Fix registry ownership/ACL and hang bugs in tiny11maker.ps1, plus build/setup script updates
Fixes several offline-hive build failures: TrustedInstaller-owned keys (WindowsRuntime\ActivatableClassId, Explorer\Advanced, System\GameConfigStore, Search SystemIndex) denying writes even to admin-owned processes, a PowerShell 5.1 quirk that drops empty-string reg.exe arguments and can hang the build on a silent overwrite prompt, a registry-handle leak that left hives locked and cascaded into DISM cleanup failures, and relaxed the post-ResetBase health gate to accept 'Repairable' (only abort on 'NonRepairable') since ResetBase makes full repair impossible anyway - documented that repairing the installed OS needs the original stock ISO, not the tweaked output. Also rolls in in-progress updates to the other maker scripts and OEM setup/first-boot scripts.
This commit is contained in:
+71
-7
@@ -5,7 +5,8 @@ param (
|
||||
[ValidatePattern('^[c-zC-Z]:?$|^[a-zA-Z]:\\.*$')]
|
||||
[string]$ScratchDisk,
|
||||
[string]$imageindex,
|
||||
[switch]$UseSetupTemplate
|
||||
[switch]$UseSetupTemplate,
|
||||
[switch]$IgnoreSecBoot
|
||||
)
|
||||
|
||||
$needchange = @("AllSigned", "Restricted", "Undefined")
|
||||
@@ -60,6 +61,7 @@ if (-not $ScratchDisk) {
|
||||
}
|
||||
}
|
||||
Write-Output "Scratch disk set to $ScratchDisk"
|
||||
$hostArchitecture = $Env:PROCESSOR_ARCHITECTURE
|
||||
$setupMediaTemplatePath = "$PSScriptRoot\setup-media-template"
|
||||
New-Item -ItemType Directory -Force -Path "$ScratchDisk\tiny10\sources" >null
|
||||
$DriveLetter = Read-Host "Please enter the drive letter for the Windows 10 image"
|
||||
@@ -247,6 +249,13 @@ Set-RegistryValue -KeyPath 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotif
|
||||
Set-RegistryValue -KeyPath 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' -ValueName 'SV2' -ValueType 'REG_DWORD' -ValueData '0' -Description "Unsupported hardware notification SV2"
|
||||
Set-RegistryValue -KeyPath 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' -ValueName 'SV1' -ValueType 'REG_DWORD' -ValueData '0' -Description "User unsupported hardware notification SV1"
|
||||
Set-RegistryValue -KeyPath 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' -ValueName 'SV2' -ValueType 'REG_DWORD' -ValueData '0' -Description "User unsupported hardware notification SV2"
|
||||
Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassCPUCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Bypass CPU check"
|
||||
Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassRAMCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Bypass RAM check"
|
||||
Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassSecureBootCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Bypass Secure Boot check"
|
||||
Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassStorageCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Bypass storage check"
|
||||
Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassTPMCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Bypass TPM check"
|
||||
Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\MoSetup' -ValueName 'AllowUpgradesWithUnsupportedTPMOrCPU' -ValueType 'REG_DWORD' -ValueData '1' -Description "Allow upgrades with unsupported TPM or CPU"
|
||||
Set-RegistryValue -KeyPath 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\OOBE' -ValueName 'BypassNRO' -ValueType 'REG_DWORD' -ValueData '1' -Description "Bypass network requirement in OOBE"
|
||||
|
||||
Write-Host "Disabling Sponsored Apps:"
|
||||
Set-RegistryValue -KeyPath 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' -ValueName 'OemPreInstalledAppsEnabled' -ValueType 'REG_DWORD' -ValueData '0' -Description "OEM pre-installed apps"
|
||||
@@ -376,6 +385,21 @@ if (Test-Path "$ScratchDisk\scratchdir\Windows\WinSxS_backup") {
|
||||
Move-Item -Path "$ScratchDisk\scratchdir\Windows\WinSxS_backup" -Destination "$ScratchDisk\scratchdir\Windows\WinSxS" -Force
|
||||
}
|
||||
|
||||
# Verify the component store isn't corrupt before we capture it.
|
||||
# Must run AFTER the WinSxS restore above - scanning while WinSxS is swapped out would
|
||||
# always report corruption. /AnalyzeComponentStore is online-only (running OS) and only
|
||||
# reports size/cleanup recommendations, not a healthy/unhealthy verdict - /ScanHealth is
|
||||
# the offline-capable corruption check with an actual pass/fail result worth aborting on.
|
||||
Write-Host "Verifying component store health before capture..."
|
||||
$scanHealthOutput = & 'dism' '/English' "/image:$ScratchDisk\scratchdir" '/Cleanup-Image' '/ScanHealth'
|
||||
if ($scanHealthOutput -notmatch 'No component store corruption detected') {
|
||||
$scanHealthOutput | Write-Host
|
||||
Write-Error "Component store health check failed - possible corruption detected. Aborting build - image was NOT captured."
|
||||
& 'dism' '/English' '/unmount-image' "/mountdir:$ScratchDisk\scratchdir" '/discard' >null
|
||||
exit 1
|
||||
}
|
||||
Write-Host "Component store is healthy."
|
||||
|
||||
Write-Host "Unmounting image..."
