFIF"
[HKEY_CLASSES_ROOT\.jfif\OpenWithProgIDs]
"PhotoViewer.FileAssoc.JFIF"=hex(0):
[HKEY_CLASSES_ROOT\.jpe]
@="PhotoViewer.FileAssoc.JPEG"
[HKEY_CLASSES_ROOT\.jpe\OpenWithProgIDs]
"PhotoViewer.FileAssoc.JPEG"=hex(0):
[HKEY_CLASSES_ROOT\.jpeg]
@="PhotoViewer.FileAssoc.JPEG"
[HKEY_CLASSES_ROOT\.jpeg\OpenWithProgIDs]
"PhotoViewer.FileAssoc.JPEG"=hex(0):
[HKEY_CLASSES_ROOT\.jpg]
@="PhotoViewer.FileAssoc.JPEG"
[HKEY_CLASSES_ROOT\.jpg\OpenWithProgIDs]
"PhotoViewer.FileAssoc.JPEG"=hex(0):
[HKEY_CLASSES_ROOT\.png]
@="PhotoViewer.FileAssoc.PNG"
[HKEY_CLASSES_ROOT\.png\OpenWithProgIDs]
"PhotoViewer.FileAssoc.PNG"=hex(0):
[HKEY_CLASSES_ROOT\.rle]
@="PhotoViewer.FileAssoc.BitMap"
[HKEY_CLASSES_ROOT\.rle\OpenWithProgIDs]
"PhotoViewer.FileAssoc.BitMap"=hex(0):
[HKEY_CLASSES_ROOT\.tif]
@="PhotoViewer.FileAssoc.TIFF"
[HKEY_CLASSES_ROOT\.tif\OpenWithProgIDs]
"PhotoViewer.FileAssoc.TIFF"=hex(0):
[HKEY_CLASSES_ROOT\.tiff]
@="PhotoViewer.FileAssoc.TIFF"
[HKEY_CLASSES_ROOT\.tiff\OpenWithProgIDs]
"PhotoViewer.FileAssoc.TIFF"=hex(0):
[HKEY_CLASSES_ROOT\.wdp]
@="PhotoViewer.FileAssoc.WDP"
[HKEY_CLASSES_ROOT\.wdp\OpenWithProgIDs]
"PhotoViewer.FileAssoc.WDP"=hex(0):
[HKEY_CLASSES_ROOT\Applications\PhotoViewer.dll\Shell\Open]
"MUIVerb"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3043"
[HKEY_CLASSES_ROOT\Applications\PhotoViewer.dll\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\Applications\PhotoViewer.dll\Shell\Open\DropTarget]
"CLSID"="{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}"
[HKEY_CLASSES_ROOT\Applications\PhotoViewer.dll\Shell\Print\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\Applications\PhotoViewer.dll\Shell\Print\DropTarget]
"CLSID"="{60FD46DE-F830-4894-A628-6FA81BC0190D}"
[HKEY_CLASSES_ROOT\Applications\PhotoViewer.dll\SupportedTypes]
".bmp"=""
".dib"=""
".gif"=""
".ico"=""
".jfif"=""
".jpe"=""
".jpeg"=""
".jpg"=""
".png"=""
".rle"=""
".tif"=""
".tiff"=""
".wdp"=""
[HKEY_CLASSES_ROOT\icofile\Shell\Open]
"MUIVerb"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3043"
[HKEY_CLASSES_ROOT\icofile\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\icofile\Shell\Open\DropTarget]
"CLSID"="{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}"
[HKEY_CLASSES_ROOT\jpegfile\Shell\Open]
"MUIVerb"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3043"
[HKEY_CLASSES_ROOT\jpegfile\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\jpegfile\Shell\Open\DropTarget]
"CLSID"="{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}"
[HKEY_CLASSES_ROOT\pjpegfile\Shell\Open]
"MUIVerb"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3043"
[HKEY_CLASSES_ROOT\pjpegfile\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\pjpegfile\Shell\Open\DropTarget]
"CLSID"="{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}"
[HKEY_CLASSES_ROOT\pngfile\Shell\Open]
"MUIVerb"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3043"
[HKEY_CLASSES_ROOT\pngfile\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\pngfile\Shell\Open\DropTarget]
"CLSID"="{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}"
[HKEY_CLASSES_ROOT\wdpfile\Shell\Open]
"MUIVerb"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3043"
[HKEY_CLASSES_ROOT\wdpfile\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\wdpfile\Shell\Open\DropTarget]
"CLSID"="{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}"
[HKEY_CLASSES_ROOT\Paint.Picture\Shell\Open]
"MUIVerb"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3043"
[HKEY_CLASSES_ROOT\Paint.Picture\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\Paint.Picture\Shell\Open\DropTarget]
"CLSID"="{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}"
[HKEY_CLASSES_ROOT\TIFImage.Document\Shell\Open]
"MUIVerb"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3043"
[HKEY_CLASSES_ROOT\TIFImage.Document\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\TIFImage.Document\Shell\Open\DropTarget]
"CLSID"="{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.BitMap]
"FriendlyTypeName"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3056"
"ImageOptionFlags"=dword:00000001
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.BitMap\DefaultIcon]
@="C:\\Windows\\System32\\ImageRes.dll,-70"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.BitMap\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.BitMap\Shell\Open\DropTarget]
"CLSID"="{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.GIF]
"EditFlags"=dword:00010000
"FriendlyTypeName"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3055"
"ImageOptionFlags"=dword:00000001
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.GIF\DefaultIcon]
@="C:\\Windows\\System32\\ImageRes.dll,-71"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.GIF\Shell\Open]
"MUIVerb"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3043"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.GIF\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.GIF\Shell\Open\DropTarget]
"CLSID"="{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.JFIF]
"EditFlags"=dword:00010000
"FriendlyTypeName"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3055"
"ImageOptionFlags"=dword:00000001
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.JFIF\DefaultIcon]
@="C:\\Windows\\System32\\ImageRes.dll,-72"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.JFIF\Shell\Open]
"MUIVerb"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3043"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.JFIF\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.JFIF\Shell\Open\DropTarget]
"CLSID"="{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.JPEG]
"EditFlags"=dword:00010000
"FriendlyTypeName"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3055"
"ImageOptionFlags"=dword:00000001
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.JPEG\DefaultIcon]
@="C:\\Windows\\System32\\ImageRes.dll,-72"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.JPEG\Shell\Open]
"MUIVerb"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3043"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.JPEG\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.JPEG\Shell\Open\DropTarget]
"CLSID"="{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.PNG]
"FriendlyTypeName"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3057"
"ImageOptionFlags"=dword:00000001
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.PNG\DefaultIcon]
@="C:\\Windows\\System32\\ImageRes.dll,-71"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.PNG\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.PNG\Shell\Open\DropTarget]
"CLSID"="{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.TIFF]
"FriendlyTypeName"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3058"
"ImageOptionFlags"=dword:00000001
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.TIFF\DefaultIcon]
@="C:\\Windows\\System32\\ImageRes.dll,-122"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.TIFF\Shell\Open]
"MUIVerb"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3043"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.TIFF\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.TIFF\Shell\Open\DropTarget]
"CLSID"="{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.WDP]
"EditFlags"=dword:00010000
"ImageOptionFlags"=dword:00000001
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.WDP\DefaultIcon]
@="C:\\Windows\\System32\\WMPhoto.dll,-400"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.WDP\Shell\Open]
"MUIVerb"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3043"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.WDP\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\PhotoViewer.FileAssoc.WDP\Shell\Open\DropTarget]
"CLSID"="{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}"
[HKEY_CLASSES_ROOT\SystemFileAssociations\.bmp\OpenWithList\PhotoViewer.dll]
[HKEY_CLASSES_ROOT\SystemFileAssociations\.dib\OpenWithList\PhotoViewer.dll]
[HKEY_CLASSES_ROOT\SystemFileAssociations\.gif\OpenWithList\PhotoViewer.dll]
[HKEY_CLASSES_ROOT\SystemFileAssociations\.ico\OpenWithList\PhotoViewer.dll]
[HKEY_CLASSES_ROOT\SystemFileAssociations\.jfif\OpenWithList\PhotoViewer.dll]
[HKEY_CLASSES_ROOT\SystemFileAssociations\.jpe\OpenWithList\PhotoViewer.dll]
[HKEY_CLASSES_ROOT\SystemFileAssociations\.jpeg\OpenWithList\PhotoViewer.dll]
[HKEY_CLASSES_ROOT\SystemFileAssociations\.jpg\OpenWithList\PhotoViewer.dll]
[HKEY_CLASSES_ROOT\SystemFileAssociations\.png\OpenWithList\PhotoViewer.dll]
[HKEY_CLASSES_ROOT\SystemFileAssociations\.rle\OpenWithList\PhotoViewer.dll]
[HKEY_CLASSES_ROOT\SystemFileAssociations\.tif\OpenWithList\PhotoViewer.dll]
[HKEY_CLASSES_ROOT\SystemFileAssociations\.tiff\OpenWithList\PhotoViewer.dll]
