INTRODUCTION
Hello everyone, and welcome to Tech Haptic.
Today, we are pushing the boundaries of flexibility in Windows 11 deployment. In standard unattended installations, everything is static, and the system simply follows a fixed set of instructions. In this video, however, we will explore how to enhance Windows answer files with PowerShell scripts and make the Windows 11 setup process adaptable to different requirements.
Our goal is to go beyond simply skipping the Windows installation screens.
We are building a professional Windows 11 deployment foundation that bypasses hardware restrictions, removes unwanted components, and triggers custom provisioning logic based on the target environment.
By the end of this video, you will have a technical understanding of how to automate complex Windows 11 configurations using a single installation medium. You can then use the same principles to establish a high deployment standard in your own lab or enterprise environment.
To learn more about Windows deployment, PowerShell automation, and enterprise technologies, please subscribe to our channel.
If you are ready, let’s get started.
𝗛𝗢𝗪 𝗔𝗨𝗧𝗢𝗨𝗡𝗔𝗧𝗧𝗘𝗡𝗗.𝗫𝗠𝗟 𝗔𝗡𝗗 𝗣𝗢𝗪𝗘𝗥𝗦𝗛𝗘𝗟𝗟 𝗪𝗢𝗥𝗞 𝗧𝗢𝗚𝗘𝗧𝗛𝗘𝗥
The brain of our Windows 11 deployment system is the AutoUnattend.xml file.
We do not use this file only to bypass the Next buttons and setup screens in the Windows installation wizard. We use it to configure the operating system at a foundational level.
At this level, we will configure regional, language, currency, and Windows activation settings. We will partition the disk according to our requirements, bypass the Windows 11 TPM 2.0 and Secure Boot hardware requirements, and create a local administrator account with a predefined password.
The second layer is where the real engineering begins.
After the Windows desktop appears, we will use a custom PowerShell script to bring the entire deployment process to life. This PowerShell script opens a clean graphical user interface, or GUI, and dynamically handles the provisioning process according to our selections.
At the top of the interface, the first decision we make is the network deployment type. We can either join the computer to an Active Directory domain or leave it in a workgroup.
The default selection is Workgroup, which keeps the deployment simple. When Workgroup is selected, the script renames the computer based on its chassis type and generates a computer name containing a random four-digit identifier.
When Active Directory is selected, additional provisioning options become available.
The script handles both computer renaming and Active Directory organizational unit placement in a single process. In our example environment, we have created organizational units for three different branch locations.
When a location is selected, the script dynamically maps the corresponding distinguished name and places the computer in the correct organizational unit. It also dynamically renames the computer according to the selected department, chassis type, and a randomly generated four-digit identifier.
The interface also includes a section where we can select the enterprise applications that should be installed automatically in the background through WinGet.
With this approach, the entire Windows 11 deployment workflow can be customized according to the exact requirements of your infrastructure.
My goal in this video is not simply to provide a static template that you can copy. I want to explain the mechanics behind the scenario so that you can use the same principles to create a Windows deployment solution tailored to your own environment.
Now, let’s move to the screen and see how this solution was built.
𝗗𝗢𝗪𝗡𝗟𝗢𝗔𝗗𝗜𝗡𝗚 𝗧𝗛𝗘 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝟭𝟭 𝗜𝗦𝗢 𝗙𝗜𝗟𝗘
First, we need to download the Windows 11 ISO file.
We can download the ISO from Microsoft’s public Windows 11 download page or obtain the appropriate installation media through the Microsoft 365 portal.
If you want to install Windows 11 Enterprise, the Enterprise edition may not be available on the standard public download page. In that case, you should obtain the ISO through the appropriate Microsoft 365, Volume Licensing, or organizational portal.
For this demonstration, I will use Windows 11 Pro.
I will open the Microsoft Windows 11 download page and scroll down to the Download Windows 11 Disk Image, or ISO, for x64 devices section.
From the available options, I will select the Windows 11 multi-edition ISO and click Confirm.
After that, I need to select the product language. I will choose the appropriate language and click Confirm again.
The 64-bit download option will then become available. I will click 64-bit Download to begin downloading the Windows 11 ISO file.
I will fast-forward this part of the video so that we can continue without waiting for the download to finish.
The download is now complete.
