<?xml version="1.0" encoding="utf-8"?>
<!--
  BypassNRO answer file - https://github.com/Thectic-NL/BypassNRO

  Creates local accounts and skips the Microsoft-account sign-in screens
  during OOBE. Works two ways:

    1. Sysprep (bypass.ps1)
         Sysprep.exe /oobe /unattend:C:\Windows\Panther\unattend.xml /reboot
       Only the oobeSystem pass is processed. The specialize pass is NOT
       re-run without /generalize, which is why there is nothing in it.

    2. Installation media (recommended)
       Rename to autounattend.xml and put it on the root of the Windows 11
       USB. Setup picks it up automatically and both windowsPE and
       oobeSystem are processed. This never reaches the account screen at
       all, so there is nothing to bypass.

  WARNING: both accounts below are created WITHOUT A PASSWORD, and Admin is
  logged on automatically once. Set a password immediately after first logon.
-->
<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
	<settings pass="offlineServicing"></settings>
	<settings pass="windowsPE">
		<component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
			<UserData>
				<ProductKey>
					<!-- All zeroes: skip the product key page and use the firmware/digital licence. -->
					<Key>00000-00000-00000-00000-00000</Key>
					<WillShowUI>OnError</WillShowUI>
				</ProductKey>
				<AcceptEula>true</AcceptEula>
			</UserData>
			<UseConfigurationSet>false</UseConfigurationSet>
		</component>
	</settings>
	<settings pass="generalize"></settings>
	<settings pass="specialize"></settings>
	<settings pass="auditSystem"></settings>
	<settings pass="auditUser"></settings>
	<settings pass="oobeSystem">
		<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
			<!--
			  Defining LocalAccounts here is what actually performs the bypass:
			  OOBE skips the account screens entirely because the accounts already
			  exist, so it never asks for a Microsoft account.
			-->
			<UserAccounts>
				<LocalAccounts>
					<LocalAccount wcm:action="add">
						<Name>Admin</Name>
						<DisplayName></DisplayName>
						<Group>Administrators</Group>
						<Password>
							<Value></Value>
							<PlainText>true</PlainText>
						</Password>
					</LocalAccount>
					<LocalAccount wcm:action="add">
						<Name>User</Name>
						<DisplayName></DisplayName>
						<Group>Users</Group>
						<Password>
							<Value></Value>
							<PlainText>true</PlainText>
						</Password>
					</LocalAccount>
				</LocalAccounts>
			</UserAccounts>
			<AutoLogon>
				<Username>Admin</Username>
				<Enabled>true</Enabled>
				<LogonCount>1</LogonCount>
				<Password>
					<Value></Value>
					<PlainText>true</PlainText>
				</Password>
			</AutoLogon>
			<OOBE>
				<ProtectYourPC>3</ProtectYourPC>
				<HideEULAPage>true</HideEULAPage>
				<HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
				<HideOnlineAccountScreens>true</HideOnlineAccountScreens>
				<HideLocalAccountScreen>true</HideLocalAccountScreen>
			</OOBE>
			<FirstLogonCommands>
				<SynchronousCommand wcm:action="add">
					<Order>1</Order>
					<Description>Disable autologon after the first sign-in</Description>
					<CommandLine>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoLogonCount /t REG_DWORD /d 0 /f</CommandLine>
				</SynchronousCommand>
				<SynchronousCommand wcm:action="add">
					<Order>2</Order>
					<Description>Remove the answer file, which contains the plaintext passwords</Description>
					<CommandLine>cmd.exe /c del /q /f "C:\Windows\Panther\unattend.xml" "C:\Windows\Panther\unattend-original.xml"</CommandLine>
				</SynchronousCommand>
			</FirstLogonCommands>
		</component>
	</settings>
</unattend>