[HKEY_CLASSES_ROOT\SystemFileAssociations\.wdp\OpenWithList\PhotoViewer.dll]
[HKEY_CLASSES_ROOT\SystemFileAssociations\Image\Shell\Open]
"MUIVerb"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3043"
[HKEY_CLASSES_ROOT\SystemFileAssociations\Image\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\SystemFileAssociations\Image\Shell\Open\DropTarget]
"CLSID"="{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}"
[HKEY_CLASSES_ROOT\SystemFileAssociations\Image\Shell\Print\Command]
@="C:\\Windows\\System32\\RunDLL32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen %L"
[HKEY_CLASSES_ROOT\SystemFileAssociations\Image\Shell\Print\DropTarget]
"CLSID"="{60FD46DE-F830-4894-A628-6FA81BC0190D}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities]
"ApplicationDescription"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3069"
"ApplicationName"="@C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,-3009"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations]
".bmp"="PhotoViewer.FileAssoc.BitMap"
".dib"="PhotoViewer.FileAssoc.BitMap"
".gif"="PhotoViewer.FileAssoc.GIF"
".ico"="PhotoViewer.FileAssoc.BitMap"
".jfif"="PhotoViewer.FileAssoc.JFIF"
".jpe"="PhotoViewer.FileAssoc.JPEG"
".jpeg"="PhotoViewer.FileAssoc.JPEG"
".jpg"="PhotoViewer.FileAssoc.JPEG"
".png"="PhotoViewer.FileAssoc.PNG"
".rle"="PhotoViewer.FileAssoc.BitMap"
".tif"="PhotoViewer.FileAssoc.TIFF"
".tiff"="PhotoViewer.FileAssoc.TIFF"
".wdp"="PhotoViewer.FileAssoc.WDP" Prevent the automatic installation of Apps
like
Outlook for Windows after the
oobeSystem
pass
of
Windows Setup:
REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\DevHomeUpdate]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\EdgeUpdate]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\OutlookUpdate]Remove the requirement for a Microsoft Account and a network connection:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OoBE]
"BypassNRO"=dword:00000001
"DisablePrivacyExperience"=dword:00000001
"HideOnlineAccountScreens"=dword:00000001
"HideWirelessSetupInOOBE"=dword:00000001
"PrivacyConsentStatus"=dword:00000001
;"UnattendCreatedUser"=dword:00000001�
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Privacy]
"PrivacyConsentPresentationVersion"=dword:00000003
"PrivacyConsentSettingsValidMask"=dword:0000003F
"PrivacyConsentSettingsVersion"=dword:00000004
"TailoredExperiencesWithDiagnosticDataEnabled"=dword:00000000 Disable Recommendations
:
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Start_IrisRecommendations"=dword:00000000 Disable Widgets
:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Dsh]
"AllowNewsAndInterests"=dword:00000000Disable Teams icon:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Chat]
"ChatIcon"=dword:00000003Optionally turn off Smart App Control:
REGEDIT4
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy]
"VerifiedAndReputablePolicyState"=dword:00000000 ; Off
; 00000001 ; On
; 00000002 ; Evaluation modeDisable Copilot in Edge:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge]
"AIGenThemesEnabled"=dword:00000000
"BuiltInAIAPIsEnabled"=dword:00000000
"ComposeInlineEnabled"=dword:00000000
"CopilotPageContext"=dword:00000000
"DevToolsGenAISettings"=dword:00000002
"EdgeEntraCopilotPageContext"=dword:00000000
"EdgeHistoryAISearchEnabled"=dword:00000000
"GenAILocalFoundationalModelSettings"=dword:00000001
"HubsSidebarEnabled"=dword:00000000
"ShareBrowsingHistoryWithCopilotSearchAllowed"=dword:00000000Disable Copilot in NotePad:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\WindowsNotepad]
"DisableAIFeatures"=dword:00000001Disable Copilot in Paint:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Paint]
"DisableCocreator"=dword:00000001
"DisableGenerativeErase"=dword:00000001
"DisableGenerativeFill"=dword:00000001
"DisableImageCreator"=dword:00000001
"DisableRemoveBackground"=dword:00000001 Disable Copilot in the Shell
:
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"TaskbarCompanion"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\TaskBand\AuxilliaryPins]
"CopilotPWAPin"=dword:00000000
"RecallPin"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WindowsCopilot]
"AllowCopilotRuntime"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\BrandedKey]
"BrandedKeyChoiceType"="NoneSelected"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings]
"AutoOpenCopilotLargeScreens"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked]
"{CB3B0003-8088-4EDE-8769-8B354AB2FF8C}"="Ask Copilot"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Shell\Copilot]
"CopilotDisabledReason"="FeatureIsDisabled"
"IsCopilotAvailable"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Shell\Copilot\BingChat]
"IsUserEligible"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot]
"TurnOffWindowsCopilot"=dword:00000001Disable AI:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration]
"AllowedInRegion"=dword:00000000
"HardwareCompatibility"=dword:00000000
"MaxInstallAttemptsAllowed"=dword:00000000
"MeetsAdditionalDriverRequirements"=dword:00000000
"PolicyConfigured"=dword:00000000
"PolicyEnabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsAI]
"AllowRecallEnablement"=dword:00000000
"DisableAgentConnectors"=dword:00000001
"DisableAgentWorkspaces"=dword:00000001
"DisableAIDataAnalysis"=dword:00000001
"DisableClickToDo"=dword:00000001
"DisableRemoteAgentConnectors"=dword:00000001
"DisableSettingsAgent"=dword:00000001
"TurnOffSavingSnapshots"=dword:00000001 AutoUnattend.xml
answer file
…
<?xml version='1.0' encoding='UTF-8' standalone='yes' ?>
<!-- (C)opyright 2009-2026, Stefan Kanthak <stefan.kanthak@nexgo.de> -->
<unattend xmlns='urn:schemas-microsoft-com:unattend' xmlns:wcm='http://schemas.microsoft.com/WMIConfig/2002/State' xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'>
<settings pass='specialize'>
<component language='neutral' name='Microsoft-Windows-Deployment' processorArchitecture='amd64' publicKeyToken='31bf3856ad364e35' versionScope='nonSxS'>
<RunSynchronous>
<RunSynchronousCommand wcm:action='add'>
<Description>Prevent per-user installation of (outdated) 'OneDrive' client</Description>
<Order>1</Order>
<Path>CMD.EXE /D /C REG.EXE LOAD HKU\Default %SystemDrive%\Users\Default\NTUSER.DAT && REG.EXE DELETE HKU\Default\Software\Microsoft\Windows\CurrentVersion\Run /V OneDriveSetup /F && REG.EXE UNLOAD HKU\Default</Path>
</RunSynchronousCommand>
<RunSynchronousCommand wcm:action='add'>
<Description>Prevent installation of 'Outlook for Windows' etc.</Description>
<Order>2</Order>
<Path>CMD.EXE /D /C FOR %? IN (DevHome Edge Outlook) DO REG.EXE DELETE HKLM\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_OoBE\%?Update /F</Path>
</RunSynchronousCommand>
<RunSynchronousCommand wcm:action='add'>
<Description>Remove provisioned 'Apps'</Description>
<Order>3</Order>
<Path>CMD.EXE /D /C 1>%TMP%\unattend.log 2>&1 (FOR /F "Tokens=2" %? IN ('DISM.EXE /Online /Get-ProvisionedAppxPackages /Format:Table ^| FINDSTR.EXE /B /L PackageName:') DO DISM.EXE /Online /Remove-ProvisionedAppxPackage /PackageName:%?)</Path>
</RunSynchronousCommand>
<RunSynchronousCommand wcm:action='add'>
<Description>Extract ('empty' sample) scripts from embedded base-64 encoded CAB archive and execute them</Description>
<Order>4</Order>
<Path>CMD.EXE /D /C 1>>%TMP%\unattend.log 2>&1 (CERTUTIL.EXE /DECODE %SystemRoot%\Panther\unattend.xml %TMP%\unattend.cab && EXPAND.EXE %TMP%\unattend.cab /F:* %TMP% && REG.EXE IMPORT %TMP%\unattend.reg && CALL %TMP%\unattend.cmd)</Path>
</RunSynchronousCommand>
</RunSynchronous>
</component>
<component language='neutral' name='Microsoft-Windows-SecureStartup-FilterDriver' processorArchitecture='amd64' publicKeyToken='31bf3856ad364e35' versionScope='nonSxS'>
<PreventDeviceEncryption>true</PreventDeviceEncryption>
</component>
</settings>
<settings pass='oobeSystem'>
<component language='neutral' name='Microsoft-Windows-Shell-Setup' processorArchitecture='amd64' publicKeyToken='31bf3856ad364e35' versionScope='nonSxS'>
<AutoLogon>
<Enabled>true</Enabled>
<LogonCount>1</LogonCount>
<Password>
<PlainText>true</PlainText>
<Value>•••••••••••••••</Value>
</Password>
<Username>Administrator</Username>
</AutoLogon>
<ComputerName>AMNESIAC</ComputerName>
<ConfigureChatAutoInstall>false</ConfigureChatAutoInstall>
<DesktopOptimization>
<GoToDesktopOnSignIn>false</GoToDesktopOnSignIn>
<ShowWindowsStoreAppsOnTaskbar>false</ShowWindowsStoreAppsOnTaskbar>
</DesktopOptimization>
<FirstLogonCommands>
<SynchronousCommand wcm:action='add'>
<CommandLine>CMD.EXE /D /K TITLE %USERDOMAIN%\%USERNAME%@%COMPUTERNAME% && SET ; && ICACLS.EXE %SystemRoot%\System32\AppLocker\AppCache.* /Remove:g %USERDOMAIN%\%USERNAME% /C /Q</CommandLine>
<Description>Start interactive command prompt</Description>
<Order>1</Order>