𝗗𝗢𝗪𝗡𝗟𝗢𝗔𝗗𝗜𝗡𝗚 𝗔𝗡𝗗 𝗜𝗡𝗦𝗧𝗔𝗟𝗟𝗜𝗡𝗚 𝗔𝗡𝗬𝗕𝗨𝗥𝗡
The next tool we need is an ISO editing application.
For this demonstration, I am going to use AnyBurn. You can download it from the official AnyBurn website.
Select the free version, download the installer, and complete the installation.
Because AnyBurn is already installed on my computer, I do not need to install it again. I will close the download page and continue with the next step.
𝗖𝗥𝗘𝗔𝗧𝗜𝗡𝗚 𝗧𝗛𝗘 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝟭𝟭 𝗨𝗡𝗔𝗧𝗧𝗘𝗡𝗗𝗘𝗗 𝗔𝗡𝗦𝗪𝗘𝗥 𝗙𝗜𝗟𝗘
We now need to create the Windows unattended XML answer file.
To create it, I am going to use an online unattended installation generator. This tool allows us to create an AutoUnattend.xml file by selecting the required Windows installation settings through a graphical interface.
Creating the entire XML file manually can result in syntax mistakes, configuration problems, and human errors. Using an unattended answer file generator helps us create the configuration more consistently.
Let’s begin configuring the answer file.
𝗥𝗘𝗚𝗜𝗢𝗡𝗔𝗟 𝗔𝗡𝗗 𝗟𝗔𝗡𝗚𝗨𝗔𝗚𝗘 𝗦𝗘𝗧𝗧𝗜𝗡𝗚𝗦
Under the regional and language settings, I will select English as the Windows display language and Turkey as the location.
For the language preferences, I will select Turkish according to the requirements of this environment.
These values can be changed according to the country, language, keyboard layout, and regional requirements of your own organization.
𝗖𝗢𝗡𝗙𝗜𝗚𝗨𝗥𝗜𝗡𝗚 𝗧𝗛𝗘 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝗣𝗘 𝗣𝗔𝗦𝗦
For the Windows PE configuration pass, we need to select the option that generates a CMD script to handle the Windows PE stage.
We are enabling this because we want the Windows 11 installation to operate as a zero-touch deployment with as little manual intervention as possible.
The generator also provides options for disabling Windows Defender and changing several other Windows components. I do not need to disable those components in this environment, so I will leave those options unchanged.
𝗦𝗘𝗟𝗘𝗖𝗧𝗜𝗡𝗚 𝗧𝗛𝗘 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝟭𝟭 𝗘𝗗𝗜𝗧𝗜𝗢𝗡
For the Windows edition, I am going to select Windows 11 Pro because that is the edition used in this demonstration.
You should select the Windows edition that matches your organization’s license and deployment requirements.
𝗖𝗢𝗡𝗙𝗜𝗚𝗨𝗥𝗜𝗡𝗚 𝗚𝗣𝗧 𝗗𝗜𝗦𝗞 𝗣𝗔𝗥𝗧𝗜𝗧𝗜𝗢𝗡𝗜𝗡𝗚
The next section controls disk partitioning and formatting.
The target disk will be Disk 0. Because this is a Windows 11 installation, I will use the GPT partitioning scheme.
For this deployment, I want to create two main data partitions.
The C drive will be named System, and the D drive will be named Data.
Let’s assume that the target computer has a 250-gigabyte disk. With this structure, the Windows operating system and system files will be stored on the C drive, while other files and organizational data can be stored on the D drive.
If the operating system later becomes corrupted or needs to be reinstalled, separating the data partition can make it easier to preserve or recover files stored on the D drive. However, this configuration should not be considered a replacement for a proper backup solution.
To configure this structure, I will define the primary System partition as 100 gigabytes. The remaining available disk capacity will be assigned to the Data partition.
The first partition will therefore use 100 gigabytes and will be labeled System. The second partition will use the remaining capacity and will be labeled Data.
The Windows setup process will also create any required EFI, Microsoft Reserved, and recovery partitions needed for a GPT-based Windows 11 installation.
In the target disk assertion settings, we do not need to require that the target disk contains no existing partitions.
Make sure that this assertion option is not selected. If the target computer already contains partitions and the assertion is enabled, the installation may stop and ask how the existing partitions should be handled.
Because we want a fully unattended Windows deployment, we do not want the setup process to stop and wait for manual input.
