Azure AVD中Windows 11 Packer构建如何绕过OOBE并自动登录？

问题背景 #

使用Packer构建Windows 10镜像时，启用自动登录是绕过OOBE（开箱体验）的临时方案，若未在首次重启前启用，构建会因等待packer用户完成OOBE而停滞。但原本在Windows 10中生效的基础自动登录脚本，在Windows 11中失效：脚本虽成功设置AutoAdminLogon、DefaultUser和DefaultPassword注册表项，VM重启后仍需远程登录packer用户完成OOBE，构建才能继续。

排查过程 #

• 编辑1：尝试直接禁用OOBE后，构建仍需远程登录才能通过WinRM连接继续。
• 编辑2：确认问题根源仍为OOBE，需补充更多注册表项。
• 编辑3：整合多方资源编写新的PowerShell脚本，已解决自动登录问题。

解决脚本 #

# 
# enable-autologon.ps1
# 
# 此脚本为packer用户启用自动登录并禁用Windows 11的OOBE隐私设置界面。
# 脚本整合自网络多方资源，未逐一测试各项设置是否必要，也未确认哪一项是关键解决项。
# 逻辑较为简单，主要是一系列条件判断语句

#region 自动登录设置函数
function AutoAdminLogonSettings {
    Write-Host "==> 设置Winlogon属性: $winlogonPath\AutoAdminLogon <=="
    if (-not (Get-ItemProperty -Path $winlogonPath -Name AutoAdminLogon ) ) {
        New-ItemProperty -Path $winlogonPath -Name AutoAdminLogon -Value "1" -Force
    } else {
        Set-ItemProperty -Path $winlogonPath -Name AutoAdminLogon -Value "1" -Force
    }

    Write-Host "==> 设置Winlogon项属性: $winlogonPath\DefaultUsername <=="
    if (-not (Get-ItemProperty -Path $winlogonPath -Name DefaultUsername ) ) {
        New-ItemProperty -Path $winlogonPath -Name DefaultUsername -Value $env:UserName -Force
    } else {
        Set-ItemProperty -Path $winlogonPath -Name DefaultUsername -Value $env:UserName -Force
    }

    Write-Host "==> 设置Winlogon项属性: $winlogonPath\DefaultPassword <=="
    if (-not (Get-ItemProperty -Path $winlogonPath -Name DefaultPassword ) ) {
        New-ItemProperty -Path $winlogonPath -Name DefaultPassword -Value $env:ADMIN_PASSWORD -Force
    } else {
        Set-ItemProperty -Path $winlogonPath -Name DefaultPassword -Value $env:ADMIN_PASSWORD -Force
    }

    Write-Host "==> 设置Winlogon项属性: $winlogonPath\EnableFirstLogonAnimation <=="
    if (-not (Get-ItemProperty -Path $winlogonPath -Name EnableFirstLogonAnimation ) ) {
        New-ItemProperty -Path $winlogonPath -Name EnableFirstLogonAnimation -Value 0 -Force
    } else {
        Set-ItemProperty -Path $winlogonPath -Name EnableFirstLogonAnimation -Value 0 -Force
    }

}
#endregion

#region OOBE设置函数
function OOBESettings {
    Write-Host "==> 设置OOBE属性: $oobePath\SkipMachineOOBE <=="
    if (-not (Get-ItemProperty -Path $oobePath -Name SkipMachineOOBE ) ) {
        New-ItemProperty -Path $oobePath -Name SkipMachineOOBE -Value 1 -Force
    } else {
        Set-ItemProperty -Path $oobePath -Name SkipMachineOOBE -Value 1 -Force
    }

    Write-Host "==> 设置OOBE属性: $oobePath\SkipUserOOBE <=="
    if (-not (Get-ItemProperty -Path $oobePath -Name SkipUserOOBE ) ) {
        New-ItemProperty -Path $oobePath -Name SkipUserOOBE -Value 1 -Force
    } else {
        Set-ItemProperty -Path $oobePath -Name SkipUserOOBE -Value 1 -Force
    }

    Write-Host "==> 设置OOBE属性: $oobePath\SkipMachineOutOfBoxExperience <=="
    if (-not (Get-ItemProperty -Path $oobePath -Name SkipMachineOutOfBoxExperience ) ) {
        New-ItemProperty -Path $oobePath -Name SkipMachineOutOfBoxExperience -Value 1 -Force
    } else {
        Set-ItemProperty -Path $oobePath -Name SkipMachineOutOfBoxExperience -Value 1 -Force
    }

    Write-Host "==> 设置OOBE属性: $oobePath\PrivacyConsentStatus <=="
    if (-not (Get-ItemProperty -Path $oobePath -Name PrivacyConsentStatus ) ) {
        New-ItemProperty -Path $oobePath -Name PrivacyConsentStatus -Value 1 -Force
    } else {
        Set-ItemProperty -Path $oobePath -Name PrivacyConsentStatus -Value 1 -Force
    }
}
#endregion

#region OOBE策略设置函数
function OOBEPolicySettings {
    Write-Host "==> 设置OOBE属性: $oobePolicyPath\DisablePrivacyExperience <=="
    if (-not (Get-ItemProperty -Path $oobePolicyPath -Name DisablePrivacyExperience ) ) {
        New-ItemProperty -Path $oobePolicyPath -Name DisablePrivacyExperience -Value 1 -Force
    } else {
        Set-ItemProperty -Path $oobePolicyPath -Name DisablePrivacyExperience -Value 1 -PropertyType DWORD -Force
    }
}
#endregion

#region 变量与控制
# 设置变量，非终止错误时静默继续
$ErrorActionPreference = "SilentlyContinue"
$winlogonPath = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'
$oobePath = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE'
$oobePolicyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\OOBE'

If (-not $env:ADMIN_PASSWORD ) { Throw "`$env:ADMIN_PASSWORD 不能为空" }
#endregion

#region 自动登录注册表设置
Write-Host "==> 设置注册表值以启用自动登录... <=="
if ((Test-Path $winlogonPath ) ) {
    AutoAdminLogonSettings

} else {
    Write-Output "创建注册表项: $winlogonPath"
    New-Item -Path $winlogonPath -Force

    if (-not $LASTEXITCODE) {
        AutoAdminLogonSettings

    } else {
        Write-Host "创建注册表项失败: $winlogonPath"
        exit 1
    }
}
#endregion

#region OOBE注册表设置
Write-Host "==> OOBE注册表设置 <=="
if ((Test-Path $oobePath ) ) {
    OOBESettings

} else {
    Write-Output "创建注册表项: $oobePath"
    New-Item -Path $oobePath -Force

    if (-not $LASTEXITCODE) {
        OOBESettings

    } else {
        Write-Host "创建注册表项失败: $oobePath"
        exit 1
    }
}
#endregion

#region OOBE策略设置
Write-Host "==> OOBE策略设置 <=="
if ((Test-Path $oobePolicyPath ) ) {
    OOBEPolicySettings

} else {
    Write-Output "创建注册表项: $oobePolicyPath"
    New-Item -Path $oobePolicyPath -Force

    if (-not $LASTEXITCODE) {
        OOBEPolicySettings

    } else {
        Write-Host "创建注册表项失败: $oobePolicyPath"
        exit 1
    }
}
#endregion

内容的提问来源于stack exchange，提问作者theillien