<RequiresUserInput>true</RequiresUserInput>
</SynchronousCommand>
</FirstLogonCommands>
<OOBE>
<HideEULAPage>true</HideEULAPage>
<HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
<HideLocalAccountScreen>true</HideLocalAccountScreen>
<HideOnlineAccountScreens>true</HideOnlineAccountScreens>
<HideWirelessSetupInOOBE>false</HideWirelessSetupInOOBE>
<ProtectYourPC>2</ProtectYourPC>
</OOBE>
<RegisteredOrganization>eSKamation</RegisteredOrganization>
<RegisteredOwner>Stefan Kanthak</RegisteredOwner>
<UserAccounts>
<AdministratorPassword>
<PlainText>true</PlainText>
<Value>•••••••••••••••</Value>
</AdministratorPassword>
</UserAccounts>
</component>
</settings>
<cabinet xmlns='https://eskamation.de/'>-----BEGIN CABINET----- TVNDRgAAAACQAAAAAAAAACwAAAAAAAAAAwEBAAIAAAC4CQAAZgAAAAEAAxUDAAAAAAAAAAAAIQBcZCAAd2hpc3BlcnMuY21kAAoAAAADAAAAAAAhAFxkIAB3aGlzcGVycy5yZWcAP6QmliIADQBbgICNADDQAAoAAAABAAAAAQAAAEANClJFR0VESVQ0DQoA -----END CABINET-----</cabinet>
</unattend>MAX_PATH − 1 characters!
Unattended Windows Setup Reference
Unattended Windows Setup Reference
Components
Microsoft-Windows-Deployment
Microsoft-Windows-SecureStartup-FilterDriver
Microsoft-Windows-Setup
Microsoft-Windows-Shell-Setup
<?xml version='1.0' encoding='US-ASCII' standalone='yes' ?>
<!-- (C)opyright 2011-2026, Stefan Kanthak -->
<xs:schema attributeFormDefault='unqualified'
elementFormDefault='qualified'
version='1.0'
xmlns:uia='urn:schemas-microsoft-com:unattend'
xmlns:wcm='http://schemas.microsoft.com/WMIConfig/2002/State'
xmlns:xs='http://www.w3.org/2001/XMLSchema'
xmlns:xsd='http://www.w3.org/2001/XMLSchema-datatypes'
xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'>
<xs:annotation>
<xs:documentation>XML Schema Definition for Unattended Installation Answer Files</xs:documentation>
</xs:annotation>
<xs:element name='unattend'>
<xs:complexType>
<xs:sequence>
<xs:annotation>
<xs:documentation>Supported under 'offlineServicing' only</xs:documentation>
</xs:annotation>
<xs:element ref='servicing' />
<xs:element ref='settings' minOccurs='0' maxOccurs='unbounded' />
<xs:any namespace='##other' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
</xs:sequence>
<xs:attribute name='author' type='xs:string' use='optional' />
<xs:attribute name='description' type='xs:string' use='optional' />
<xs:attribute name='creationTimeStamp' type='xs:dateTime' use='optional' />
<xs:attribute name='lastUpdateTimeStamp' type='xs:dateTime' use='optional' />
<xs:attribute name='ConfigurationSetTimeStamp' type='xs:dateTime' use='optional' />
<xs:anyAttribute namespace='##other' processContents='lax' />
</xs:complexType>
</xs:element>
<xs:element name='servicing'>
<xs:complexType>
<xs:sequence>
<xs:element ref='package' minOccurs='0' maxOccurs='unbounded' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='package'>
<xs:complexType>
<xs:sequence>
<xs:element ref='assemblyIdentity' />
<xs:choice minOccurs='0' maxOccurs='unbounded'>
<xs:element ref='source' />
<xs:element ref='selection' />
</xs:choice>
</xs:sequence>
<xs:attribute name='action' use='required'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:enumeration value='configure' />
<xs:enumeration value='install' />
<xs:enumeration value='remove' />
<xs:enumeration value='stage' />
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:attribute ref='permanence' use='optional' default='removable' />
<xs:anyAttribute namespace='##other' processContents='lax' />
</xs:complexType>
</xs:element>
<xs:element name='assemblyIdentity'>
<xs:complexType>
<xs:attribute name='language' type='xs:string' use='required' />
<xs:attribute name='name' type='xs:string' use='required' />
<xs:attribute ref='processorArchitecture' use='required' />
<xs:attribute ref='publicKeyToken' use='required' />
<xs:attribute ref='version' use='required' />
<xs:attribute name='versionScope' type='xs:string' use='optional' fixed='nonSxS' />
</xs:complexType>
</xs:element>
<xs:attribute name='processorArchitecture'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:pattern value='((X|x)86)|((I|i)(A|a)64)|((A|a)(M|m)(D|d)64)|((W|w)(O|o)(W|w)64)|((M|m)(S|s)(I|i)(L|l))|((S|s)(H|h)(X|x))|((A|a)(R|r)(M|m))|((D|d)(A|a)(T|t)(A|a))|((N|n)(E|e)(U|u)(T|t)(R|r)(A|a)(L|l))' />
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:attribute name='publicKeyToken'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:pattern value='[0-9A-Fa-f]{16}' />
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:attribute name='version'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:pattern value='(0*[0-9]{0,4}|0*[1-5][0-9]{4}|0*6[0-4][0-9]{3}|0*65[0-4][0-9]{2}|0*655[0-2][0-9]|0*6553[0-5])\.(0*[0-9]{0,4}|0*[1-5][0-9]{4}|0*6[0-4][0-9]{3}|0*65[0-4][0-9]{2}|0*655[0-2][0-9]|0*6553[0-5])\.(0*[0-9]{0,4}|0*[1-5][0-9]{4}|0*6[0-4][0-9]{3}|0*65[0-4][0-9]{2}|0*655[0-2][0-9]|0*6553[0-5])\.(0*[0-9]{0,4}|0*[1-5][0-9]{4}|0*6[0-4][0-9]{3}|0*65[0-4][0-9]{2}|0*655[0-2][0-9]|0*6553[0-5])' />
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:element name='source'>
<xs:complexType>
<xs:annotation>
<xs:documentation>Package source specification</xs:documentation>
</xs:annotation>
<xs:attribute name='location' type='xs:string' use='required'>
<xs:annotation>
<xs:documentation>Path to source location for package to install</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute ref='permanence' use='optional' default='permanent' />
</xs:complexType>
</xs:element>
<xs:element name='selection'>
<xs:complexType>
<xs:annotation>
<xs:documentation>Selection state override for nested child packages</xs:documentation>
</xs:annotation>
<xs:attribute name='name' type='xs:string' use='required'>
<xs:annotation>
<xs:documentation>Name of selectable update within child package</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name='state' type='xs:boolean' use='required'>
<xs:annotation>
<xs:documentation>Boolean initial state for selection</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:complexType>
</xs:element>
<xs:attribute name='permanence'>
<xs:simpleType>
<xs:annotation>
<xs:documentation>
Package removal options:
permanent = not removable
temporary = removed upon update of any component
</xs:documentation>
</xs:annotation>
<xs:restriction base='xs:string'>
<xs:enumeration value='permanent' />
<xs:enumeration value='removable' />
<xs:enumeration value='temporary' />
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:element name='settings'>
<xs:complexType>
<xs:sequence>
<xs:element ref='component' minOccurs='0' maxOccurs='unbounded' />
</xs:sequence>
<xs:attribute name='pass' use='required'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:enumeration value='offlineServicing' />
<xs:enumeration value='windowsPE' />
<xs:enumeration value='generalize' />
<xs:enumeration value='specialize' />
<xs:enumeration value='auditSystem' />
<xs:enumeration value='auditUser' />
<xs:enumeration value='oobeSystem' />
<xs:enumeration value='oobeUser' />
</xs:restriction>
</xs:simpleType>
</xs:attribute>
</xs:complexType>
</xs:element>
<xs:element name='component'>
<xs:complexType>
<xs:sequence>
<xs:element ref='AutoLogon' minOccurs='0' />
<xs:element name='ComplianceCheck' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='DisplayReport' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:enumeration value='Never' />
<xs:enumeration value='OnError' />
</xs:restriction>
</xs:simpleType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='ComputerName' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:pattern value='(\*|[^\a\b\t\n\v\f\r !"#$%&'()*+,./:;<=>?@[\\\]^`{|}~]{0,15})' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='ConfigureChatAutoInstall' type='xs:boolean' minOccurs='0' />
<xs:element name='DesktopOptimization' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='GoToDesktopOnSignIn' type='xs:boolean' minOccurs='0' />
<xs:element name='ShowWindowsStoreAppsOnTaskbar' type='xs:boolean' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='Diagnostics' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='OptIn' type='xs:boolean' minOccurs='0' default='false' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element ref='DiskConfiguration' minOccurs='0' maxOccurs='unbounded' />
<xs:element name='Display' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='ColorDepth' type='xs:positiveInteger' minOccurs='0' />
<xs:element name='HorizontalResolution' type='xs:positiveInteger' minOccurs='0' />
<xs:element name='RefreshRate' type='xs:positiveInteger' minOccurs='0' />
<xs:element name='VerticalResolution' type='xs:positiveInteger' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='DoNotCleanTaskBar' type='xs:boolean' minOccurs='0' />
<xs:element ref='DriverPaths' minOccurs='0' maxOccurs='unbounded' />