You should also ensure that the target disk has enough capacity for the partition sizes specified in the answer file. In this example, the disk must have more than 100 gigabytes of usable capacity. Otherwise, the partitioning process may fail.
The remaining disk and partition settings can be left at their default values for this deployment.
Remember that this configuration can erase existing data on the selected target disk. Always verify the target disk number and back up any required information before starting the installation.
𝗖𝗢𝗡𝗙𝗜𝗚𝗨𝗥𝗜𝗡𝗚 𝗧𝗛𝗘 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝗣𝗥𝗢𝗗𝗨𝗖𝗧 𝗞𝗘𝗬
For the Windows edition and product key configuration, you can either enter the product key assigned to the target computer or use a generic installation key.
A generic Windows product key allows the selected Windows edition to be installed, but it does not activate Windows.
In this demonstration, I will use the option to install Windows 11 Pro with a generic product key. Windows activation can be completed later through the organization’s normal activation method.
The configuration is the same for Intel and AMD-based x64 processors. Because we are using a 64-bit Windows 11 installation, I will keep the architecture configured as 64-bit.
𝗕𝗬𝗣𝗔𝗦𝗦𝗜𝗡𝗚 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝟭𝟭 𝗛𝗔𝗥𝗗𝗪𝗔𝗥𝗘 𝗥𝗘𝗤𝗨𝗜𝗥𝗘𝗠𝗘𝗡𝗧𝗦
Windows 11 has several hardware requirements, including TPM 2.0 and Secure Boot.
The unattended answer file generator provides an option to bypass these Windows 11 hardware checks. I will enable this option for the demonstration.
Keep in mind that bypassing Microsoft’s Windows 11 hardware requirements may result in an unsupported configuration. It should be used only when you understand the operational, security, update, and support implications.
We can also allow Windows 11 to be installed without an active internet connection. I will enable this option so that the deployment can continue even when internet access is not available during setup.
𝗖𝗢𝗡𝗙𝗜𝗚𝗨𝗥𝗜𝗡𝗚 𝗧𝗛𝗘 𝗖𝗢𝗠𝗣𝗨𝗧𝗘𝗥 𝗡𝗔𝗠𝗘
For the computer name, we can define a fixed computer name or allow Windows Setup to generate a random name.
In our scenario, the final computer name will be assigned later by the custom PowerShell provisioning interface.
For that reason, I will allow Windows Setup to generate a temporary random computer name. The PowerShell script will rename the computer according to the selected deployment type, department, chassis type, and naming policy.
The remaining computer name settings can be left unchanged.
𝗖𝗢𝗡𝗙𝗜𝗚𝗨𝗥𝗜𝗡𝗚 𝗧𝗛𝗘 𝗧𝗜𝗠𝗘 𝗭𝗢𝗡𝗘
For the time zone, you can allow Windows to determine the appropriate setting from the selected language and region, or you can define the time zone explicitly.
In my environment, I will explicitly select the Istanbul time zone, which uses UTC+3.
𝗖𝗥𝗘𝗔𝗧𝗜𝗡𝗚 𝗔 𝗟𝗢𝗖𝗔𝗟 𝗔𝗗𝗠𝗜𝗡𝗜𝗦𝗧𝗥𝗔𝗧𝗢𝗥 𝗔𝗖𝗖𝗢𝗨𝗡𝗧
This section is important.
We need to create a local administrator account and define a password for it. When the custom PowerShell script runs during the first logon, it will use the administrative privileges of this account.
I will enter TechAdmin as the account name.
For the display name, I will use Tech Haptic Admin. I will define a password and add the account to the local Administrators group.
We do not need to create an additional standard user account, so I will remove any unnecessary user entries.
For the first logon settings, no additional user selection is required.
The generator also includes an option to obscure account passwords in the AutoUnattend.xml file by encoding them with Base64. I will enable this option so that the password is not displayed directly as ordinary clear text.
However, Base64 encoding is only obfuscation and is not secure encryption. Anyone with access to the answer file may still be able to recover the password. In a production environment, you should protect the installation media and consider rotating or disabling temporary deployment credentials after provisioning is complete.
We do not need to add a Microsoft account or another local user account, so those options will remain disabled.
For password expiration, I will select Password Does Not Expire for this deployment account.