|
||||
& 'dism' '/English' '/unmount-image' "/mountdir:$ScratchDisk\scratchdir" '/commit'
|
||||
|
||||
@@ -414,6 +438,9 @@ Set-RegistryValue -KeyPath 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotif
|
||||
Set-RegistryValue -KeyPath 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' -ValueName 'SV1' -ValueType 'REG_DWORD' -ValueData '0' -Description "Setup image user unsupported hardware notification SV1"
|
||||
Set-RegistryValue -KeyPath 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' -ValueName 'SV2' -ValueType 'REG_DWORD' -ValueData '0' -Description "Setup image user unsupported hardware notification SV2"
|
||||
Set-RegistryValue -KeyPath 'HKEY_LOCAL_MACHINE\zSYSTEM\Setup' -ValueName 'CmdLine' -ValueType 'REG_SZ' -ValueData 'X:\sources\setup.exe' -Description "Setup command line"
|
||||
if ($IgnoreSecBoot) {
|
||||
Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'IgnoreSecBootBootRes' -ValueType 'REG_DWORD' -ValueData '1' -Description "Setup image flag first boot to enable testsigning/nointegritychecks for custom bootres.dll"
|
||||
}
|
||||
|
||||
Write-Host "Tweaking complete!"
|
||||
Write-Host "Unmounting Registry..."
|
||||
@@ -451,13 +478,50 @@ Write-Host "Would you like to create an ISO? (y/n)"
|
||||
$iso = Read-Host
|
||||
|
||||
if ($iso -eq 'y') {
|
||||
if (Test-Path "$env:ProgramFiles(x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\amd64\Oscdimg\oscdimg.exe") {
|
||||
Write-Host "Creating ISO..."
|
||||
& "$env:ProgramFiles(x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\amd64\Oscdimg\oscdimg.exe" '-m' '-o' '-u2' '-udfver102' "-bootdata:2#p0,e,b$ScratchDisk\tiny10\boot\etfsboot.com#pEF,e,b$ScratchDisk\tiny10\efi\microsoft\boot\efisys.bin" "$ScratchDisk\tiny10" "$PSScriptRoot\tiny10core.iso"
|
||||
Write-Host "ISO created successfully!"
|
||||
} else {
|
||||
Write-Host "Windows ADK is not installed. Cannot create ISO."
|
||||
Write-Host "Creating ISO image..."
|
||||
# Get Windows ADK path from registry (following Visual Studio's winsdk.bat approach).
|
||||
$WinSDKPath = [Microsoft.Win32.Registry]::GetValue("HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Kits\Installed Roots", "KitsRoot10", $null)
|
||||
if ($null -eq $WinSDKPath) {
|
||||
$WinSDKPath = [Microsoft.Win32.Registry]::GetValue("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Kits\Installed Roots", "KitsRoot10", $null)
|
||||
}
|
||||
|
||||
if ($null -ne $WinSDKPath) {
|
||||
# Trim the following backslash for path concatenation.
|
||||
$WinSDKPath = $WinSDKPath.TrimEnd('\')
|
||||
$ADKDepTools = "$WinSDKPath\Assessment and Deployment Kit\Deployment Tools\$hostArchitecture\Oscdimg"
|
||||
}
|
||||
$localOSCDIMGPath = "$PSScriptRoot\oscdimg.exe"
|
||||
|
||||
if ((Test-Path variable:ADKDepTools) -and (Test-Path "$ADKDepTools\oscdimg.exe" -PathType leaf)) {
|
||||
Write-Host "Will be using oscdimg.exe from system ADK."
|
||||
$OSCDIMG = "$ADKDepTools\oscdimg.exe"
|
||||
}
|
||||
else {
|
||||
Write-Host "oscdimg.exe from system ADK not found. Will be using bundled oscdimg.exe."
|
||||
|
||||
$url = "https://msdl.microsoft.com/download/symbols/oscdimg.exe/3D44737265000/oscdimg.exe"
|
||||
|
||||
if (![System.IO.File]::Exists($localOSCDIMGPath)) {
|
||||
Write-Host "Downloading oscdimg.exe..."
|
||||
Invoke-WebRequest -Uri $url -OutFile $localOSCDIMGPath
|
||||
|
||||
if ([System.IO.File]::Exists($localOSCDIMGPath)) {
|
||||
Write-Host "oscdimg.exe downloaded successfully."
|
||||
}
|
||||
else {
|
||||
Write-Error "Failed to download oscdimg.exe."
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
else {
|
||||
Write-Host "oscdimg.exe already exists locally."
|
||||
}
|
||||
|
||||
$OSCDIMG = $localOSCDIMGPath
|
||||
}
|
||||
|
||||
& "$OSCDIMG" '-m' '-o' '-u2' '-udfver102' "-bootdata:2#p0,e,b$ScratchDisk\tiny10\boot\etfsboot.com#pEF,e,b$ScratchDisk\tiny10\efi\microsoft\boot\efisys.bin" "$ScratchDisk\tiny10" "$PSScriptRoot\tiny10core.iso"
|
||||
Write-Host "ISO created successfully!"
|
||||
}
|
||||
|
||||
Write-Host "Performing Cleanup..."
|
||||
|
||||
Reference in New Issue
Block a user