<xs:element name='DynamicUpdate' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='Enable' type='xs:boolean' minOccurs='0' />
<xs:element ref='WillShowUI' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='EnableFirewall' type='xs:boolean' minOccurs='0' default='true' />
<xs:element name='EnableNetwork' type='xs:boolean' minOccurs='0' default='false' />
<xs:element ref='FirstLogonCommands' minOccurs='0' maxOccurs='unbounded' />
<xs:element name='FolderLocations' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='ProfilesDirectory' type='xs:string' minOccurs='0' default='%SystemDrive%\Users' />
<xs:element name='ProgramData' type='xs:string' minOccurs='0' default='%SystemDrive%\ProgramData' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element ref='Identification' minOccurs='0' />
<xs:element ref='ImageInstall' minOccurs='0' maxOccurs='unbounded' />
<xs:element name='InputLocale' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:pattern value='[0-9A-Fa-f]{4}:[0-9A-Fa-f]{8}' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='LogonCommands' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='AsynchronousCommand'>
<xs:complexType>
<xs:sequence>
<xs:element name='CommandLine' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='1024' />
<xs:minLength value='1' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='Description' type='xs:string' minOccurs='0' />
<xs:element name='Order' type='xs:positiveInteger' minOccurs='0' />
<!-- xs:element name='RequiresUserInput' type='xs:boolean' minOccurs='0' default='false' /-->
</xs:sequence>
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='LogPath' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='259' />
<xs:minLength value='1' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='OEMInformation' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='HelpCustomized' type='xs:boolean' minOccurs='0' default='false' />
<xs:element name='Logo' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:pattern value='[^\a\b\t\n\v\f\r*"<>?|]{0,256}' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='Manufacturer' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='256' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='Model' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='256' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='SupportHours' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='256' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='SupportPhone' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='256' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='SupportURL' type='xs:anyURI' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='OEMName' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='256' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='OOBE' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='HideEULAPage' type='xs:boolean' minOccurs='0' default='false' />
<xs:element name='HideLocalAccountScreen' type='xs:boolean' minOccurs='0' default='false' />
<xs:element name='HideOEMRegistrationScreen' type='xs:boolean' minOccurs='0' default='false' />
<xs:element name='HideOnlineAccountScreens' type='xs:boolean' minOccurs='0' default='false' />
<xs:element name='HideWirelessSetupInOOBE' type='xs:boolean' minOccurs='0' default='false' />
<xs:element name='NetworkLocation' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:enumeration value='Home' />
<xs:enumeration value='Other' />
<xs:enumeration value='Work' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='OEMAppID' type='xs:string' minOccurs='0' />
<xs:element name='ProtectYourPC' minOccurs='0'>
<xs:annotation>
<xs:documentation>
Automatic update options:
1 = important and recommended
2 = important only
3 = none
</xs:documentation>
</xs:annotation>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:enumeration value='1' />
<xs:enumeration value='2' />
<xs:enumeration value='3' />
</xs:restriction>
</xs:simpleType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='PageFile' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='Path' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='259' />
<xs:minLength value='1' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='Size' type='xs:positiveInteger' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='ProductKey' minOccurs='0'>
<xs:annotation>
<xs:documentation>Activates the installed edition</xs:documentation>
</xs:annotation>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:pattern value='[2346789BCDFGHJKMNPQRTVWXY]{5}(-[2346789BCDFGHJKMNPQRTVWXY]{5}){4}' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='RegisteredOrganization' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='256' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='RegisteredOwner' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='256' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='Restart' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:enumeration value='Restart' />
<xs:enumeration value='Shutdown' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element ref='RunAsynchronous' minOccurs='0' maxOccurs='unbounded' />
<xs:element ref='RunSynchronous' minOccurs='0' maxOccurs='unbounded' />
<xs:element name='SetupUILanguage' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='UILanguage' type='xs:language' minOccurs='0' default='en-US' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='SystemLocale' type='xs:language' minOccurs='0' default='en-US' />
<xs:element name='TaskbarLinks' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='Link0' type='pathname' minOccurs='0' />
<xs:element name='Link1' type='pathname' minOccurs='0' />
<xs:element name='Link2' type='pathname' minOccurs='0' />
<xs:element name='Link3' type='pathname' minOccurs='0' />
<xs:element name='Link4' type='pathname' minOccurs='0' />
<xs:element name='Link5' type='pathname' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='Themes' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='ScreenSaver' type='pathname' minOccurs='0' />
<xs:element name='ThemeName' type='pathname' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='TimeZone' type='xs:string' minOccurs='0' default='UTC' />
<xs:element name='UILanguage' type='xs:language' minOccurs='0' default='en-US' />
<xs:element ref='UpgradeData' minOccurs='0' />
<xs:element name='UseConfigurationSet' type='xs:boolean' minOccurs='0' default='false' />
<xs:element ref='UserAccounts' minOccurs='0' />
<xs:element ref='UserData' minOccurs='0' />
<xs:element name='UserLocale' type='xs:language' minOccurs='0' default='en-US' />
<xs:element ref='WindowsDeploymentServices' minOccurs='0' />
<xs:element name='WindowsFeatures' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='ShowInternetExplorer' type='xs:boolean' minOccurs='0' default='true' />
<xs:element name='ShowMediaCenter' type='xs:boolean' minOccurs='0' default='true' />
<xs:element name='ShowWindowsMail' type='xs:boolean' minOccurs='0' default='true' />
<xs:element name='ShowWindowsMediaPlayer' type='xs:boolean' minOccurs='0' default='true' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:any namespace='##other' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
</xs:sequence>
<xs:attribute name='language' type='xs:string' use='required' />
<xs:attribute name='name' type='xs:string' use='required' />
<xs:attribute ref='processorArchitecture' use='required' />
<xs:attribute ref='publicKeyToken' use='required' />
<xs:attribute ref='version' use='optional' />
<xs:attribute name='versionScope' use='optional' default='nonSxS'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:pattern value='((N|n)(E|e)(U|u)(T|t)(R|r)(A|a)(L|l))|((N|n)(O|o)(N|n)(S|s)(X|x)(S|s))' />
</xs:restriction>
</xs:simpleType>
</xs:attribute>
</xs:complexType>
</xs:element>
<xs:element name='AutoLogon'>
<xs:complexType>
<xs:sequence>
<xs:element name='Domain' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='15' />
<xs:minLength value='1' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='Enabled' type='xs:boolean' minOccurs='0' default='false' />
<xs:element name='LogonCount' type='xs:unsignedInt' minOccurs='0' />
<xs:element ref='Password' minOccurs='0' />
<xs:element name='Username' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:pattern value='[^\a\b\t\n\v\f\r%*+,/:;<=>?@[\\\]|]{1,256}' />
</xs:restriction>
</xs:simpleType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='WillShowUI'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:enumeration value='Always' />
<xs:enumeration value='Never' />
<xs:enumeration value='OnError' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='Password'>
<xs:complexType>
<xs:sequence>
<xs:element name='PlainText' type='xs:boolean' minOccurs='0' default='true' />