We do not need to modify the account lockout policy, so the default Windows policy will remain in place.
𝗖𝗢𝗡𝗙𝗜𝗚𝗨𝗥𝗜𝗡𝗚 𝗙𝗜𝗟𝗘 𝗘𝗫𝗣𝗟𝗢𝗥𝗘𝗥 𝗔𝗡𝗗 𝗧𝗔𝗦𝗞𝗕𝗔𝗥 𝗦𝗘𝗧𝗧𝗜𝗡𝗚𝗦
The File Explorer customization options can be configured according to your organization’s requirements.
For this deployment, I will enable Always Show File Extensions. Displaying file extensions makes it easier for administrators and users to identify actual file types.
I will also enable the classic context menu in Windows 11. This restores the traditional right-click menu and provides faster access to commonly used administrative options.
For the Windows taskbar search option, I will configure the search box to appear as an icon only.
For the taskbar icon selection, I will keep the default icons.
𝗗𝗜𝗦𝗔𝗕𝗟𝗜𝗡𝗚 𝗪𝗜𝗗𝗚𝗘𝗧𝗦 𝗔𝗡𝗗 𝗪𝗘𝗕 𝗦𝗘𝗔𝗥𝗖𝗛 𝗥𝗘𝗦𝗨𝗟𝗧𝗦
We can disable Windows widgets, including the news and weather interface that appears on the Windows 11 taskbar. I believe disabling it is useful for a clean enterprise deployment, so I will enable this option.
We can also prevent web results from appearing when users search through the Start menu or Windows search box.
Because this deployment is focused on an enterprise environment, I will disable web-based search results.
The Windows 10-specific Start menu options do not apply to our Windows 11 installation, so we can skip those settings.
𝗥𝗘𝗠𝗢𝗩𝗜𝗡𝗚 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝟭𝟭 𝗦𝗧𝗔𝗥𝗧 𝗠𝗘𝗡𝗨 𝗣𝗜𝗡𝗦
For the Windows 11 Start menu, I will select the option to remove all default pinned applications.
We are going to remove several unwanted Windows applications from the operating system. Therefore, we do not want obsolete or removed application shortcuts to remain pinned in the Start menu.
This provides users with a cleaner Windows 11 Start menu after deployment.
𝗖𝗢𝗡𝗙𝗜𝗚𝗨𝗥𝗜𝗡𝗚 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝗦𝗬𝗦𝗧𝗘𝗠 𝗧𝗪𝗘𝗔𝗞𝗦
Under System Tweaks, I do not want to disable Windows Update, User Account Control, or Smart App Control.
These security and management components should remain enabled unless your organization has a specific technical reason to modify them.
We can optionally enable Remote Desktop Services so that authorized technicians can remotely connect to deployed computers. I will enable Remote Desktop for this demonstration.
You should still control Remote Desktop access through Windows Firewall, network segmentation, account permissions, Group Policy, and your organization’s security policies.
I will also allow the execution of PowerShell script files. This setting configures the PowerShell execution policy as RemoteSigned, which is sufficient for our deployment script.
We can hide the Microsoft Edge first-run experience so that the browser can be opened without displaying the initial configuration screens. I will enable this option.
The generator also includes an option to disable Core Isolation and virtualization-based security.
Disabling virtualization-based security may improve performance in certain environments, but it also disables security protections. You should evaluate this setting according to your organization’s security requirements.
For this isolated test environment, I will disable it. In a production environment, I would normally recommend keeping supported Windows security protections enabled unless there is a documented compatibility or performance requirement.
𝗖𝗢𝗡𝗙𝗜𝗚𝗨𝗥𝗜𝗡𝗚 𝗩𝗜𝗦𝗨𝗔𝗟 𝗘𝗙𝗙𝗘𝗖𝗧𝗦 𝗔𝗡𝗗 𝗗𝗘𝗦𝗞𝗧𝗢𝗣 𝗜𝗖𝗢𝗡𝗦
We do not need to modify the Windows visual effects for this deployment.
For the desktop icons, I will add This PC, Recycle Bin, and Control Panel. These icons are useful for users and support technicians who need quick access to system resources.
We do not need to make any changes to the Start menu folder options.
𝗩𝗜𝗥𝗧𝗨𝗔𝗟 𝗠𝗔𝗖𝗛𝗜𝗡𝗘 𝗔𝗡𝗗 𝗪𝗜-𝗙𝗜 𝗖𝗢𝗡𝗙𝗜𝗚𝗨𝗥𝗔𝗧𝗜𝗢𝗡
The generator includes options related to virtual machine support.
In most cases, we are not creating this image specifically for a virtualized environment, so I do not need to enable additional virtual machine settings.
In your environment, you can enable the appropriate options if the deployment will be used for virtual desktops or virtual machines.
The generator also allows you to configure a Wi-Fi network during installation. This can be useful when computers need to connect automatically to a company wireless network.
I do not need Wi-Fi configuration in this environment, so I will select the option to skip Wi-Fi setup.
We do not need to modify the Windows Express Settings.
We also do not need to change accessibility or keyboard options such as Sticky Keys.
As you can see, the unattended installation generator provides many additional settings. You can configure them according to the technical and security requirements of your organization.
We do not need to modify the personalization settings, so we will continue to the software removal section.
𝗗𝗘𝗕𝗟𝗢𝗔𝗧𝗜𝗡𝗚 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝟭𝟭 𝗕𝗬 𝗥𝗘𝗠𝗢𝗩𝗜𝗡𝗚 𝗨𝗡𝗪𝗔𝗡𝗧𝗘𝗗 𝗔𝗣𝗣𝗟𝗜𝗖𝗔𝗧𝗜𝗢𝗡𝗦
The software removal section is important because it allows us to debloat Windows 11 and create a cleaner operating system installation.
The applications I select may not be appropriate for every organization. The selections shown here are generally acceptable for my test environment, but you should review every item before removing it from your own Windows image.
Do not remove an application simply because it is included in this demonstration. Confirm that your users, business applications, support teams, and operational processes do not depend on it.
In this environment, I do not need components and applications such as the legacy Internet Explorer components, Mixed Reality, People, PowerShell 2.0, Tips, Wallet, Movies and TV, Solitaire, Weather, Xbox applications, Feedback Hub, Maps, Paint 3D, Skype, and Phone Link.
PowerShell 2.0 is an old and insecure version, so I do not want it enabled in this environment.
The standard Calculator and Paint applications are useful, so I will keep them.
I will select the unnecessary applications and components that can be safely removed from this specific Windows 11 installation.
Removing these applications reduces unnecessary Start menu entries and creates a cleaner desktop experience. However, the actual performance improvement may vary, and removing built-in applications should always be tested before being applied to production computers.
𝗖𝗢𝗡𝗙𝗜𝗚𝗨𝗥𝗜𝗡𝗚 𝗧𝗛𝗘 𝗙𝗜𝗥𝗦𝗧-𝗟𝗢𝗚𝗢𝗡 𝗣𝗢𝗪𝗘𝗥𝗦𝗛𝗘𝗟𝗟 𝗦𝗖𝗥𝗜𝗣𝗧
The generator provides several stages where custom scripts can be executed.
The earlier script sections are not the stages we want to use, so we will leave them empty.
We are also not running a script for every default user profile, so we will skip the Default User Scripts section.
The First Logon Scripts section is the stage we need.
The first user who logs on is normally an administrator. Scripts configured in this section can therefore run with elevated administrative privileges.
This is exactly what we need because our PowerShell script must display a graphical provisioning interface and perform administrative actions such as renaming the computer, joining the Active Directory domain, moving the computer into the selected organizational unit, and installing enterprise applications.
Make sure that the CMD script type is selected.
I will copy the required command into this section. The command launches our PowerShell provisioning script during the first administrator logon.
I will share the PowerShell script separately so that you can review and customize it according to your own organizational unit structure, domain name, computer naming convention, departments, and application requirements.
We do not need to configure an application control policy in this section.
Also, make sure that the Use Filename Rather Than option remains unchecked. Enabling that option would only change how the XML file is named, which is not what we want in this deployment.
After completing the configuration, click Download XML File to save the generated AutoUnattend.xml file to the computer.
𝗖𝗥𝗘𝗔𝗧𝗜𝗡𝗚 𝗧𝗛𝗘 𝗣𝗢𝗪𝗘𝗥𝗦𝗛𝗘𝗟𝗟 𝗣𝗥𝗢𝗩𝗜𝗦𝗜𝗢𝗡𝗜𝗡𝗚 𝗦𝗖𝗥𝗜𝗣𝗧
I assume that AnyBurn has already been downloaded and installed.
Before editing the Windows 11 ISO, we need to create the PowerShell provisioning script.
Create a new PowerShell script file and give it the exact filename expected by the first-logon command in the unattended answer file.
In this demonstration, the script is named TechHaptic-Provisioning.ps1.
Paste the provisioning code into the file and save it.
The filename in the AutoUnattend.xml command and the actual PowerShell script filename must match exactly. Otherwise, the script will not run during the first logon.
𝗔𝗗𝗗𝗜𝗡𝗚 𝗔𝗨𝗧𝗢𝗨𝗡𝗔𝗧𝗧𝗘𝗡𝗗.𝗫𝗠𝗟 𝗔𝗡𝗗 𝗣𝗢𝗪𝗘𝗥𝗦𝗛𝗘𝗟𝗟 𝗧𝗢 𝗧𝗛𝗘 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝟭𝟭 𝗜𝗦𝗢
Open AnyBurn.
From the available options, select Edit Image File.
Choose the original Windows 11 ISO file that we downloaded from Microsoft.
We now need to add two files to the ISO image:
The AutoUnattend.xml answer file and the TechHaptic-Provisioning.ps1 PowerShell script.
Click Add and select both files from the location where they were saved.
Make sure that both files are placed in the root directory of the Windows 11 ISO. Do not place them inside another folder.
Windows Setup searches for AutoUnattend.xml in specific locations, including the root of the installation media. Placing the file in the wrong directory may prevent the unattended installation from starting.
After adding the files, click Next.
Give the new ISO an appropriate name. In this example, I will name it Windows 11 Tech Haptic Light Touch.
Click Create.
AnyBurn will now create a new Windows 11 ISO containing the AutoUnattend.xml answer file and our PowerShell provisioning script.
When the operation is complete, click Exit.
As you can see, the customized Windows 11 ISO file has been created successfully.
𝗣𝗥𝗘𝗣𝗔𝗥𝗜𝗡𝗚 𝗧𝗛𝗘 𝗔𝗖𝗧𝗜𝗩𝗘 𝗗𝗜𝗥𝗘𝗖𝗧𝗢𝗥𝗬 𝗧𝗘𝗦𝗧 𝗘𝗡𝗩𝗜𝗥𝗢𝗡𝗠𝗘𝗡𝗧
Now, let’s return to the virtualization environment.
I previously created an Active Directory domain and prepared the required organizational unit structure.
The main organizational unit is named Tech Haptic.
Under the main organizational unit, I created three location-based organizational units:
Istanbul, London, and Montreal.
Under each location, I created separate Computers and Users organizational units.
The PowerShell script uses the location selected in the provisioning interface to determine the correct target organizational unit for the new computer account.
I also configured the required DNS settings so that the new Windows 11 computer can locate the domain controller and communicate with Active Directory.
The virtual machine is connected to the same network as the domain controller. When the required selections and domain credentials are entered in the PowerShell interface, the computer can automatically join the Active Directory domain.
I created a 250-gigabyte virtual hard disk and assigned suitable processor and memory resources to the virtual machine.
The only remaining step is to replace the virtual machine’s existing installation media with the customized Windows 11 ISO.
I will open the virtual machine settings and select the newly created ISO file.
Click OK to save the configuration.
Now, let’s start the virtual machine and begin the Windows 11 installation.
𝗥𝗨𝗡𝗡𝗜𝗡𝗚 𝗧𝗛𝗘 𝗭𝗘𝗥𝗢-𝗧𝗢𝗨𝗖𝗛 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝟭𝟭 𝗜𝗡𝗦𝗧𝗔𝗟𝗟𝗔𝗧𝗜𝗢𝗡
I will fast-forward the installation as much as possible, but I also want you to see the actions being performed automatically on the computer.
The installation is running inside a virtualized test environment. Depending on your physical or virtual hardware, the installation time and behavior may be different.
Windows Setup reads the AutoUnattend.xml file, creates the disk partitions, installs Windows 11 Pro, applies the selected regional and system settings, creates the local administrator account, removes the selected Windows components, and completes the initial setup without requiring manual interaction.
The first phase has now been completed as a zero-touch Windows 11 deployment.
𝗨𝗦𝗜𝗡𝗚 𝗧𝗛𝗘 𝗣𝗢𝗪𝗘𝗥𝗦𝗛𝗘𝗟𝗟 𝗣𝗥𝗢𝗩𝗜𝗦𝗜𝗢𝗡𝗜𝗡𝗚 𝗚𝗨𝗜
As you can see, the PowerShell script is running.
Behind the Start menu, you can see the graphical user interface created by the script.
The interface contains two main network deployment options:
Workgroup and Active Directory.
If we select Workgroup, we only need to select the applications that should be installed on the operating system. The script will keep the device in a workgroup and assign a computer name based on the detected chassis type and a random four-digit identifier.
For this demonstration, however, we will use the Active Directory option.
I will select Active Directory.
𝗦𝗘𝗟𝗘𝗖𝗧𝗜𝗡𝗚 𝗧𝗛𝗘 𝗟𝗢𝗖𝗔𝗧𝗜𝗢𝗡 𝗔𝗡𝗗 𝗗𝗘𝗣𝗔𝗥𝗧𝗠𝗘𝗡𝗧
For the location, we have the three locations that were configured in the script:
Istanbul, London, and Montreal.
I will select Istanbul.
For the department, we have defined four department options. We can select any available department according to the computer’s intended use.
For this demonstration, I will select Human Resources.
The selected department will become part of the computer naming convention.
𝗦𝗘𝗟𝗘𝗖𝗧𝗜𝗡𝗚 𝗘𝗡𝗧𝗘𝗥𝗣𝗥𝗜𝗦𝗘 𝗔𝗣𝗣𝗟𝗜𝗖𝗔𝗧𝗜𝗢𝗡𝗦 𝗙𝗢𝗥 𝗪𝗜𝗡𝗚𝗘𝗧 𝗜𝗡𝗦𝗧𝗔𝗟𝗟𝗔𝗧𝗜𝗢𝗡
The Enterprise Applications section contains three example applications.
In your own environment, this list may contain many more applications.
The available applications can be changed by modifying the PowerShell script and defining the appropriate WinGet package identifiers.
For this demonstration, I will select Google Chrome and Adobe Acrobat Reader.
The script will install these applications automatically in the background through WinGet.
𝗘𝗡𝗧𝗘𝗥𝗜𝗡𝗚 𝗔𝗖𝗧𝗜𝗩𝗘 𝗗𝗜𝗥𝗘𝗖𝗧𝗢𝗥𝗬 𝗗𝗢𝗠𝗔𝗜𝗡 𝗖𝗥𝗘𝗗𝗘𝗡𝗧𝗜𝗔𝗟𝗦
To join the computer to the Active Directory domain, we need to provide credentials for an account that has permission to add computers to the domain and create or move the computer account into the selected organizational unit.
I will enter the domain username and password.
In a production environment, avoid using a highly privileged Domain Administrator account for routine computer joins. A delegated service or deployment account with only the required permissions is a safer approach.
After entering the credentials, I will click Start Provisioning.
𝗥𝗘𝗡𝗔𝗠𝗜𝗡𝗚 𝗧𝗛𝗘 𝗖𝗢𝗠𝗣𝗨𝗧𝗘𝗥 𝗔𝗡𝗗 𝗝𝗢𝗜𝗡𝗜𝗡𝗚 𝗧𝗛𝗘 𝗔𝗖𝗧𝗜𝗩𝗘 𝗗𝗜𝗥𝗘𝗖𝗧𝗢𝗥𝗬 𝗗𝗢𝗠𝗔𝗜𝗡
We expect the computer account to be created under the Istanbul organizational unit and inside its Computers sub-organizational unit.
We also expect the computer name to follow the predefined naming convention.
The script determines the department prefix from the selected department. Because Human Resources was selected, the computer name begins with HR.
The script also runs a WMI query to identify the chassis type.
If the target device is detected as a desktop computer, the script adds the PC identifier to the computer name. If it is detected as a laptop, the script uses the LAP identifier.
Finally, the script appends a randomly generated four-digit number.
The resulting computer name therefore includes the department, device type, and random identifier.
The PowerShell script renames the computer, joins it to the Active Directory domain, places it in the selected organizational unit, and installs the selected applications.
When the provisioning operation is complete, the computer must restart so that the new computer name and Active Directory domain membership can take effect.
The process has completed successfully.
Click OK.
The computer is now restarting.
𝗩𝗘𝗥𝗜𝗙𝗬𝗜𝗡𝗚 𝗧𝗛𝗘 𝗖𝗢𝗠𝗣𝗨𝗧𝗘𝗥 𝗔𝗖𝗖𝗢𝗨𝗡𝗧 𝗜𝗡 𝗔𝗖𝗧𝗜𝗩𝗘 𝗗𝗜𝗥𝗘𝗖𝗧𝗢𝗥𝗬
Let’s check Active Directory and confirm whether the computer account was created.
I will open the Istanbul organizational unit and refresh the Computers organizational unit.
As you can see, the computer account was created successfully and follows the predefined naming convention.
The HR prefix represents the Human Resources department.
The PC identifier was assigned because the WMI query detected the device as a desktop computer. If the device had been detected as a laptop, the computer name would contain LAP instead.
The final four digits were assigned randomly by the PowerShell script.
The computer account was also created in the correct Istanbul organizational unit.
This confirms that the PowerShell script successfully renamed the computer, joined it to Active Directory, and placed the computer account in the selected OU.
𝗩𝗘𝗥𝗜𝗙𝗬𝗜𝗡𝗚 𝗧𝗛𝗘 𝗖𝗢𝗠𝗣𝗨𝗧𝗘𝗥 𝗡𝗔𝗠𝗘 𝗔𝗡𝗗 𝗗𝗢𝗠𝗔𝗜𝗡 𝗠𝗘𝗠𝗕𝗘𝗥𝗦𝗛𝗜𝗣
Now, let’s return to the Windows 11 computer.
Press Ctrl+Alt+Delete and sign in with an authorized account.
After logging in, we can check the computer name and domain membership.
As you can see, the device has been renamed successfully and is joined to the Active Directory domain.
The system is no longer operating as a standalone workgroup computer.
𝗩𝗘𝗥𝗜𝗙𝗬𝗜𝗡𝗚 𝗧𝗛𝗘 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝟭𝟭 𝗗𝗜𝗦𝗞 𝗣𝗔𝗥𝗧𝗜𝗧𝗜𝗢𝗡𝗦
Let’s check the disk partitions.
As you can see, the unattended Windows installation created the System and Data partitions.
The System partition is assigned to the C drive and has approximately 100 gigabytes of capacity.
The remaining available disk capacity was assigned to the Data partition on the D drive.
This confirms that the custom GPT disk partitioning configuration in the AutoUnattend.xml file was applied successfully.
𝗩𝗘𝗥𝗜𝗙𝗬𝗜𝗡𝗚 𝗧𝗛𝗘 𝗪𝗜𝗡𝗚𝗘𝗧 𝗔𝗣𝗣𝗟𝗜𝗖𝗔𝗧𝗜𝗢𝗡 𝗜𝗡𝗦𝗧𝗔𝗟𝗟𝗔𝗧𝗜𝗢𝗡𝗦
Finally, let’s check the installed applications.
As you can see, Google Chrome and Adobe Acrobat Reader were installed successfully.
We can also confirm the installations from the Windows installed applications interface or Programs and Features.
This confirms that the PowerShell provisioning script processed the application selections correctly and installed the selected enterprise applications through WinGet.
𝗖𝗢𝗡𝗖𝗟𝗨𝗦𝗜𝗢𝗡
We have now completed an advanced Windows 11 unattended installation using AutoUnattend.xml and PowerShell.
The deployment automatically configured Windows Setup, created GPT disk partitions, installed Windows 11 Pro, bypassed the selected setup requirements, created a local administrator account, applied Windows customizations, removed unwanted applications, and launched a custom PowerShell provisioning interface.
Through the PowerShell GUI, we selected whether the computer should remain in a workgroup or join an Active Directory domain. We dynamically assigned the location, department, organizational unit, computer name, and enterprise applications.
The computer was then renamed, joined to Active Directory, placed in the correct organizational unit, and provisioned with Google Chrome and Adobe Acrobat Reader through WinGet.
This approach gives us a reusable Windows 11 deployment foundation that can be adapted to different offices, departments, device types, Active Directory structures, naming standards, and application requirements.
I hope this video was useful.
Thank you for watching, and I will see you in the next video.
Goodbye.