vmix.nix/lib/images/windows/helpers/makeAuditModeAutounattend.nix

# Autounattend.xml for unattended Windows installation into Audit Mode.
# Minimal — only what's needed to install Windows and enter Audit Mode.
# All customization (hostname, timezone, telemetry, UAC, etc.) is done via templates.
{ pkgs, lib, ... }:
{
  locale ? "en-US",
  productKey ? "",
  diskIndex ? 0,
  imageIndex ? 1,
  efi ? true,
  virtioDriverLetter ? "E",
  bypassRequirements ? false,
  windowsVersionForVirtioDrivers
}: pkgs.writeText "Autounattend.xml" ''
  <?xml version="1.0" encoding="utf-8"?>
  <unattend xmlns="urn:schemas-microsoft-com:unattend"
            xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">

    <!-- windowsPE — locale, product key, VirtIO drivers, disk partitioning -->
    <settings pass="windowsPE">
      <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64"
                 publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
        <SetupUILanguage>
          <UILanguage>${locale}</UILanguage>
        </SetupUILanguage>
        <InputLocale>${locale}</InputLocale>
        <SystemLocale>${locale}</SystemLocale>
        <UILanguage>${locale}</UILanguage>
        <UserLocale>${locale}</UserLocale>
      </component>

      <component name="Microsoft-Windows-PnpCustomizationsWinPE" processorArchitecture="amd64"
                 publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
        <DriverPaths>
          <PathAndCredentials wcm:action="add" wcm:keyValue="1">
            <Path>${virtioDriverLetter}:\amd64\${windowsVersionForVirtioDrivers}</Path>
          </PathAndCredentials>
        </DriverPaths>
      </component>

      <component name="Microsoft-Windows-Setup" processorArchitecture="amd64"
                 publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
        <UserData>
          ${lib.optionalString (productKey != "") ''
          <ProductKey>
            <Key>${productKey}</Key>
          </ProductKey>
          ''}
          <AcceptEula>true</AcceptEula>
        </UserData>

        <ImageInstall>
          <OSImage>
            <InstallFrom>
              <MetaData wcm:action="add">
                <Key>/IMAGE/INDEX</Key>
                <Value>${toString imageIndex}</Value>
              </MetaData>
            </InstallFrom>
            <InstallTo>
              <DiskID>${toString diskIndex}</DiskID>
              <PartitionID>${if efi then "3" else "1"}</PartitionID>
            </InstallTo>
          </OSImage>
        </ImageInstall>

        <DiskConfiguration>
          <Disk wcm:action="add">
            <DiskID>${toString diskIndex}</DiskID>
            <WillWipeDisk>true</WillWipeDisk>
            ${if efi then ''
            <CreatePartitions>
              <CreatePartition wcm:action="add">
                <Order>1</Order>
                <Size>100</Size>
                <Type>EFI</Type>
              </CreatePartition>
              <CreatePartition wcm:action="add">
                <Order>2</Order>
                <Size>16</Size>
                <Type>MSR</Type>
              </CreatePartition>
              <CreatePartition wcm:action="add">
                <Order>3</Order>
                <Extend>true</Extend>
                <Type>Primary</Type>
              </CreatePartition>
            </CreatePartitions>
            <ModifyPartitions>
              <ModifyPartition wcm:action="add">
                <Order>1</Order>
                <PartitionID>1</PartitionID>
                <Format>FAT32</Format>
                <Label>EFI</Label>
              </ModifyPartition>
              <ModifyPartition wcm:action="add">
                <Order>2</Order>
                <PartitionID>2</PartitionID>
              </ModifyPartition>
              <ModifyPartition wcm:action="add">
                <Order>3</Order>
                <PartitionID>3</PartitionID>
                <Format>NTFS</Format>
                <Label>Windows</Label>
              </ModifyPartition>
            </ModifyPartitions>
            '' else ''
            <CreatePartitions>
              <CreatePartition wcm:action="add">
                <Order>1</Order>
                <Extend>true</Extend>
                <Type>Primary</Type>
              </CreatePartition>
            </CreatePartitions>
            <ModifyPartitions>
              <ModifyPartition wcm:action="add">
                <Order>1</Order>
                <PartitionID>1</PartitionID>
                <Format>NTFS</Format>
                <Label>Windows</Label>
                <Active>true</Active>
              </ModifyPartition>
            </ModifyPartitions>
            ''}
          </Disk>
        </DiskConfiguration>

        ${lib.optionalString bypassRequirements ''
        <RunSynchronous>
          <RunSynchronousCommand wcm:action="add">
            <Order>1</Order>
            <Path>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassTPMCheck /t REG_DWORD /d 1 /f</Path>
          </RunSynchronousCommand>
          <RunSynchronousCommand wcm:action="add">
            <Order>2</Order>
            <Path>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassSecureBootCheck /t REG_DWORD /d 1 /f</Path>
          </RunSynchronousCommand>
          <RunSynchronousCommand wcm:action="add">
            <Order>3</Order>
            <Path>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassRAMCheck /t REG_DWORD /d 1 /f</Path>
          </RunSynchronousCommand>
        </RunSynchronous>
        ''}
      </component>
    </settings>

    <!-- specialize — inject RunOnce to clean up cached Autounattend and shutdown -->
    <settings pass="specialize">
      <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64"
                 publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
        <RunSynchronous>
          <RunSynchronousCommand wcm:action="add">
            <Order>1</Order>
            <Path>reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v vmixCleanup /t REG_SZ /d "cmd /c del /q C:\Windows\Panther\unattend.xml" /f</Path>
          </RunSynchronousCommand>
          <RunSynchronousCommand wcm:action="add">
            <Order>2</Order>
            <Path>reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v vmixShutdown /t REG_SZ /d "shutdown /s /t 10 /c vmix-audit-ready" /f</Path>
          </RunSynchronousCommand>
        </RunSynchronous>
      </component>
    </settings>

    <!-- oobeSystem — enter Audit Mode -->
    <settings pass="oobeSystem">
      <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64"
                 publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
        <Reseal>
          <Mode>Audit</Mode>
        </Reseal>
      </component>
    </settings>
  </unattend>
''