<xs:element name='Value' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='Value'>
<xs:simpleType>
<xs:union>
<xs:simpleType>
<xs:annotation>
<xs:documentation>base64-encoded UTF-16LE</xs:documentation>
</xs:annotation>
<xs:restriction base='xs:base64Binary'>
<xs:maxLength value='256' />
</xs:restriction>
</xs:simpleType>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='256' />
</xs:restriction>
</xs:simpleType>
</xs:union>
</xs:simpleType>
</xs:element>
<xs:element name='DiskConfiguration'>
<xs:complexType>
<xs:sequence>
<xs:element name='DisableEncryptedDiskProvisioning' type='xs:boolean' minOccurs='0' default='false' />
<xs:element name='Disk'>
<xs:complexType>
<xs:sequence>
<xs:element name='CreatePartitions' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='CreatePartition' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='Extend' type='xs:boolean' minOccurs='0' default='false' />
<xs:element name='Order' type='xs:positiveInteger' minOccurs='0' />
<xs:element name='Size' type='xs:positiveInteger' minOccurs='0' />
<xs:element name='Type' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:enumeration value='EFI' />
<xs:enumeration value='Extended' />
<xs:enumeration value='Logical' />
<xs:enumeration value='MSR' />
<xs:enumeration value='Primary' />
</xs:restriction>
</xs:simpleType>
</xs:element>
</xs:sequence>
<!-- xs:attribute ref='wcm:action' /-->
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='DiskID' type='xs:nonNegativeInteger' />
<xs:element name='ModifyPartitions' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='ModifyPartition' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='Active' type='xs:boolean' minOccurs='0' />
<xs:element name='Extend' type='xs:boolean' minOccurs='0' default='false' />
<xs:element name='Format' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:enumeration value='FAT32' />
<xs:enumeration value='NTFS' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='Label' type='xs:string' minOccurs='0' />
<xs:element name='Letter' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:pattern value='[A-Z]' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='Order' type='xs:positiveInteger' minOccurs='0' />
<xs:element name='PartitionID' type='xs:positiveInteger' minOccurs='0' />
<xs:element name='TypeID' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:enumeration value='EFI' />
<xs:enumeration value='Extended' />
<xs:enumeration value='Logical' />
<xs:enumeration value='MSR' />
<xs:enumeration value='Primary' />
</xs:restriction>
</xs:simpleType>
</xs:element>
</xs:sequence>
<!-- xs:attribute ref='wcm:action' /-->
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='WillWipeDisk' type='xs:boolean' minOccurs='0' />
</xs:sequence>
<!-- xs:attribute ref='wcm:action' /-->
</xs:complexType>
</xs:element>
<xs:element ref='WillShowUI' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='DriverPaths'>
<xs:complexType>
<xs:sequence>
<xs:element name='PathAndCredentials' minOccurs='0' maxOccurs='unbounded'>
<xs:complexType>
<xs:sequence>
<xs:element ref='Credentials' minOccurs='0' />
<xs:element name='Path' type='xs:string' minOccurs='0' />
</xs:sequence>
<!-- xs:attribute ref='wcm:action' /-->
<!-- xs:attribute ref='wcm:keyValue' /-->
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='FirstLogonCommands'>
<xs:complexType>
<xs:sequence>
<xs:element name='SynchronousCommand' minOccurs='0' maxOccurs='unbounded'>
<xs:complexType>
<xs:sequence>
<xs:element name='CommandLine' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='259' />
<xs:minLength value='1' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='Description' type='xs:string' minOccurs='0' />
<xs:element name='Order' type='xs:positiveInteger' minOccurs='0' />
<xs:element name='RequiresUserInput' type='xs:boolean' minOccurs='0' default='false' />
</xs:sequence>
<!-- xs:attribute ref='wcm:action' /-->
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='Identification'>
<xs:complexType>
<xs:sequence>
<xs:element ref='Credentials' minOccurs='0' />
<xs:element name='JoinDomain' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='15' />
<xs:minLength value='1' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='JoinWorkgroup' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='15' />
<xs:minLength value='1' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='MachineObjectOU' type='xs:string' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='Credentials'>
<xs:complexType>
<xs:sequence>
<xs:element name='Domain' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='15' />
<xs:minLength value='1' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='Password' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='256' />
<xs:minLength value='1' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='Username' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='256' />
<xs:minLength value='1' />
</xs:restriction>
</xs:simpleType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='ImageInstall'>
<xs:complexType>
<xs:sequence>
<xs:element name='DataImage' minOccurs='0' maxOccurs='unbounded'>
<xs:complexType>
<xs:sequence>
<xs:element ref='InstallFrom' minOccurs='0' />
<xs:element ref='InstallTo' minOccurs='0' />
<xs:element name='Order' type='xs:positiveInteger' minOccurs='0' />
</xs:sequence>
<!-- xs:attribute ref='wcm:action' /-->
</xs:complexType>
</xs:element>
<xs:element name='OSImage' minOccurs='0' maxOccurs='unbounded'>
<xs:complexType>
<xs:sequence>
<xs:element ref='InstallFrom' minOccurs='0' />
<xs:element ref='InstallTo' minOccurs='0' />
<xs:element name='InstallToAvailablePartition' type='xs:boolean' minOccurs='0' default='false' />
<xs:element ref='WillShowUI' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='InstallFrom'>
<xs:complexType>
<xs:sequence>
<xs:element ref='Credentials' minOccurs='0' />
<xs:element name='MetaData' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='Key' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:enumeration value='/IMAGE/DESCRIPTION' />
<xs:enumeration value='/IMAGE/INDEX' />
<xs:enumeration value='/IMAGE/NAME' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='Value' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:minLength value='1' />
</xs:restriction>
</xs:simpleType>
</xs:element>
</xs:sequence>
<!-- xs:attribute ref='wcm:action' /-->
</xs:complexType>
</xs:element>
<xs:element name='Path' type='xs:string' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='InstallTo'>
<xs:complexType>
<xs:sequence>
<xs:element name='DiskID' type='xs:nonNegativeInteger' minOccurs='0' />
<xs:element name='PartitionID' type='xs:positiveInteger' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='RunAsynchronous'>
<xs:complexType>
<xs:sequence>
<xs:element name='RunAsynchronousCommand' minOccurs='0' maxOccurs='unbounded'>
<xs:complexType>
<xs:sequence>
<xs:element ref='Credentials' minOccurs='0' />
<xs:element name='Description' type='xs:string' minOccurs='0' />
<xs:element name='Order' type='xs:positiveInteger' minOccurs='0' />
<xs:element name='Path' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='259' />
<xs:minLength value='1' />
</xs:restriction>
</xs:simpleType>
</xs:element>
</xs:sequence>
<!-- xs:attribute ref='wcm:action' /-->
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='RunSynchronous'>
<xs:complexType>
<xs:sequence>
<xs:element name='RunSynchronousCommand' minOccurs='0' maxOccurs='unbounded'>
<xs:complexType>
<xs:sequence>
<xs:element ref='Credentials' minOccurs='0' />
<xs:element name='Description' type='xs:string' minOccurs='0' />
<xs:element name='Order' type='xs:positiveInteger' minOccurs='0' />
<xs:element name='Path' minOccurs='0'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='259' />
<xs:minLength value='1' />
</xs:restriction>
</xs:simpleType>
</xs:element>
</xs:sequence>
<!-- xs:attribute ref='wcm:action' /-->
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='UpgradeData'>
<xs:complexType>
<xs:sequence>
<xs:element name='Upgrade' type='xs:boolean' minOccurs='0' />
<xs:element ref='WillShowUI' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='UserAccounts'>
<xs:complexType>
<xs:sequence>
<xs:element name='AdministratorPassword' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='PlainText' type='xs:boolean' minOccurs='0' default='true' />
<xs:element ref='Value' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='DomainAccounts' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='DomainAccountList' minOccurs='0' maxOccurs='unbounded'>
<xs:complexType>
<xs:sequence>
<xs:element name='Domain'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:maxLength value='15' />
