daac231148
All checks were successful
Build SilverMetal Enhanced - Windows ISO / build (pull_request) Successful in 5m37s
VM e2e findings on the real-user desktop: 1. Lock/login screen + wallpaper NOT branded (OEM About WAS) — Windows resets the offline-baked personalization (PersonalizationCSP / default-user wallpaper / FVE) during OOBE, same class as the UAC reset. Fix: stage windows/branding/ into the image and re-run Apply-Branding -Mode Online from SetupComplete (post-OOBE, as SYSTEM) where it sticks. OEM About re-asserted harmlessly. 2. sm-bootstrap account still present after onboarding — TearDownAsync's in-session Remove-LocalUser no-ops (can't delete the account you're logged in as). Fix: keep the best-effort in-session attempt, but DEFER the real removal to a SYSTEM AtStartup scheduled task that runs on next boot (sm-bootstrap not logged on), removes the account + Win32_UserProfile, then deletes itself. (Network 'no adapter' in the VM was a Proxmox NIC-model regression to virtio — fixed by switching the VM to Intel e1000; not a SilverMetal change.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
38 lines
1.8 KiB
Batchfile
38 lines
1.8 KiB
Batchfile
@echo off
|
|
REM ===========================================================================
|
|
REM SilverMetal Enhanced - Windows : first-boot entry point.
|
|
REM Windows runs %WINDIR%\Setup\Scripts\SetupComplete.cmd automatically (as
|
|
REM SYSTEM) at the end of setup. It hands off to Invoke-Hardening.ps1 via -File
|
|
REM to avoid cmd/PowerShell quoting fragility (an inline -Command one-liner
|
|
REM here previously failed to parse, so the §A-H modules never ran).
|
|
REM
|
|
REM Design: ../../iso-builder.md Controls: ../../hardening-spec.md
|
|
REM ===========================================================================
|
|
|
|
set LOG=C:\Windows\Setup\Scripts\silvermetal-firstboot.log
|
|
set HARD=C:\Windows\Setup\Scripts\hardening
|
|
|
|
echo [%DATE% %TIME%] SilverMetal first-boot start >> "%LOG%"
|
|
|
|
REM Re-apply branding ONLINE (lock screen / wallpaper / OEM / FVE). Windows resets
|
|
REM the offline-baked personalization during OOBE, so re-assert it here (post-OOBE,
|
|
REM as SYSTEM) where it sticks. Idempotent with the offline bake.
|
|
if exist "%~dp0branding\Apply-Branding.ps1" (
|
|
echo [%DATE% %TIME%] re-applying SilverMetal branding (online) >> "%LOG%"
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0branding\Apply-Branding.ps1" -Mode Online >> "%LOG%" 2>&1
|
|
)
|
|
|
|
if exist "C:\Program Files\SilverOS\Welcome\SilverOS.Welcome.App.exe" (
|
|
echo [%DATE% %TIME%] configuring onboarding kiosk >> "%LOG%"
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0Configure-Kiosk.ps1" >> "%LOG%" 2>&1
|
|
)
|
|
|
|
if exist "C:\Program Files\SilverOS\Welcome\SilverOS.Welcome.App.exe" (
|
|
echo [%DATE% %TIME%] hardening deferred to SilverOS Welcome >> "%LOG%"
|
|
) else (
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File "%HARD%\Invoke-Hardening.ps1" >> "%LOG%" 2>&1
|
|
)
|
|
|
|
echo [%DATE% %TIME%] SilverMetal first-boot done >> "%LOG%"
|
|
exit /b 0
|