oxmc
d38cd32b82
Fixes several offline-hive build failures: TrustedInstaller-owned keys (WindowsRuntime\ActivatableClassId, Explorer\Advanced, System\GameConfigStore, Search SystemIndex) denying writes even to admin-owned processes, a PowerShell 5.1 quirk that drops empty-string reg.exe arguments and can hang the build on a silent overwrite prompt, a registry-handle leak that left hives locked and cascaded into DISM cleanup failures, and relaxed the post-ResetBase health gate to accept 'Repairable' (only abort on 'NonRepairable') since ResetBase makes full repair impossible anyway - documented that repairing the installed OS needs the original stock ISO, not the tweaked output. Also rolls in in-progress updates to the other maker scripts and OEM setup/first-boot scripts.
38 lines
1.5 KiB
PowerShell
38 lines
1.5 KiB
PowerShell
# Check PowerShell version for use in path
|
|
if ($PSVersionTable.PSVersion.Major -ge 3) {
|
|
$currentDir = $PSScriptRoot
|
|
}
|
|
else {
|
|
$currentDir = (Get-Item .).FullName
|
|
}
|
|
|
|
# Only run if the maker script flagged this build with -IgnoreSecBoot
|
|
$labConfigPath = "HKLM:\SYSTEM\Setup\LabConfig"
|
|
$flag = Get-ItemProperty -Path $labConfigPath -Name "IgnoreSecBootBootRes" -ErrorAction SilentlyContinue
|
|
|
|
if (-not $flag -or $flag.IgnoreSecBootBootRes -ne 1) {
|
|
return
|
|
}
|
|
|
|
Write-Output "IgnoreSecBootBootRes flag set - checking Secure Boot state before touching BCD..."
|
|
|
|
# Confirm-SecureBootUEFI throws on legacy BIOS / non-UEFI firmware - no Secure Boot to worry about there
|
|
$secureBootOn = $false
|
|
try {
|
|
$secureBootOn = Confirm-SecureBootUEFI
|
|
}
|
|
catch {
|
|
Write-Output "Confirm-SecureBootUEFI unavailable (legacy BIOS/non-UEFI) - Secure Boot not applicable, proceeding."
|
|
$secureBootOn = $false
|
|
}
|
|
|
|
if ($secureBootOn) {
|
|
Write-Warning "Secure Boot is ENABLED - skipping testsigning/nointegritychecks. Windows ignores both settings while Secure Boot is on, and forcing them here would do nothing but risk an inconsistent BCD. Disable Secure Boot in UEFI firmware, then re-run this script (`"$PSCommandPath`") manually to apply the settings - it only runs automatically once, during setup."
|
|
return
|
|
}
|
|
|
|
& bcdedit /set '{current}' testsigning on | Out-Null
|
|
& bcdedit /set '{current}' nointegritychecks on | Out-Null
|
|
|
|
Write-Output "testsigning/nointegritychecks enabled - Secure Boot was off, so this should take effect on next reboot."
|