<xs:minLength value='1' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='DomainAccount' minOccurs='0' maxOccurs='unbounded'>
<xs:complexType>
<xs:sequence>
<xs:element ref='Group' minOccurs='0' />
<xs:element ref='Name' minOccurs='0' />
</xs:sequence>
<!-- xs:attribute ref='wcm:action' /-->
</xs:complexType>
</xs:element>
</xs:sequence>
<!-- xs:attribute ref='wcm:action' /-->
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='LocalAccounts' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='LocalAccount' minOccurs='0' maxOccurs='unbounded'>
<xs:complexType>
<xs:sequence>
<xs:element name='Description' type='xs:string' minOccurs='0' />
<xs:element name='DisplayName' type='xs:string' minOccurs='0' />
<xs:element name='Group' minOccurs='0' />
<xs:element ref='Name' minOccurs='0' />
<xs:element ref='Password' minOccurs='0' />
</xs:sequence>
<!-- xs:attribute ref='wcm:action' /-->
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='Group'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:pattern value='(AccountOperators|Administrators|BackupOperators|CryptoOperators|DCOMUsers|Guests|IUsers|NetworkConfigurationOperators|PerfLoggingUsers|PerfMonitoringUsers|PowerUsers|PrintOperators|RemoteDesktopUsers|Replicator|SystemOperators|Users)(;(AccountOperators|Administrators|BackupOperators|CryptoOperators|DCOMUsers|Guests|IUsers|NetworkConfigurationOperators|PerfLoggingUsers|PerfMonitoringUsers|PowerUsers|PrintOperators|RemoteDesktopUsers|Replicator|SystemOperators|Users)*)' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='Name'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:pattern value='([^Nn][^Oo][^Nn][^Ee]|[^\a\b\t\n\v\f\r%*+,/:;<=>?@[\\\]|]{1,256})' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='UserData'>
<xs:complexType>
<xs:sequence>
<xs:element name='AcceptEula' type='xs:boolean' minOccurs='0' />
<xs:element name='FullName' type='xs:string' minOccurs='0' />
<xs:element name='Organization' type='xs:string' minOccurs='0' />
<xs:element name='ProductKey' minOccurs='0'>
<xs:complexType>
<xs:sequence>
<xs:element name='Key' minOccurs='0'>
<xs:annotation>
<xs:documentation>Selects the edition to install</xs:documentation>
</xs:annotation>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:pattern value='[2346789BCDFGHJKMNPQRTVWXY]{5}(-[2346789BCDFGHJKMNPQRTVWXY]{5}){4}' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element ref='WillShowUI' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='WindowsDeploymentServices'>
<xs:complexType>
<xs:sequence>
<xs:element name='ImageSelection'>
<xs:complexType>
<xs:sequence>
<xs:element name='InstallImage'>
<xs:complexType>
<xs:sequence>
<xs:element name='Filename' type='pathname' />
<xs:element name='ImageGroup'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:minLength value='1' />
</xs:restriction>
</xs:simpleType>
</xs:element>
<xs:element name='ImageName'>
<xs:simpleType>
<xs:restriction base='xs:string'>
<xs:minLength value='1' />
</xs:restriction>
</xs:simpleType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='InstallTo'>
<xs:complexType>
<xs:sequence>
<xs:element name='DiskID' type='xs:positiveInteger' />
<xs:element name='PartitionID' type='xs:positiveInteger' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element ref='WillShowUI' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name='Login'>
<xs:complexType>
<xs:sequence>
<xs:element ref='Credentials' />
<xs:element ref='WillShowUI' minOccurs='0' />
</xs:sequence>
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:simpleType name='pathname'>
<xs:restriction base='xs:string'>
<xs:pattern value='[^\a\b\t\n\v\f\r*"<>?|]{1,259}' />
<xs:pattern value='[\u0020\u0021\u0023-\u0029\u002B-\u003B\u003D\u0040-\u007B\u007D-\uFFFE\u10000-\u10FFFF]{1,259}' />
</xs:restriction>
</xs:simpleType>
</xs:schema> Execute the following command lines to create and encode the sample
cabinet archive
unattend.cab embedded in the
answer file
AutoUnattend.xml:
1>unattend.reg ECHO REGEDIT4 1>unattend.cmd ECHO @ 1>unattend.ddf ECHO unattend.cmd 1>>unattend.ddf ECHO unattend.reg MAKECAB.EXE /D CabinetNameTemplate=unattend.cab /D CompressionLevel=7 /D CompressionMemory=21 /D CompressionType=LZX /D DiskDirectoryTemplate=. /D InfDate=01/01/1980 /D InfFileName=NUL: /D InfTime=12:34:56 /D RptFileName=NUL: /F unattend.ddf CERTUTIL.EXE /ENCODE unattend.cab unattend.txt TYPE unattend.txtNote: the command lines can be copied and pasted as block into a Command Processor window.
Cabinet Maker - Lossless Data Compression Tool Parsing directives Parsing directives (unattend.ddf: 1 lines) 13 bytes in 2 files Executing directives 0.00% - unattend.cmd (1 of 2) 0.00% - unattend.reg (2 of 2) 100.00% - unattend.reg (2 of 2) 0.00% [flushing current folder] 23.61% [flushing current folder] 58.00% [flushing current folder] 100.00% [flushing current folder] Total files: 2 Bytes before: 13 Bytes after: 34 After/Before: 261.54% compression Time: 0.01 seconds ( 0 hr 0 min 0.01 sec) Throughput: 1.27 Kb/second Input Length = 144 Output Length = 254 CertUtil: -encode command completed successfully. -----BEGIN CERTIFICATE----- TVNDRgAAAACQAAAAAAAAACwAAAAAAAAAAwEBAAIAAAC4CQAAZgAAAAEAAxUDAAAA AAAAAAAAIQBcZCAAd2hpc3BlcnMuY21kAAoAAAADAAAAAAAhAFxkIAB3aGlzcGVy cy5yZWcAP6QmliIADQBbgICNADDQAAoAAAABAAAAAQAAAEANClJFR0VESVQ0DQoA -----END CERTIFICATE-----Microsoft Cabinet Format Makecab Certutil
unattend.cfg
; Copyright © 2009-2026, Stefan Kanthak <stefan.kanthak@nexgo.de>
[Version]
Signature = "$Windows NT$"
[System Access]
EnableAdminAccount = 1
EnableGuestAccount = 0
LSAAnonymousNameLookup = 0
[Registry Values]
MACHINE\Software\Microsoft\Cryptography\WinTrust\Config\EnableCertPaddingCheck=1,"1"
MACHINE\Software\Microsoft\OneDrive\PreventNetworkTrafficPreUserSignIn=4,1
MACHINE\Software\Microsoft\SchedulingAgent\LogPath=2,"%SystemRoot%\System32\LogFiles\SCHEDULE.LOG"
MACHINE\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo\Enabled=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontUsePowerShellOnWinX=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\AutoOpenCopilotLargeScreens=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowOnlineTips=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Paint\DisableCocreator=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Paint\DisableGenerativeErase=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Paint\DisableGenerativeFill=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Paint\DisableImageCreator=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Paint\DisableRemoveBackground=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin=4,2
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableAutomaticRestartSignOn=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\SafeModeBlockNonAdmins=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked\{CB3B0003-8088-4EDE-8769-8B354AB2FF8C}=1,"Ask Copilot"
MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration\AllowedInRegion=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration\HardwareCompatibility=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration\MaxInstallAttemptsAllowed=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration\MeetsAdditionalDriverRequirements=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration\PolicyConfigured=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration\PolicyEnabled=4,0
MACHINE\Software\Microsoft\Windows\Shell\Copilot\CopilotDisabledReason=1,"FeatureIsDisabled"
MACHINE\Software\Microsoft\Windows\Shell\Copilot\IsCopilotAvailable=4,0
MACHINE\Software\Microsoft\Windows\Shell\Copilot\BingChat\IsUserEligible=4,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SecurityLevel=4,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SetCommand=4,0
MACHINE\Software\Microsoft\Windows Script Host\Settings\Enabled=4,0
MACHINE\Software\Microsoft\Windows Script Host\Settings\IgnoreUserSettings=4,1
MACHINE\Software\Microsoft\Windows Script Host\Settings\LogSecurityFailures=4,1
MACHINE\Software\Microsoft\Windows Script Host\Settings\LogSecuritySuccesses=4,1
MACHINE\Software\Microsoft\Windows Script Host\Settings\Remote=4,0
MACHINE\Software\Microsoft\Windows Script Host\Settings\TrustPolicy=4,2
MACHINE\Software\Microsoft\Windows Script Host\Settings\UseWinSAFER=4,1
MACHINE\Software\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\BlockedOobeUpdaters=1,"[""MS_Outlook""]"
MACHINE\Software\Policies\Microsoft\Dsh\AllowNewsAndInterests=4,0
MACHINE\Software\Policies\Microsoft\Edge\AIGenThemesEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\AllowGamesMenu=4,0
MACHINE\Software\Policies\Microsoft\Edge\AlternateErrorPagesEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\AutoImportAtFirstRun=4,4
