windows/installer/build.ps1

@@ -192,6 +192,13 @@ function Invoke-ServiceWim {
             Write-Host '   adding drivers'; Add-WindowsDriver -Path $mount -Driver $drv -Recurse | Out-Null
         } else { Write-Host '   no .inf drivers staged (ok for VM test)' }
 
+        # Kiosk features (Shell Launcher v2 + Keyboard Filter) — IoT Enterprise LTSC.
+        if ($env:SILVERMETAL_WELCOME_ENABLED -ne '0') {
+            Write-Host '   enabling Shell Launcher + Keyboard Filter features'
+            Enable-WindowsOptionalFeature -Path $mount -FeatureName Client-EmbeddedShellLauncher -All -NoRestart | Out-Null
+            Enable-WindowsOptionalFeature -Path $mount -FeatureName Client-KeyboardFilter        -All -NoRestart | Out-Null
+        }
+
         # Debloat: remove provisioned appx listed in debloat/appx-remove.txt (best-effort).
         $list = Join-Path $WindowsDir 'debloat\appx-remove.txt'
         if (Test-Path $list) {
@@ -208,6 +215,7 @@ function Invoke-ServiceWim {
         $scripts = Join-Path $mount 'Windows\Setup\Scripts'
         $null = New-Item -ItemType Directory -Force $scripts, (Join-Path $scripts 'hardening')
         Copy-Item (Join-Path $PSScriptRoot 'oem\SetupComplete.cmd') $scripts -Force
+        Copy-Item (Join-Path $PSScriptRoot 'oem\Configure-Kiosk.ps1') $scripts -Force
         Copy-Item (Join-Path $WindowsDir 'hardening\*') (Join-Path $scripts 'hardening') -Recurse -Force
 
         # Stage Welcome app + flavours while the WIM is still mounted.