Generate autounattend.xml files for Windows 10/11

This service lets you create answer files (typically named unattend.xml or autounattend.xml) to perform unattended installations of Windows 10/11. The .NET library that forms the basis for this service is available on GitHub.

Region and language settings:

Install Windows using these language settings:

Display menus, dialog boxes, etc. in this language, which must match the language of your Windows 10/11 .iso file: Format dates, times, currency, and numbers according to this locale / culture: Use this keyboard layout: Use this country or region as your home location:

Select language settings interactively during Windows Setup

Processor architectures:

When you select multiple processor architectures, a single autounattend.xml file will be created that is applicable to all of these architectures.

Setup settings: Bypass Windows 11 requirements check (TPM, Secure Boot, etc.) Allow Windows 11 to be installed without internet connection This effectively runs the oobe\BypassNRO.cmd command, which was discovered by Reddit user aveyo. Note that you still have to click the I don't have internet button during Windows Setup.

Computer name: Let Windows generate a random computer name like DESKTOP-ZFAH8Z2 Choose a computer name yourself Use this name:

Time zone:

Let Windows determine your time zone based on language and region settings Set your time zone explicitly

This is useful when your country or region spans multiple time zones, like Australia or the United States. Use this time zone:

Partitioning and formatting:

Partition the disk interactively during Windows Setup or use existing partition Let Windows Setup wipe, partition and format your hard drive (more specifically, disk 0) using these settings:

Choose partition layout GPT

The GPT partition layout must be used for UEFI systems. Set the size of the EFI System Partition (ESP) to MB.

MBR MBR The MBR-based partition layout must be used for legacy BIOS systems.

Choose how to install Windows RE Install on recovery partition

Create a separate partition with a size of MB and install Windows RE to it.

Install on Windows partition This will install Windows RE in C:\Recovery. No recovery partition will be created. Remove Windows RE This will delete the C:\Recovery folder and thus free about 600 MB of disk space. No recovery partition will be created.

Use a custom diskpart script to configure your disk(s):

Avoid drive letter assignments (e.g. ASSIGN LETTER=R) in your script as these will not persist.

Choose partition to install Windows to after script has run Install Windows to the first available partition that has enough space and does not already contain an installation of Windows Install to another partition:

Disk (0-based):
Partition (1-based):

Windows edition:

Use a generic product key

Such a key can be used to install Windows, but will not activate it. You can change the product key later. Install this edition of Windows:

Enter your own product key during Windows Setup You can also enter your key in the autounattend.xml file. To do this, find the <Key>00000-00000-00000-00000-00000</Key> element and replace the text with your key.

User accounts:

Let Windows Setup create the following local accounts:

Account name	Password	Group

First logon

Some settings might not be applied until an administrator logs on for the first time. You should therefore let Windows log you on to an administrator account once – this does not affect subsequent logons. Choose which account to use for this:

Logon to the first administrator account created above Activate built-in account Administrator and logon to this account Set its password to: Do not logon The installation ends with the sign-in screen being shown.

Add user accounts interactively during Windows Setup Choose this if you want to use a Microsoft account.

Password expiration:

Passwords do not expire This is in accordance to NIST guidelines that no longer recommend password expiration. Use Windows default Passwords expire after 42 days. Use custom password expiration:

Passwords expire after days.

These settings only apply to local accounts. Also, the password of the built-in account Administrator never expires.

Account Lockout policy:

Use default policy By default, Windows will lock out an account after 10 failed logon attempts (threshold) within 10 minutes (window). After 10 minutes (duration), the account is unlocked automatically. Disable policy Disabling Account Lockout might leave your computer vulnerable to brute-force attacks. Use custom policy:

Lock out an account after failed logon attempts within minutes. After minutes, unlock the account automatically.

Optimizations:

Disable Windows Defender This disables certain services (Sense, WdBoot, WdFilter, WdNisDrv, WdNisSvc, WinDefend) during Windows Setup. A reboot might be required to stop these services. The method to disable Windows Defender on Windows 11 was adapted from an article by Rudy Mens. Disable System Protection / System Restore Windows will not create restore points for drive C: and thus use less disk space. Enable long paths This sets the LongPathsEnabled registry value, which enables several programs (including PowerShell, 7-Zip and TreeSize) to use long paths with up to 32,767 characters without resorting to the \\?\ prefix. Enable Remote Desktop services (RDP) Harden ACLs This removes write permissions on C:\ for the Authenticated Users group. In particular, this prevents unprivileged users from creating bogus folders such as C:\Windows . Allow execution of PowerShell script files This runs the command Set-ExecutionPolicy -ExecutionPolicy 'RemoteSigned', which allows the execution of unsigned .ps1 files. Do not update Last Access Time stamp This runs the command fsutil.exe behavior set disableLastAccess 1, which can improve file system performance. Do not reboot with users signed in This prevents Windows Update from rebooting when a user is signed in. Turn off system sounds This changes the sound scheme from Windows Default to No sounds for all users. Disable app suggestions This sets several registry values that prevent the silent download and installation of suggested apps. Disable widgets This hides the news and weather widget in the lower-left corner in Windows 11. Audit process creation events

Each time a new process is created, Windows writes an event to the Security log. This is a powerful tool for troubleshooting. Include command line in log events

WLAN / Wi-Fi setup:

Configure Wi-Fi interactively during Windows Setup Skip Wi-Fi configuration Choose this if you have a wired connection to the internet. Configure Wi-Fi using these settings:

Network name (SSID):
Connect even if not broadcasting:
Authentication:
Password:

If both your Wi-Fi router and your computer's Wi-Fi adapter support it, make sure to select WPA3. Otherwise, Windows Setup will try to switch from WPA2 to WPA3 and require manual interaction.

