Understanding Autounattend XML

Winhance generates custom autounattend.xml files based on your current settings. These are sophisticated answer files that automate the Windows setup, bypass hardware restrictions, and apply your custom configuration immediately during installation.

XML Structure & Configuration Passes

The answer file is divided into specific "passes" that run at different stages of the Windows installation. Windows Setup processes these passes sequentially. Here is exactly what happens in each pass:

1. windowsPE (Pre-Installation Environment)

This pass runs in the Windows PE environment before Windows is installed to the disk.

• Hardware Requirement Bypass: Automatically adds registry keys to HKLM\SYSTEM\Setup\LabConfig to bypass Windows 11 hardware checks:
  • BypassTPMCheck - Skips TPM 2.0 requirement
  • BypassSecureBootCheck - Skips Secure Boot requirement
  • BypassRAMCheck - Skips 4GB RAM requirement
  • BypassCPUCheck - Skips CPU compatibility check
  • BypassStorageCheck - Skips storage space requirement
  • BypassDiskCheck - Skips disk type requirement
• Edition Selection: Sets a blank Product Key (00000-00000-00000-00000-00000) with WillShowUI=Always. This ensures the Windows Edition selection screen appears, allowing you to choose between Home, Pro, etc.
• EULA Acceptance: Automatically accepts the End User License Agreement.

2. specialize (First Boot - System Context)

This pass runs when Windows boots for the very first time, but before any user logs in. It runs under the SYSTEM account with full privileges.

• Script Extraction: A PowerShell command extracts the embedded Winhancements.ps1 script from within the XML file itself (stored in a custom <Extensions> section) to C:\ProgramData\Winhance\Unattend\Scripts\.
• BypassNRO: Adds the BypassNRO registry key to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE. This allows setting up Windows with a local account without requiring an internet connection—essential for privacy-conscious users.
• Disable Network Adapters: Temporarily disables all network adapters using Get-NetAdapter | Disable-NetAdapter. This is crucial because it:
  • Prevents Windows from forcing a Microsoft Account login during OOBE
  • Stops Windows Update from downloading drivers or updates during setup
  • Ensures the local account creation option is available
• Enable .NET Framework 3.5: Searches for the installation media (drives C through K) and installs .NET Framework 3.5 directly from \sources\sxs using DISM. This legacy framework is required by some older applications.
• Run Winhancements.ps1: Executes the extracted PowerShell script in "System Mode" to perform machine-wide configuration (see detailed explanation below).

3. oobeSystem (Out of Box Experience)

This pass runs during the OOBE phase—when you would normally see the "Let's set things up for you" screens.

• Skip OOBE Screens: Automatically hides several setup screens:
  • HideEULAPage - Skips the license agreement
  • HideOEMRegistrationScreen - Skips manufacturer registration
  • HideOnlineAccountScreens - Skips Microsoft Account prompts
  • HideWirelessSetupInOOBE - Skips WiFi connection setup
• Privacy Settings: Sets ProtectYourPC=3 which disables sending diagnostic data during OOBE.
• First Logon Command: When you log in for the first time, a command automatically re-enables all network adapters that were disabled in the specialize pass. Your internet connection is restored.

What you'll see: After these automated steps, you'll only need to select your region, keyboard layout, and create your username. No Microsoft Account prompts, no "let's connect you to a network" delays.

The Winhancements.ps1 Script

Embedded inside the XML file is a dynamically generated PowerShell script named Winhancements.ps1. This script is the engine that applies all your Winhance settings. When you click "Generate" in Winhance, your current app selections and toggle states are converted into this script.

Post-Installation: "Some settings are managed by your organization"

After installation, you may see messages in Windows Settings saying "Some of these settings are managed by your organization." This is normal and expected.

This message appears because the XML applies settings using Group Policy registry keys (under HKLM\SOFTWARE\Policies). These are the same mechanisms enterprises use to enforce settings. The benefit is that Windows Update cannot override these settings—they remain enforced until you change them via Winhance or manually.

Windows Edition Selection & Forcing Specific Editions

How the Default Blank Key Works

By default, the Winhance-generated XML uses a blank product key (00000-00000-00000-00000-00000) with WillShowUI=Always. This configuration tells Windows Setup to display the edition selection UI. However, the behavior differs between Windows 10 and 11 when your computer has an OEM key embedded in the UEFI/BIOS:

• Windows 11: Shows the product key entry screen where you can click "I don't have a product key" to see all available editions.
• Windows 10: Shows the edition selection UI, but may only display the OEM edition. Click Back, then Next, then "I don't have a product key" to see all editions.

Forcing a Specific Edition

If you want to skip the edition selection entirely and always install a specific edition (e.g., Pro on a laptop with a Home OEM key), you can edit the <ProductKey> section of the XML file:

1. Open your autounattend.xml file in a text editor (Notepad, VS Code, etc.)
2. Find all instances of the <Key> tag (there are three—one each for x86, ARM64, and AMD64 processor architectures)
3. Replace the blank key with a Generic Installation Key from the table below
4. Optionally, change <WillShowUI>Always</WillShowUI> to <WillShowUI>Never</WillShowUI> to skip the edition selection screen entirely

A complete list of Generic Installation Keys for all editions is available on on GitHub.

File Location After Installation

After Windows is installed using your custom ISO, you can find the Winhance scripts and files at:

• Scripts: C:\ProgramData\Winhance\Unattend\Scripts\
• Drivers (if added via WIMUtil): C:\Windows\Drivers\
• Original XML (copied by Windows Setup): C:\Windows\Panther\unattend.xml

What's NOT Included in the XML

The autounattend.xml does not include external software installations. External apps from the "External Software" section in Winhance (browsers, utilities, etc.) are not part of the XML file because:

• They require an internet connection to download via WinGet
• Software versions change frequently
• Users typically want to choose software after the initial setup

To install external software after using your custom ISO, use the "Install Winhance" desktop shortcut that's created automatically. This will download Winhance so you can install your preferred software from the External Software section.

Cross-Version Compatibility

When generating an XML in Winhance, you can use the version filter toggle (filter icon in the top bar) to include settings for both Windows 10 and Windows 11. Turn off the filter before generating to create an XML that works on either version—the script will automatically apply only the settings relevant to the installed Windows version.

Using Your Autounattend.xml Without WIMUtil

While WIMUtil is the recommended way to create a custom ISO with your XML embedded, you can also use the autounattend.xml file directly with these alternative methods:

Method 1: USB Root Directory

After creating a bootable Windows USB with Rufus, simply copy your autounattend.xml file to the root of the USB drive. Windows Setup will automatically detect and use it.

Method 2: Ventoy Auto Install Plugin

Ventoy is a tool that creates a bootable USB where you can simply copy ISO files without reformatting. It also supports automatic answer file injection:

1. Install Ventoy on a USB drive
2. Create a folder structure: ISO\Windows\ for your Windows ISO files
3. Create a folder: Templates\ for your autounattend.xml
4. Configure Ventoy's Auto Install Plugin to associate your XML with your Windows ISO

This method lets you store multiple Windows ISOs and choose which one to boot, all using the same answer file.

Method 3: Edit the ISO Directly

You can use tools like AnyBurn to edit an official Windows ISO and embed your autounattend.xml file directly into the root of the ISO. This creates a self-contained ISO similar to what WIMUtil produces, but without the driver injection capabilities.