MACHINE\Software\Policies\Microsoft\Edge\BuiltInAIAPIsEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\BuiltInDNSClientEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\ComposeInlineEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\CopilotPageContext=4,0
MACHINE\Software\Policies\Microsoft\Edge\DefaultBrowserSettingEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\DefaultBrowserSettingsCampaignEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\DevToolsGenAISettings=4,2
MACHINE\Software\Policies\Microsoft\Edge\DiagnosticData=4,0
MACHINE\Software\Policies\Microsoft\Edge\EdgeEntraCopilotPageContext=4,0
MACHINE\Software\Policies\Microsoft\Edge\EdgeHistoryAISearchEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\EdgeShoppingAssistantEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\GenAILocalFoundationalModelSettings=4,1
MACHINE\Software\Policies\Microsoft\Edge\HideFirstRunExperience=4,1
MACHINE\Software\Policies\Microsoft\Edge\HubsSidebarEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\Microsoft365CopilotChatIconEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\MicrosoftEdgeInsiderPromotionEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\NewTabPageBingChatEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\NewTabPageContentEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\NewTabPageHideDefaultTopSites=4,1
MACHINE\Software\Policies\Microsoft\Edge\NewTabPageSearchBox=1,"redirect"
MACHINE\Software\Policies\Microsoft\Edge\ShareBrowsingHistoryWithCopilotSearchAllowed=4,0
MACHINE\Software\Policies\Microsoft\Edge\ShowMicrosoftRewards=4,0
MACHINE\Software\Policies\Microsoft\Edge\ShowPDFDefaultRecommendationsEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\ShowRecommendationsEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\SpotlightExperiencesAndRecommendationsEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\StartupBoostEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\TabServicesEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\TextPredictionEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\URLBlockList\0=1,"ms-appinstaller:*"
MACHINE\Software\Policies\Microsoft\Edge\VisualSearchEnabled=4,0
MACHINE\Software\Policies\Microsoft\Edge\WebToBrowserSignInEnabled=4,0
MACHINE\Software\Policies\Microsoft\EdgeUpdate\CreateDesktopShortcutDefault=4,0
MACHINE\Software\Policies\Microsoft\Internet Explorer\HTA\DisableHTMLApplication=4,1
MACHINE\Software\Policies\Microsoft\MicrosoftAccount\DisableUserAuth=4,1
MACHINE\Software\Policies\Microsoft\MRT\DontOfferThroughWUAU=4,1
MACHINE\Software\Policies\Microsoft\MRT\DontReportInfectionInformation=4,1
MACHINE\Software\Policies\Microsoft\Windows\AdvertisingInfo\DisabledByGroupPolicy=4,1
MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\EnableMSAppInstallerProtocol=4,0
MACHINE\Software\Policies\Microsoft\Windows\CloudContent\ConfigureWindowsSpotlight=4,2
MACHINE\Software\Policies\Microsoft\Windows\CloudContent\DisableSoftLanding=4,1
MACHINE\Software\Policies\Microsoft\Windows\CloudContent\DisableSpotlightCollectionOnDesktop=4,1
MACHINE\Software\Policies\Microsoft\Windows\CloudContent\DisableTailoredExperiencesWithDiagnosticData=4,1
MACHINE\Software\Policies\Microsoft\Windows\CloudContent\DisableThirdPartySuggestions=4,1
MACHINE\Software\Policies\Microsoft\Windows\CloudContent\DisableWindowsConsumerFeatures=4,1
MACHINE\Software\Policies\Microsoft\Windows\CloudContent\DisableWindowsSpotlightFeatures=4,1
MACHINE\Software\Policies\Microsoft\Windows\CloudContent\DisableWindowsSpotlightOnActionCenter=4,1
MACHINE\Software\Policies\Microsoft\Windows\CloudContent\DisableWindowsSpotlightOnSettings=4,1
MACHINE\Software\Policies\Microsoft\Windows\CloudContent\DisableWindowsSpotlightWindowsWelcomeExperience=4,1
MACHINE\Software\Policies\Microsoft\Windows\CloudContent\IncludeEnterpriseSpotlight=4,0
MACHINE\Software\Policies\Microsoft\Windows\Explorer\NoUseStoreOpenWith=4,1
MACHINE\Software\Policies\Microsoft\Windows\OneDrive\DisableFileSync=4,1
MACHINE\Software\Policies\Microsoft\Windows\OneDrive\DisableFileSyncNGSC=4,1
MACHINE\Software\Policies\Microsoft\Windows\OneDrive\DisableLibrariesDefaultSaveToOneDrive=4,1
MACHINE\Software\Policies\Microsoft\Windows\OneDrive\DisableMeteredNetworkFileSync=4,1
MACHINE\Software\Policies\Microsoft\Windows\Personalization\NoLockScreen=4,1
MACHINE\Software\Policies\Microsoft\Windows\Windows Chat\ChatIcon=4,3
MACHINE\Software\Policies\Microsoft\Windows\Windows Feeds\EnableFeeds=4,0
MACHINE\Software\Policies\Microsoft\Windows\Windows Search\AllowCortana=4,0
MACHINE\Software\Policies\Microsoft\Windows\Windows Search\ConnectedSearchUseWeb=4,0
MACHINE\Software\Policies\Microsoft\Windows\Windows Search\ConnectedSearchUseWebOverMeteredConnections=4,0
MACHINE\Software\Policies\Microsoft\Windows\Windows Search\DisableWebSearch=4,1
MACHINE\Software\Policies\Microsoft\Windows\Windows Search\EnableDynamicContentInWSB=4,0
MACHINE\Software\Policies\Microsoft\Windows\WindowsAI\AllowRecallEnablement=4,0
MACHINE\Software\Policies\Microsoft\Windows\WindowsAI\DisableAgentConnectors=4,1
MACHINE\Software\Policies\Microsoft\Windows\WindowsAI\DisableAgentWorkspaces=4,1
MACHINE\Software\Policies\Microsoft\Windows\WindowsAI\DisableAIDataAnalysis=4,1
MACHINE\Software\Policies\Microsoft\Windows\WindowsAI\DisableClickToDo=4,1
MACHINE\Software\Policies\Microsoft\Windows\WindowsAI\DisableRemoteAgentConnectors=4,1
MACHINE\Software\Policies\Microsoft\Windows\WindowsAI\DisableSettingsAgent=4,1
MACHINE\Software\Policies\Microsoft\Windows\WindowsAI\TurnOffSavingSnapshots=4,1
MACHINE\Software\Policies\Microsoft\Windows\WindowsCopilot\TurnOffWindowsCopilot=4,1
;MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\ActiveHoursStart=4,0
;MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\ActiveHoursEnd=4,17
MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\SetActiveHours=4,0
MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\AUOptions=4,5
MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\IncludeRecommendedUpdates=4,0
MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoRebootWithLoggedOnUsers=4,1
MACHINE\Software\Policies\Microsoft\WindowsStore\AutoDownload=4,2
MACHINE\Software\Policies\Microsoft\WindowsStore\DisableStoreApps=4,1
MACHINE\Software\Policies\Microsoft\WindowsStore\RemoveWindowsStore=4,1
MACHINE\Software\Policies\WindowsNotepad\DisableAIFeatures=4,1
MACHINE\System\CurrentControlSet\Control\BitLocker\PreventDeviceEncryption=4,1
MACHINE\System\CurrentControlSet\Control\CI\Policy\VerifiedAndReputablePolicyState=4,0
MACHINE\System\CurrentControlSet\Control\DisableRemoteSCMEndpoints=4,1
MACHINE\System\CurrentControlSet\Control\FileSystem\LongPathsEnabled=4,1
MACHINE\System\CurrentControlSet\Control\FileSystem\NTFSDisable8dot3NameCreation=4,1
MACHINE\System\CurrentControlSet\Control\FileSystem\Win95TruncatedExtensions=4,0
MACHINE\System\CurrentControlSet\Control\LSA\LMCompatibilityLevel=4,5
MACHINE\System\CurrentControlSet\Control\LSA\NoLMHash=4,1
MACHINE\System\CurrentControlSet\Control\LSA\RestrictAnonymous=4,1
MACHINE\System\CurrentControlSet\Control\LSA\RestrictAnonymousSAM=4,1
MACHINE\System\CurrentControlSet\Control\LSA\RunAsPPL=4,1
;MACHINE\System\CurrentControlSet\Control\LSA\MSV1_0\RestrictReceivingNTLMTraffic=4,2
;MACHINE\System\CurrentControlSet\Control\LSA\MSV1_0\RestrictSendingNTLMTraffic=4,2
MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDrivers=4,0
MACHINE\System\CurrentControlSet\Control\Session Manager\CWDIllegalInDLLSearch=4,ffffffff
MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\NoDefaultCurrentDirectoryInExePath=1,"*"
MACHINE\System\CurrentControlSet\Control\Session Manager\Power\HiberBootEnabled=4,0
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\AutoDisconnect=4,15
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableForcedLogOff=4,1
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionPipes=7,
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess=4,1
MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Parameters\EnablePlainTextPassword=4,0
MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Parameters\EnableSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Parameters\RequireSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Services\NetBT\Parameters\EnableLMHOSTS=4,0
MACHINE\System\CurrentControlSet\Services\TcpIp\Parameters\UseDomainNameDevolution=4,0
[Profile Description]
Description =
[Privilege Rights]
[File Security]
[Event Audit] SetupComplete.cmd
Windows Setup Technical Reference
The batch script
%SystemRoot%\Setup\Scripts\SetupComplete.cmd
is executed during the
installation
of Windows Vista and later versions after the
oobeSystem
pass
and before the first user logon – it runs (invisible) under
the NT AUTHORITY\SYSTEM alias
LocalSystem
user account.
