Generate autounattend.xml files for Windows 10/11

» schneegans.de

This service lets you create answer files (typically named unattend.xml or autounattend.xml) to perform unattended installations of both Windows 10 and Windows 11, including 24H2 and 25H2. Answer files generated by this service are primarily intended to be used with Windows Setup run from Windows PE to perform clean (rather than upgrade) installations.

Usage · Sample scripts · GitHub · Donate via PayPal · Buy Me a Coffee · Commit 7985144 (updated 2 days ago)

Import .xml file generated by this service
Presets
Region and language settings:
Windows features like Settings and File Explorer will appear in this language. It must match the language of your Windows 10/11 .iso file.
Windows and apps might use your country or region to give you local content.
Choose language preferences and keyboard layouts
Select one or more languages in order of preference. The first language will also determine the initial regional format, which defines how numbers, dates, times and currency are formatted. You can change the regional format later.
Windows PE stage:
Windows Setup will ask you how to partition your disk and where to install Windows. Choose this when your disk already has partitions that you want to keep.
This removes all existing short file names such as PROGRA~1 and disables the creation of new ones.
Windows image to install
Run Get-WindowsImage -ImagePath "…\install.wim" in PowerShell to learn the name and index of an image inside a .wim file.
This only works when you select Use a generic product key in the Windows edition section below.
Partitioning and formatting
Select target disk The hard drive is disk (0-based).
Choose partition layout
The GPT partition layout must be used for UEFI systems. Set the size of the EFI System Partition (ESP) to MB.
MBR The MBR-based partition layout must be used for legacy BIOS systems.
Choose how to install Windows RE
Create a separate partition with a size of MB and install Windows RE to it.
Windows RE will not be available, and no recovery partition will be created.
Drive letter assignments in the script (e.g. ASSIGN LETTER=W) solely affect the Windows PE stage of Windows Setup. These assignments do not persist to the new installation, which will always assign the C: drive letter to the Windows partition.
Verify disk numbers
When you let Windows Setup wipe and partition your disks, there is a risk they were assigned unexpected index numbers. For example, on some computers, disk 0 might refer to an USB thumb drive instead of the primary hard drive. To make sure that Windows Setup targets the intended disk, you can make assertions about that disk. If these assertions are not met, Windows Setup will halt to avoid data loss.
Your script has to partition and format the disk, copy a Windows image to it and make it bootable. Note that PowerShell is usually not available in Windows PE.
Windows edition:
Such a key can be used to install Windows, but will not activate it. You can change the product key later.
Choose this if your computer came pre-installed with Windows and you want to reuse that license.
Processor architectures:

When you select multiple processor architectures, a single autounattend.xml file will be created that is applicable to all of these architectures.
Setup settings:
Only check this option if your computer really does not have internet access. You will still have to click the I don't have internet button during Windows Setup in that case. If you just want to create local (“offline”) user accounts in Windows 11, you do not need this option – simply use the User accounts section of this form.
This makes Windows Setup look for a folder named $OEM$ in the root of the drive where your autounattend.xml file is located and copy its contents to the target partition.
By default, PowerShell scripts that run during Windows Setup will have a visible window. This makes debugging easier and lets you use interactive prompts in your scripts, but also carries the risk that this window gets inadvertently or deliberately closed, which would kill the script. If you choose to hide PowerShell windows, any PowerShell scripts during Windows Setup will be run with the -WindowStyle "Hidden" switch.
Do not enable this checkbox if you are planning to use interactive prompts (like PowerShell's Read-Host cmdlet) in your scripts! Without a visible window, you would be unable to answer these prompts, and Windows Setup could not continue.
By default, the files C:\Windows\Panther\unattend.xml, C:\Windows\Panther\unattend-original.xml and C:\Windows\Setup\Scripts\Wifi.xml, which may contain sensitive data, will be deleted once Windows Setup has finished. When you enable this checkbox, those files will be kept.
Narrator is a built-in screen reader that speaks out loud what is on your screen.
Computer name:
Your script will be evaluated during Windows Setup. The script must return a single string, which must be a valid computer name. You can also use a script such as return Read-Host -Prompt 'Enter computer name'; to create an interactive prompt.
Time zone:
This is useful when your country or region spans multiple time zones, like Australia or the United States.
User accounts:
Account name Display name Password Group

Leave Display name empty unless you want it to be different from Account name.

First logon
Several settings will only be applied when an administrator logs on for the first time. You should therefore let Windows log you on to an administrator account once – this does not affect subsequent logons. Choose which account to use for this:
The installation ends with the sign-in screen being shown. Not recommended.
Password expiration:
This is in accordance to NIST guidelines that no longer recommend password expiration.
Passwords expire after 42 days.
Passwords expire after days.