You should not enter your actual Wi-Fi password here. Once you have downloaded the autounattend.xml file, find the password enclosed in <keyMaterial>…</keyMaterial> and adjust it.

Configure Wi-Fi using an XML file created by netsh.exe wlan export profile key=clear on another computer:

Express settings: Disable all Windows will not send diagnostic data, personalized input or your location history to Microsoft. Choose this if you value privacy. Enable all Windows will send data to Microsoft to provide location-based services, improve language recognition, and show personalized ads. Choose settings interactively during Windows Setup This lets you enable some settings while disabling others.

Remove bloatware:

Windows comes with several apps that many users do not want or do not need. Check all the apps you want removed during Windows Setup:

If you select one or more apps to remove, all shortcuts, tiles and pinned icons in the start menu will be deleted, utilizing a technique demonstrated by Michael Niehaus. This is to prevent a user from accidentally reinstalling an app that has just been removed. The method to completely remove OneDrive was described by Stefan Kanthak, with whom I also collaborated to identify the registry keys that block the installation of Dev Home and Outlook for Windows.

Run custom scripts:

Scripts to run in the system context, before user accounts are created

Run as a file.
Run as a file.
Run as a file.
Run as a file.

Scripts to modify the default user's registry hive

You must use [HKEY_USERS\DefaultUser\…] keys in this .reg file. Do not use [HKEY_USERS\.DEFAULT\…] or [HKEY_CURRENT_USER\…] keys.

Run as a file.

Scripts to run when the first user logs on

Run as a file.
Run as a file.
Run as a file.
Run as a file.

Scripts to run whenever a user logs on for the first time

Run as a file.
Run as a file.
Run as a file.
Run as a file.

Your scripts will be run as follows:

.cmd	`C:\Windows\Setup\Scripts\unattend-01.cmd`
.ps1	`powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Setup\Scripts\unattend-02.ps1' -Raw \| Invoke-Expression;"`
.reg	`reg.exe import "C:\Windows\Setup\Scripts\unattend-03.reg"`
.vbs	`cscript.exe //E:vbscript "C:\Windows\Setup\Scripts\unattend-04.vbs"`
.js	`cscript.exe //E:jscript "C:\Windows\Setup\Scripts\unattend-05.js"`

Windows Defender Application Control:

Do not configure WDAC policy Configure a basic WDAC policy using these settings:

Applications in C:\Windows, C:\Program Files and C:\Program Files (x86) are allowed to run. Applications stored elsewhere and those in known user-writable folders such as C:\Windows\Temp or C:\Windows\Debug\WIA are not allowed to run. To disable this WDAC policy later, simply delete the file C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{d26bff32-33a2-48a3-b037-10357ee48427}.cip and reboot. To create a more customized policy, see my online WDAC generator.

Choose how to enforce the policy Auditing mode Logs drivers and applications that would have been blocked. Auditing mode on boot failure When the policy blocks a system driver and thus would prevent Windows from booting, use audit mode. Otherwise, use enforcement mode. Enforcement mode Drivers and applications will be blocked unless allowed by the policy.

Choose script enforcement Restricted PowerShell will run in Constrained Language Mode. See Script Enforcement for details. Unrestricted PowerShell will run in Full Language Mode.

Placeholders for more components:

This service can optionally generate templates for all available components, with respect to their valid configuration passes. Look for  comments in the generated autounattend.xml file and fill in the desired settings yourself.

