如何自动化Windows Server 2016虚拟机全配置流程？含重启类任务

Absolutely, you can automate this entire workflow end-to-end—reboots and all! The trick is to chain your tasks across restarts using persistent triggers like RunOnce registry entries or Task Scheduler jobs, plus leveraging Windows' built-in unattended setup tools for the Sysprep/OOBE phase. Here's a practical, step-by-step approach tailored to your needs:

1. Use Unattend.xml to Automate Sysprep & OOBE Post-Reboot #

Sysprep will generalize your VM and kick off the Out-of-Box Experience (OOBE) on reboot. Instead of manually walking through OOBE, create an Unattend.xml file to handle core tasks automatically:

• Set the local administrator password
• Rename the VM
• Join the domain (if network is available during OOBE)
• Skip unnecessary OOBE prompts (like privacy settings)

You can generate this file using the Windows System Image Manager (SIM) tool, or use a simplified example like this (save it to C:\Windows\Panther\Unattend.xml before running Sysprep):

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
  <settings pass="oobeSystem">
    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
      <OOBE>
        <HideEULAPage>true</HideEULAPage>
        <HideLocalAccountScreen>true</HideLocalAccountScreen>
        <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
        <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
        <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
        <NetworkLocation>Work</NetworkLocation>
        <ProtectYourPC>1</ProtectYourPC>
      </OOBE>
      <UserAccounts>
        <AdministratorPassword>
          <Value>YourSecurePasswordHere</Value>
          <PlainText>true</PlainText>
        </AdministratorPassword>
      </UserAccounts>
      <ComputerName>VM-NewName</ComputerName>
    </component>
  </settings>
  <settings pass="specialize">
    <component name="Microsoft-Windows-UnattendedJoin" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
      <Identification>
        <JoinDomain>YourDomain.com</JoinDomain>
        <Credentials>
          <Domain>YourDomain</Domain>
          <Password>DomainAdminPassword</Password>
          <Username>DomainAdminUser</Username>
        </Credentials>
        <MachineObjectOU>OU=Servers,DC=YourDomain,DC=com</MachineObjectOU>
      </Identification>
    </component>
  </settings>
</unattend>

Then run Sysprep with the unattend file:

& C:\Windows\System32\Sysprep\Sysprep.exe /generalize /oobe /shutdown /unattend:C:\Windows\Panther\Unattend.xml

2. Trigger Post-OOBE Tasks with RunOnce #

Once the VM boots through OOBE and completes domain join/renaming, you need to run your remaining tasks (fixed IP, software installs). Use the RunOnce registry key to execute a PowerShell script automatically on the first login:

Before running Sysprep, add this registry entry (or include it in your initial setup script):

$scriptPath = "C:\Scripts\PostSetupTasks.ps1"
New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" -Name "PostSetup" -Value "powershell.exe -ExecutionPolicy Bypass -File $scriptPath" -Force

3. Create Your Post-Setup PowerShell Script (PostSetupTasks.ps1) #

This script will handle the remaining tasks after the OOBE reboot:

# Set fixed IP address
$adapter = Get-NetAdapter | Where-Object {$_.Status -eq 'Up'}
New-NetIPAddress -InterfaceAlias $adapter.Name -IPAddress "192.168.1.100" -PrefixLength 24 -DefaultGateway "192.168.1.1"
Set-DnsClientServerAddress -InterfaceAlias $adapter.Name -ServerAddresses "192.168.1.5", "192.168.1.6"

# Install required software (example using Chocolatey, or use MSI/exe installs)
# First install Chocolatey if not present
if (-not (Get-Command choco -ErrorAction SilentlyContinue)) {
    Set-ExecutionPolicy Bypass -Scope Process -Force
    [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
    iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
}
choco install notepadplusplus googlechrome -y

# Cleanup: Remove RunOnce entry so this script doesn't run again
Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\PostSetup" -Force

4. Key Tips for Success #

• Store scripts securely: Place your PostSetupTasks.ps1 and Unattend.xml in a local directory (like C:\Scripts) before running Sysprep—Sysprep won’t delete these files unless you explicitly include them in a cleanup.
• Test in a lab: Always run through the full workflow on a test VM first to catch issues like domain join failures or IP conflicts.
• Sysprep limits: Remember that Sysprep can only be run 8 times on a Windows Server 2016 VM (unless you use the /mode:vm flag for Hyper-V VMs, which removes this limit).
• Permissions: Ensure your domain admin account has rights to join computers to the domain and create computer objects in the specified OU.

By combining unattended setup with post-boot script triggers, you can eliminate all manual steps and make your deployment consistent and error-free.

内容的提问来源于stack exchange，提问作者user130268