REM Copyright © 2009-2026, Stefan Kanthak <stefan.kanthak@nexgo.de>
REM Prevent accidental execution
IF "%USERNAME%" == "SYSTEM" (
IF /I "%USERPROFILE%" == "%SystemRoot%\System32\Config\SystemProfile" (
IF /I "%~f0" == "%SystemRoot%\Setup\Scripts\SetupComplete.cmd" (
CALL :CONTINUE %*))) 0<NUL: 1>"%~dpn0.out" 2>"%~dpn0.err"
EXIT /B
:CONTINUE
REM %CMDCMDLINE%Rem Copyright © 2009-2026, Stefan Kanthak <stefan.kanthak@nexgo.de>
Rem Prevent accidental execution
If "%USERNAME%" == "SYSTEM" (
If /I "%USERPROFILE%" == "%SystemRoot%\System32\Config\SystemProfile" (
If /I "%~f0" == "%SystemRoot%\Setup\Scripts\SetupComplete.cmd" (
Call :REDIRECT %*))) 0<NUL: 1>"%~dpn0.out" 2>"%~dpn0.err"
Exit /B
:REDIRECT
…
Rem Private 'TEMP' directory for 'LocalSystem' user account
If /I "%TEMP%" == "%SystemRoot%\Temp" (
"%SystemRoot%\System32\SetX.exe" TEMP "%%USERPROFILE%%\AppData\Local\Temp" /M
"%SystemRoot%\System32\SetX.exe" TMP "%%USERPROFILE%%\AppData\Local\Temp" /M
MkDir "%SystemRoot%\System32\Config\SystemProfile\AppData\Local\Temp"
If Exist "%SystemRoot%\SysWoW64\Config\SystemProfile" MkDir "%SystemRoot%\SysWoW64\Config\SystemProfile\AppData\Local\Temp"
)
…
Rem Disable builtin 'Guest' user account
"%SystemRoot%\System32\Net.exe" USER Guest /Active:No
Rem Enable builtin 'Administrator' user account and set random password
Rem (https://support.microsoft.com/en-us/kb/251394)
"%SystemRoot%\System32\Net.exe" USER Administrator /Active:Yes /FullName:"Stefan Kanthak" /PasswordReq:Yes /Random
…
Rem Disable offer for permanent ACL change on inaccessible directories in 'File Explorer'
Rem (https://support.microsoft.com/en-us/kb/950934)
For %%? In ("%SystemRoot%\Logs\HomeGroup"
"%SystemRoot%\Logs\RecoveryDisc"
"%SystemRoot%\Logs\SystemRestore"
"%SystemRoot%\Logs\WindowsBackup"
"%SystemRoot%\Security\Audit"
"%SystemRoot%\ServiceProfiles\LocalService"
"%SystemRoot%\ServiceProfiles\NetworkService"
"%SystemRoot%\System32\Config\SystemProfile"
"%SystemRoot%\System32\LogFiles\Fax\Incoming"
"%SystemRoot%\System32\LogFiles\Fax\Outgoing"
"%SystemRoot%\System32\LogFiles\Firewall"
"%SystemRoot%\System32\LogFiles\HTTPERR"
"%SystemRoot%\System32\LogFiles\WMI"
"%SystemRoot%\System32\MSDTC"
"%SystemRoot%\System32\NetworkList
"%SystemRoot%\System32\Tasks"
"%SystemRoot%\System32\WDI"
"%SystemRoot%\System32\WFP"
"%SystemRoot%\SysWoW64\Config\SystemProfile"
"%SystemRoot%\SysWoW64\Tasks"
"%SystemRoot%\Temp") Do "%SystemRoot%\System32\Attrib.exe" +H +R +S "%%~?"
…
Rem Remove 'Edge Chromium'
Rem If Defined ProgramFiles(x86) (For /R "%ProgramFiles(x86)%\Microsoft\Edge\Application" %%? In (Setup?.Exe) Do Set SETUP=%%~?) Else (For /R "%ProgramFiles%\Microsoft\Edge\Application" %%? In (Setup?.Exe) Do Set SETUP=%%~?)
Rem If Defined SETUP "%SETUP%" --force-uninstall --system-level --uninstall --verbose-logging
…
Rem Move 'Network Database'
MkDir "%ProgramData%\Microsoft\Network\Database" && (
Move "%SystemRoot%\System32\Drivers\Etc\*" "%ProgramData%\Microsoft\Network\Database"
For %%! In ("%ProgramData%\Microsoft\Network\Database\*") Do @(
For /D /R "%SystemRoot%\WinSxS" %%? In (*) Do @(
If Exist "%%?\%%~nx!" MkLink /H "%SystemRoot%\System32\Drivers\Etc\%%~nx!" "%%?\%%~nx!"))
"%SystemRoot%\System32\Reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters" /V "DataBasePath" /T REG_SZ /F /D "%ProgramData%\Microsoft\Network\Database")
…
Rem Prevent (per-user) installation of 'OneDrive Client'
If Defined ProgramFiles(x86) (
Delete "%SystemRoot%\SysWoW64\OneDriveSetup.exe"
) Else (
Delete "%SystemRoot%\System32\OneDriveSetup.exe"
)
…
Rem (https://support.microsoft.com/en-us/kb/310516)
"%SystemRoot%\System32\Reg.exe" IMPORT "%SystemRoot%\Setup\Scripts\SetupComplete.reg"
…
Rem (https://msdn.microsoft.com/en-us/library/gg441316.aspx)
"%SystemRoot%\System32\RunDLL32.exe" "%SystemRoot%\System32\AdvPack.dll",LaunchINFSection "%SystemRoot%\Setup\Scripts\SetupComplete.inf",UnattendedInstall
… SetupConfig.ini
%SystemDrive%\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini
[SetupConfig]
;AddBootMgrLast
;Auto={ Clean | DataOnly | Upgrade }
;BitLocker={ AlwaysSuspend | TryKeepActive | ForceKeepActive }
;CompactOS={ Enable | Disable }
;Compat={ IgnoreWarning | ScanOnly }
;CopyLogs=[ ‹drive›:\‹directory› | \\‹computer›\‹share›\‹directory› ]
;DiagnosticPrompt={ Disable | Enable }
;DynamicUpdate={ Disable | Enable | NoDrivers | NoDriversNoLCU | NoLCU }
;InstallDrivers=[ ‹drive›:\‹directory› | \\‹computer›\‹share›\‹directory› ]
;InstallFrom=[ ‹drive›:\‹directory› | \\‹computer›\‹share›\‹directory› ]
;InstallLangPacks=[ ‹drive›:\‹directory› | \\‹computer›\‹share›\‹directory› ]
;M=[ ‹drive›:\‹directory› | \\‹computer›\‹share›\‹directory› ]
;MigNEO=Disable
;MigrateDrivers={ All | None }
NoReboot
;PKey=23467-89BCD-FGHJK-MNPQR-TVWXY
;Priority=Normal
;PostOOBE=[ ‹drive›:\‹directory› | \\‹computer›\‹share›\‹directory› ] [ \setupcomplete.cmd ]
;PostRollback=[ ‹drive›:\‹directory› | \\‹computer›\‹share›\‹directory› ] [ \setuprollback.cmd ]
;PostRollbackContext={ System | User }
;Quiet
;ReflectDrivers=[ ‹drive›:\‹directory› | \\‹computer›\‹share›\‹directory› ]
;ResizeRecoveryPartition={ Disable | Enable }
;ShowOOBE={ Full | None }
;Telemetry={ Disable | Enable }
;TempDrive=‹drive›:
;Unattend=[ ‹drive›:\‹directory› | \\‹computer›\‹share›\‹directory› ] [ \unattend.xml ]
;Uninstall={ Disable | Enable }Use the X.509 certificate to send S/MIME encrypted mail.
Note: email in weird format and without a proper sender name is likely to be discarded!
I dislike
HTML (and even
weirder formats too) in email, I prefer to receive plain text.
I also expect to see your full (real) name as sender, not your
nickname.
I abhor top posts and expect inline quotes in replies.
as iswithout any warranty, neither express nor implied.
cookiesin the web browser.
The web service is operated and provided by
Telekom Deutschland GmbH The web service provider stores a session cookie
in the web
browser and records every visit of this web site with the following
data in an access log on their server(s):