Microsoft-Windows-Audio-AudioCore: specialize
Microsoft-Windows-Audio-VolumeControl: specialize
Microsoft-Windows-Authentication-AuthUI: specialize
Microsoft-Windows-BLB-WSB-Online-Main: specialize oobeSystem
Microsoft-Windows-BrowserService: generalize
Microsoft-Windows-CodeIntegrity: offlineServicing
Microsoft-Windows-CoreMmRes: generalize specialize auditSystem auditUser oobeSystem
Microsoft-Windows-Deployment: generalize specialize auditSystem auditUser oobeSystem
Microsoft-Windows-DeviceAccess: specialize
Microsoft-Windows-DeviceGuard-Unattend: offlineServicing
Microsoft-Windows-DiagCpl: offlineServicing generalize specialize
Microsoft-Windows-Disk-Failure-Diagnostic-Module: offlineServicing generalize specialize
Microsoft-Windows-DNS-Client: specialize
Microsoft-Windows-Embedded-BootExp: specialize oobeSystem
Microsoft-Windows-Embedded-EmbeddedLogon: offlineServicing specialize
Microsoft-Windows-Embedded-KeyboardFilterService: offlineServicing
Microsoft-Windows-Embedded-ShellLauncher: oobeSystem
Microsoft-Windows-Embedded-UnifiedWriteFilter: specialize
Microsoft-Windows-EnhancedStorage-Adm: specialize
Microsoft-Windows-ErrorReportingCore: specialize
Microsoft-Windows-Fax-Service: specialize
Microsoft-Windows-GPIOButtons: offlineServicing specialize
Microsoft-Windows-HelpAndSupport: specialize oobeSystem
Microsoft-Windows-IE-ClientNetworkProtocolImplementation: oobeSystem
Microsoft-Windows-IE-ESC: specialize
Microsoft-Windows-IE-InternetExplorer: specialize
Microsoft-Windows-International-Core: specialize oobeSystem
Microsoft-Windows-International-Core-WinPE: windowsPE
Microsoft-Windows-LUA-Settings: offlineServicing
Microsoft-Windows-MapControl-Desktop: specialize oobeSystem
Microsoft-Windows-MediaPlayer-Core: offlineServicing
Microsoft-Windows-MicrosoftEdgeBrowser: specialize
Microsoft-Windows-MobilePC-Sensors-API: specialize
Microsoft-Windows-NetBT: specialize
Microsoft-Windows-NetworkBridge: generalize
Microsoft-Windows-NetworkLoadBalancing-Core: specialize
Microsoft-Windows-OutOfBoxExperience: generalize specialize
Microsoft-Windows-PartitionManager: offlineServicing
Microsoft-Windows-PnpCustomizationsNonWinPE: offlineServicing auditSystem
Microsoft-Windows-PnpCustomizationsWinPE: windowsPE
Microsoft-Windows-PnpSysprep: generalize specialize
Microsoft-Windows-PowerCPL: generalize specialize
Microsoft-Windows-Printing-Spooler-Core: specialize
Microsoft-Windows-RasServer: specialize
Microsoft-Windows-RemoteAssistance-Exe: specialize
Microsoft-Windows-SecureStartup-FilterDriver: offlineServicing specialize auditSystem oobeSystem
Microsoft-Windows-Security-SPP: generalize
Microsoft-Windows-Security-SPP-UX: specialize
Microsoft-Windows-ServerManager-SvrMgrNc: generalize specialize
Microsoft-Windows-Setup: windowsPE
Microsoft-Windows-SharedAccess: generalize
Microsoft-Windows-Shell-Setup: offlineServicing windowsPE generalize specialize auditSystem auditUser oobeSystem
Microsoft-Windows-SHWebSVC: oobeSystem
Microsoft-Windows-SMBServer: generalize
Microsoft-Windows-SNMP-Agent-Service: generalize specialize
Microsoft-Windows-SQMAPI: specialize
Microsoft-Windows-STObject: generalize specialize
Microsoft-Windows-StorPort-RegistrySettings: specialize auditSystem auditUser oobeSystem
Microsoft-Windows-SystemMaintenanceService: specialize
Microsoft-Windows-SystemRestore-Main: specialize
Microsoft-Windows-SystemSettingsThreshold: generalize specialize
Microsoft-Windows-TabletPC-Platform-Input-Core: offlineServicing specialize oobeSystem
Microsoft-Windows-TapiSetup: specialize
Microsoft-Windows-TCPIP: windowsPE specialize
Microsoft-Windows-TerminalServices-CentralPublishing: oobeSystem
Microsoft-Windows-TerminalServices-LicenseServer: oobeSystem
Microsoft-Windows-TerminalServices-LocalSessionManager: offlineServicing generalize specialize
Microsoft-Windows-TerminalServices-Publishing-WMIProvider: offlineServicing generalize specialize
Microsoft-Windows-TerminalServices-RDP-WinStationExtensions: generalize specialize
Microsoft-Windows-TerminalServices-RemoteConnectionManager: offlineServicing generalize specialize
Microsoft-Windows-Tpm-Tasks: specialize
Microsoft-Windows-TwinUI: offlineServicing specialize oobeSystem
Microsoft-Windows-UnattendedJoin: offlineServicing specialize
Microsoft-Windows-WDF-KernelLibrary: offlineServicing
Microsoft-Windows-WiFiNetworkManager: offlineServicing specialize oobeSystem
Microsoft-Windows-WinRE-RecoveryAgent: oobeSystem
Microsoft-Windows-WLANSVC: offlineServicing windowsPE specialize oobeSystem
Microsoft-Windows-WorkstationService: generalize specialize
Microsoft-Windows-WPD-BusEnumService: specialize
Microsoft-Windows-WWANUI: generalize specialize
Networking-MPSSVC-Svc: specialize
Security-Malware-Windows-Defender: offlineServicing specialize oobeSystem

Submit form: