From 05a44af161c38f32b50d9fbc24b3075b6cdd72f2 Mon Sep 17 00:00:00 2001
From: nocode <suzuku295@gmail.com>
Date: Wed, 8 Jul 2026 23:57:28 +0200
Subject: [PATCH] feat(gameboot-windows): add windows 11 offline unattend
 answer file template

Add unattend.offline.xml.tmpl for Windows 11 deployment via fws-windows-deploy.

This offline answer file handles specialize and oobeSystem passes after wimlib
image application. It configures:
- Computer name and locale settings
- BitLocker and OOBE registry tweaks
- Local admin gaming account with temporary auto-login
- FirstBoot PowerShell script execution

Tokens (__HOSTNAME__, __USER__, __DISPLAY__, __LOCALE__, __INPUT__,
__FIRSTBOOT__) are substituted by fws-windows-deploy via sed.
---
 .../unattend.offline.xml.tmpl                 | 95 +++++++++++++++++++
 1 file changed, 95 insertions(+)
 create mode 100644 configs/releng/airootfs/usr/local/share/fws/gameboot-windows/unattend.offline.xml.tmpl

diff --git a/configs/releng/airootfs/usr/local/share/fws/gameboot-windows/unattend.offline.xml.tmpl b/configs/releng/airootfs/usr/local/share/fws/gameboot-windows/unattend.offline.xml.tmpl
new file mode 100644
index 0000000..9f10138
--- /dev/null
+++ b/configs/releng/airootfs/usr/local/share/fws/gameboot-windows/unattend.offline.xml.tmpl
@@ -0,0 +1,95 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  FWS — answer file OFFLINE pour Windows 11, deploye a \Windows\Panther\unattend.xml
+  par fws-windows-deploy APRES l'application de install.wim (wimlib). Setup NE
+  TOURNE JAMAIS : pas de passe windowsPE, pas de DiskConfiguration (la partition
+  cible est adressee cote Linux par PARTLABEL). Seuls specialize + oobeSystem
+  s'executent au 1er boot de l'image generalisee.
+
+  Tokens substitues par sed (fws-windows-deploy) :
+    __HOSTNAME__  __USER__  __DISPLAY__  __LOCALE__  __INPUT__  __FIRSTBOOT__
+  Compte gaming LOCAL admin SANS mot de passe (contrat auto-login) — JAMAIS nomme
+  'Administrator' (25H2 le confond avec le compte integre). AutoLogon temporaire
+  (LogonCount) survit au reboot Vanguard le temps que FirstBoot pose l'auto-login
+  permanent (Winlogon) via Install-FwsGameboot.
+-->
+<unattend xmlns="urn:schemas-microsoft-com:unattend">
+
+  <settings pass="specialize">
+    <component name="Microsoft-Windows-Shell-Setup"
+               processorArchitecture="amd64"
+               language="neutral"
+               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
+               versionScope="nonSxS">
+      <ComputerName>__HOSTNAME__</ComputerName>
+    </component>
+    <component name="Microsoft-Windows-Deployment"
+               processorArchitecture="amd64"
+               language="neutral"
+               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
+               versionScope="nonSxS">
+      <RunSynchronous>
+        <!-- Ceintures (doublons du reg offline hivex de fws-windows-deploy). -->
+        <RunSynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Path>reg add "HKLM\SYSTEM\CurrentControlSet\Control\BitLocker" /v PreventDeviceEncryption /t REG_DWORD /d 1 /f</Path>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>2</Order>
+          <Path>reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f</Path>
+        </RunSynchronousCommand>
+      </RunSynchronous>
+    </component>
+  </settings>
+
+  <settings pass="oobeSystem">
+    <component name="Microsoft-Windows-International-Core"
+               processorArchitecture="amd64"
+               language="neutral"
+               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
+               versionScope="nonSxS">
+      <InputLocale>__INPUT__</InputLocale>
+      <SystemLocale>__LOCALE__</SystemLocale>
+      <!-- Pas de <UILanguage> : une install.wim mono-langue (en-US) n'a pas le
+           pack UI __LOCALE__ → le forcer casse specialize. On garde en-US pour l'UI. -->
+      <UserLocale>__LOCALE__</UserLocale>
+    </component>
+    <component name="Microsoft-Windows-Shell-Setup"
+               processorArchitecture="amd64"
+               language="neutral"
+               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
+               versionScope="nonSxS">
+      <OOBE>
+        <HideEULAPage>true</HideEULAPage>
+        <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
+        <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
+        <HideLocalAccountScreen>true</HideLocalAccountScreen>
+        <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
+        <ProtectYourPC>3</ProtectYourPC>
+      </OOBE>
+      <UserAccounts>
+        <LocalAccounts>
+          <LocalAccount wcm:action="add">
+            <Name>__USER__</Name>
+            <DisplayName>__DISPLAY__</DisplayName>
+            <Group>Administrators</Group>
+            <!-- PAS de <Password> : compte sans mot de passe (contrat auto-login FWS). -->
+          </LocalAccount>
+        </LocalAccounts>
+      </UserAccounts>
+      <AutoLogon>
+        <Enabled>true</Enabled>
+        <Username>__USER__</Username>
+        <LogonCount>5</LogonCount>
+      </AutoLogon>
+      <FirstLogonCommands>
+        <SynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Description>FWS Gameboot first boot</Description>
+          <CommandLine>powershell.exe -NoProfile -ExecutionPolicy Bypass -File "__FIRSTBOOT__"</CommandLine>
+        </SynchronousCommand>
+      </FirstLogonCommands>
+    </component>
+  </settings>
+
+</unattend>