oxmc/windows-builder
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix registry ownership/ACL and hang bugs in tiny11maker.ps1, plus build/setup script updates

Browse Source 
Fixes several offline-hive build failures: TrustedInstaller-owned keys
(WindowsRuntime\ActivatableClassId, Explorer\Advanced, System\GameConfigStore, Search
SystemIndex) denying writes even to admin-owned processes, a PowerShell 5.1 quirk that drops
empty-string reg.exe arguments and can hang the build on a silent overwrite prompt, a
registry-handle leak that left hives locked and cascaded into DISM cleanup failures, and
relaxed the post-ResetBase health gate to accept 'Repairable' (only abort on
'NonRepairable') since ResetBase makes full repair impossible anyway - documented that
repairing the installed OS needs the original stock ISO, not the tweaked output. Also
rolls in in-progress updates to the other maker scripts and OEM setup/first-boot scripts.
This commit is contained in:
oxmc
2026-07-31 06:09:58 -07:00
parent 26c397fb95
commit d38cd32b82
16 changed files with 1477 additions and 220 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tiny11Coremaker.ps1
+23 -1
View File
@@ -5,7 +5,8 @@ param (
[ValidatePattern('^[c-zC-Z]:?$|^[a-zA-Z]:\\.*$')]
[string]$ScratchDisk,
[string]$imageindex,
[switch]$UseSetupTemplate
[switch]$UseSetupTemplate,
[switch]$IgnoreSecBoot
)
$needchange = @("AllSigned", "Restricted", "Undefined")
@@ -421,6 +422,9 @@ Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassSecu
Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassStorageCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Bypass storage check"
Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassTPMCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Bypass TPM check"
Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\MoSetup' -ValueName 'AllowUpgradesWithUnsupportedTPMOrCPU' -ValueType 'REG_DWORD' -ValueData '1' -Description "Allow upgrades with unsupported TPM or CPU"
if ($IgnoreSecBoot) {
Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'IgnoreSecBootBootRes' -ValueType 'REG_DWORD' -ValueData '1' -Description "Flag first boot to enable testsigning/nointegritychecks for custom bootres.dll"
}
Write-Host "Disabling Sponsored Apps:"
Set-RegistryValue -KeyPath 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' -ValueName 'OemPreInstalledAppsEnabled' -ValueType 'REG_DWORD' -ValueData '0' -Description "OEM pre-installed apps"
Set-RegistryValue -KeyPath 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' -ValueName 'PreInstalledAppsEnabled' -ValueType 'REG_DWORD' -ValueData '0' -Description "Pre-installed apps"
@@ -780,6 +784,21 @@ Write-Host "Cleaning up image..."
& 'dism' '/English' "/image:$ScratchDisk\scratchdir" '/Cleanup-Image' '/StartComponentCleanup' '/ResetBase' >null
Write-Host "Cleanup complete."
Write-Host ' '
# Verify the component store isn't corrupt before we capture it.
# /AnalyzeComponentStore is online-only (running OS) and only reports size/cleanup
# recommendations, not a healthy/unhealthy verdict - /ScanHealth is the offline-capable
# corruption check with an actual pass/fail result worth aborting the build on.
Write-Host "Verifying component store health before capture..."
$scanHealthOutput = & 'dism' '/English' "/image:$ScratchDisk\scratchdir" '/Cleanup-Image' '/ScanHealth'
if ($scanHealthOutput -notmatch 'No component store corruption detected') {
$scanHealthOutput | Write-Host
Write-Error "Component store health check failed - possible corruption detected. Aborting build - image was NOT captured."
& 'dism' '/English' '/unmount-image' "/mountdir:$ScratchDisk\scratchdir" '/discard' >null
exit 1
}
Write-Host "Component store is healthy."
Write-Host "Unmounting image..."
& 'dism' '/English' '/unmount-image' "/mountdir:$ScratchDisk\scratchdir" '/commit'
Write-Host "Exporting image..."
@@ -812,6 +831,9 @@ Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassSecu
Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassStorageCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Setup image bypass storage check"
Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassTPMCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Setup image bypass TPM check"
Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\MoSetup' -ValueName 'AllowUpgradesWithUnsupportedTPMOrCPU' -ValueType 'REG_DWORD' -ValueData '1' -Description "Setup image allow upgrades with unsupported TPM or CPU"
if ($IgnoreSecBoot) {
Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'IgnoreSecBootBootRes' -ValueType 'REG_DWORD' -ValueData '1' -Description "Setup image flag first boot to enable testsigning/nointegritychecks for custom bootres.dll"
}
Set-RegistryValue -KeyPath 'HKEY_LOCAL_MACHINE\zSYSTEM\Setup' -ValueName 'CmdLine' -ValueType 'REG_SZ' -ValueData 'X:\sources\setup.exe' -Description "Setup command line"
Write-Host "Tweaking complete!"
Write-Host "Unmounting Registry..."