These settings only apply to local accounts. Also, the password of the built-in account Administrator never expires.
Account Lockout policy:
By default, Windows will lock out an account after 10 failed logon attempts (threshold) within 10 minutes (window). After 10 minutes (duration), the account is unlocked automatically.
Disabling Account Lockout might leave your computer vulnerable to brute-force attacks.
Lock out an account after failed logon attempts within minutes. After minutes, unlock the account automatically.
File Explorer tweaks:
Choose which files are hidden in File Explorer
This will hide any file that has the Hidden attribute set.
This will only hide files that have both the Hidden and the System attribute set.
This setting is recommended for advanced users.
By default, File Explorer would hide extensions for known file types.
Start menu and taskbar:
Choose how to display the search box in the taskbar
Choose icons to display in the taskbar
See Microsoft's documentation for more examples.
This hides the news and weather widget in the lower-left corner in Windows 11.
On Windows 10, this will simply set the EnableAutoTray registry value. On Windows 11, this will create a scheduled task that runs periodically in the background and sets all tray icons visible.
Windows 10
Configure the tiles that are initially shown in the Windows 10 Start menu. You can add or remove tiles later. On Windows 11, this setting is simply ignored.
If you select apps in the Remove bloatware section below, Windows 10 will automatically remove their tiles from the Start menu.
Windows 11
Configure the pins that are initially shown in the Windows 11 Start menu. You can add or remove pins later. On Windows 10, this setting is simply ignored.
Avoid this setting if you select apps in the Remove bloatware section below, as Windows 11 will deceptively retain their pins in the Start menu.
System tweaks:
This disables certain services (Sense, WdBoot, WdFilter, WdNisDrv, WdNisSvc, WinDefend) during the Windows PE stage of Windows Setup and thus prevents the MsMpEng.exe process from running. This method was adapted from an article by Rudy Mens.
This will create a scheduled task (named PauseWindowsUpdate) that pauses updates for one week again and again. If you want to run Windows Update for once, click Resume updates in Settings. If you want to enable Windows Update permanently, disable or delete that task.
Not recommended to be used with a Microsoft (“online”) user account as Windows Hello PIN dialogs might appear minimized or hidden.
You should disable UAC only for testing environments or when you intend to use separate administrator and user accounts.
This turns Smart App Control off in Windows 11. Note that you will not be able to turn it back on.
Windows will not create restore points for drive C: and thus use less disk space.
This sets the LongPathsEnabled registry value, which enables several programs (including PowerShell, 7-Zip and TreeSize) to use long paths with up to 32,767 characters without resorting to the \\?\ prefix.
This removes write permissions on C:\ for the Authenticated Users group. In particular, this prevents unprivileged users from creating bogus folders such as C:\Windows .
This will delete several hidden junction points, such as C:\Documents and Settings or C:\Users\Default\My Documents. These were intended to improve compatibility with older software, but also can be quite confusing.
This runs the command Set-ExecutionPolicy -ExecutionPolicy 'RemoteSigned', which allows the execution of unsigned .ps1 files.
This runs the command fsutil.exe behavior set disableLastAccess 1, which can improve file system performance.
This creates a scheduled task that periodically moves your active hours, tricking Windows into thinking your device is in use all the time.
This changes the sound scheme from Windows Default to No sounds for all users.
This sets several registry values that prevent the silent download and installation of suggested apps. Note that as a side effect this will also disable the Manage devices button in the Mobile devices section in Settings. If this bothers you, change the value of DisableWindowsConsumerFeatures to 0.
Windows 11 would otherwise enable BitLocker encryption automatically.
This will skip the annoying dialogs when Edge is run for the first time.
This will stop Edge from running in the background all the time.
This will modify the C:\Windows\System32\IntegratedServicesRegionPolicySet.json file such that Edge can be uninstalled even outside the European Economic Area.
This settings tends to cause problems with Windows Update. Use at your own risk!
This may be useful for players of first-person shooters.
This may improve performance, but also lessens security. Also enable this setting if you plan to run VMware or VirtualBox as it will disable Hyper-V, which would otherwise dramatically decrease the performance of your virtual machines.
By default, Windows automatically signs on the last user after a restart and then locks their session. This offers very little benefits compared to signing on manually and will often lead to a confusing warning: Someone else is still using this PC. If you restart now, they could lose unsaved work.
Each time a new process is created, Windows writes an event to the Security log. This is a powerful tool for troubleshooting.
Visual effects:
Desktop icons:
Folders on Start:

This setting has no effect on Windows 10. On Windows 11, the folders will appear on the Start menu as follows:

Virtual machine support:
See the usage notes for how to set up your Windows VM in VirtualBox, VMWare Workstation, Proxmox VE or Parallels Desktop.
WLAN / Wi-Fi setup:
Choose this if you have a wired connection to the internet.
If Windows does not support your Wi-Fi adapter out-of-the-box, you need to add the appropriate driver files to the $WinPEDriver$ folder on your installation medium.
Express settings:
Windows will not send diagnostic data, personalized input or your location history to Microsoft. Choose this if you value privacy.
Windows will send data to Microsoft to provide location-based services, improve language recognition, and show personalized ads.
This lets you enable some settings while disabling others.
Lock key settings:
Key Initial state When pressed
Caps Lock
Num Lock
Scroll Lock
This will affect all users and also the login screen.
Sticky keys:
This will affect all users and also the login screen.
Personalization settings:

These settings are particularly useful if you want to use Windows without activation when the Personalization settings page is not available.

Colors
Desktop wallpaper
Your script will be evaluated during Windows Setup, after your computer has connected to a network. The script must return a byte[] value, which must contain the raw image data. For example, you can download an image from the internet, locate an image file on a removable drive or a network share and load it via [System.IO.File]::ReadAllBytes, or provide the image data directly via [convert]::FromBase64String.
Lock screen image
This script works just as the Desktop wallpaper script above.
Remove bloatware:

Windows comes with several apps that many users do not want or do not need. Check all the apps you want removed during Windows Setup:

Note that it might be difficult to reinstall removed apps, particularly the Microsoft Store app.
Run custom scripts:

You may want to take a look at some sample scripts first.

System scripts
These scripts will run in the system context, before user accounts are created.
  1. Run as a file.
  2. Run as a file.
  3. Run as a file.
  4. Run as a file.
DefaultUser scripts
Use these scripts to modify the default user's registry hive. The generated code will automatically mount the C:\Users\Default\NTUSER.DAT hive file, run your scripts and unmount the hive again. Your scripts will be run before user accounts are created – hence, they will affect all user accounts, including the built-in account Administrator. Access the keys in this hive as follows:
.reg [HKEY_USERS\DefaultUser\…
.cmd HKU\DefaultUser\…
.ps1 Registry::HKU\DefaultUser\…
  1. Run as a file.
  2. Run as a file.
  3. Run as a file.
FirstLogon scripts
These scripts will run when the first user logs on after Windows has been installed. The first user to log on is typically an administrator. In this case, these scripts will run with elevated privileges.
  1. Run as a file.
  2. Run as a file.
  3. Run as a file.
  4. Run as a file.
UserOnce scripts
These scripts will run whenever a user logs on for the first time.
  1. Run as a file.
  2. Run as a file.
  3. Run as a file.
  4. Run as a file.
This will restart the explorer.exe process that is responsible for displaying Start menu, taskbar and Desktop. If your scripts in this section make changes to any of these elements, check this box so that they take effect immediately.

Your scripts will be run as follows:

.cmd C:\Windows\Setup\Scripts\unattend-01.cmd
.ps1 powershell.exe -WindowStyle "Normal" -ExecutionPolicy "Unrestricted" -NoProfile -File "C:\Windows\Setup\Scripts\unattend-02.ps1"
.reg reg.exe import "C:\Windows\Setup\Scripts\unattend-03.reg"
.vbs cscript.exe //E:vbscript "C:\Windows\Setup\Scripts\unattend-04.vbs"
Windows Defender Application Control:

Applications in C:\Windows, C:\Program Files and C:\Program Files (x86) are allowed to run. Applications stored elsewhere and those in known user-writable folders such as C:\Windows\Temp or C:\Windows\Debug\WIA are not allowed to run. To disable this WDAC policy later, simply delete the file C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{d26bff32-33a2-48a3-b037-10357ee48427}.cip and reboot. To create a more customized policy, see my online WDAC generator.

WDAC configuration will be removed from this service in the future. In my opinion, WDAC is not suited for application whitelisting, and I have stopped using WDAC on my machines some time ago. Also note that WDAC might very well block vital operating system files or device drivers from loading.

For most scenarios, prefer AppLocker over WDAC. AppLocker is now also available for Home and Pro editions of Windows 10 and Windows 11. Use the AppLocker section below to configure a policy.

Choose how to enforce the policy
Logs drivers and applications that would have been blocked.
When the policy blocks a system driver and thus would prevent Windows from booting, use audit mode. Otherwise, use enforcement mode.
Drivers and applications will be blocked unless allowed by the policy.
Choose script enforcement
PowerShell will run in Constrained Language Mode. See Script Enforcement for details.
PowerShell will run in Full Language Mode.
AppLocker:
XML markup for more components:

You can add settings for all available components to add functionality not yet covered by this generator.

The generator itself uses some components (displayed with a reddish background below). You may assign your own XML markup to these components, but this will completely replace their generated content, and there is no guarantee that the resulting autounattend.xml file will work as intended.

Do not include settings or component elements with your markup – they will be added automatically.

  1. Insert XML markup to the component.
  2. Insert XML markup to the component.
  3. Insert XML markup to the component.
Download settings:
Windows Setup will not process the notautounattend.xml file automatically. Instead, you need to run a command such as setup.exe /Unattend:D:\notautounattend.xml. This is useful to prevent Windows Setup from inadvertently wiping your hard drive, and lets you specify additional parameters such as /NoReboot.
Submit form:
Contact: Christoph Schneegans (christoph@schneegans.de)