Skip to content

Commit eede0ff

Browse files
Stensel8claude
Stensel8
and
claude
committed
WinDeploy v0.6.0 - Initial public release
Windows Deployment Automation Toolkit for zero-touch Windows deployment with automatic driver updates, application installation, bloatware removal, and system hardening. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
0 parents  commit eede0ff

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+3828
-0
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
## Description
2+
<!-- Clear description of the problem -->
3+
4+
## Current Behavior
5+
<!-- What happens currently -->
6+
7+
## Expected Behavior
8+
<!-- What should happen instead -->
9+
10+
## Steps to Reproduce
11+
1.
12+
2.
13+
3.
14+
15+
## Environment
16+
- PowerShell Version:
17+
- Windows Version:
18+
- WinDeploy Version:
19+
- Execution Method: [USB/Direct/RMM/AutoUnattend]
20+
21+
## Logs
22+
<!-- Attach relevant logs from C:\WinDeploy\Logs -->
23+
```
24+
25+
<details>
26+
<summary>Additional logs</summary>
27+
```
28+
Paste logs here
29+
```
30+
31+
</details>
32+
33+
## Additional Context
34+
<!-- Any other relevant information -->

‎.github/dependabot.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# To get started with Dependabot version updates, you'll need to specify which
2+
# package ecosystems to update and where the package manifests are located.
3+
# Please see the documentation for all configuration options:
4+
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
5+
6+
version: 2
7+
updates:
8+
# Maintain dependencies for GitHub Actions
9+
- package-ecosystem: "github-actions"
10+
directory: "/"
11+
schedule:
12+
interval: "weekly"
13+
day: "monday"
14+
time: "09:00"
15+
# No labels configured so Dependabot won't fail if these labels don't exist in the repo
16+
open-pull-requests-limit: 5
17+
commit-message:
18+
prefix: "chore(deps)"
19+
include: "scope"

‎.github/workflows/devskim.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
name: DevSkim
7+
8+
on:
9+
push:
10+
branches: [ "main" ]
11+
pull_request:
12+
branches: [ "main" ]
13+
schedule:
14+
- cron: '35 6 * * 3'
15+
16+
jobs:
17+
lint:
18+
name: DevSkim
19+
runs-on: ubuntu-latest
20+
permissions:
21+
actions: read
22+
contents: read
23+
security-events: write
24+
steps:
25+
- name: Checkout code
26+
uses: actions/checkout@v6
27+
28+
- name: Run DevSkim scanner
29+
uses: microsoft/DevSkim-Action@v1
30+
31+
- name: Upload DevSkim scan results to GitHub Security tab
32+
uses: github/codeql-action/upload-sarif@v4
33+
with:
34+
sarif_file: devskim-results.sarif

‎.github/workflows/powershell.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
#
6+
# https://github.com/microsoft/action-psscriptanalyzer
7+
# For more information on PSScriptAnalyzer in general, see
8+
# https://github.com/PowerShell/PSScriptAnalyzer
9+
10+
name: PSScriptAnalyzer
11+
12+
on:
13+
push:
14+
branches: [ "main" ]
15+
pull_request:
16+
branches: [ "main" ]
17+
schedule:
18+
- cron: '43 19 * * 3'
19+
20+
permissions:
21+
contents: read
22+
23+
jobs:
24+
build:
25+
permissions:
26+
contents: read # for actions/checkout to fetch code
27+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
28+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
29+
name: PSScriptAnalyzer
30+
runs-on: ubuntu-latest
31+
steps:
32+
- uses: actions/checkout@v6
33+
34+
- name: Run PSScriptAnalyzer
35+
uses: microsoft/psscriptanalyzer-action@6b2948b1944407914a58661c49941824d149734f
36+
with:
37+
# Check https://github.com/microsoft/action-psscriptanalyzer for more info about the options.
38+
# The below set up runs PSScriptAnalyzer to your entire repository and runs some basic security rules.
39+
path: .\
40+
recurse: true
41+
# Include your own basic security rules. Removing this option will run all the rules
42+
# includeRule: '"PSAvoidGlobalAliases", "PSAvoidUsingConvertToSecureStringWithPlainText"'
43+
output: results.sarif
44+
45+
# Upload the SARIF file generated in the previous step
46+
- name: Upload SARIF results file
47+
uses: github/codeql-action/upload-sarif@v4
48+
with:
49+
sarif_file: results.sarif

‎.gitignore‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# PowerShell
2+
*.ps1xml
3+
4+
# Logs
5+
*.log
6+
Logs/
7+
*.log.*
8+
9+
# Temporary files
10+
*.tmp
11+
*.temp
12+
Temp/
13+
tmp/
14+
15+
# Build artifacts
16+
bin/
17+
obj/
18+
out/
19+
20+
# IDE
21+
.vscode/
22+
.vs/
23+
*.suo
24+
*.user
25+
.idea/
26+
27+
# OS
28+
.DS_Store
29+
Thumbs.db
30+
desktop.ini
31+
32+
# Deployment artifacts
33+
Download/
34+
*.exe
35+
*.msi
36+
Agent.exe
37+
38+
# Backup files
39+
*.bak
40+
*.backup
41+
*~
42+
43+
# Test files
44+
test/
45+
tests/
46+
*.test.ps1
47+
48+
# Branding update script (temporary)
49+
Update-Branding.ps1

‎CHANGELOG.md‎

Lines changed: 175 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
# Changelog
2+
3+
All notable changes to WinDeploy will be documented in this file.
4+
5+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
6+
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7+
8+
---
9+
10+
## [0.6.0] - 2026-02-02
11+
12+
### Changed
13+
- Refactored RMM agent installation to be vendor-neutral (USB-based only).
14+
- Updated all deployment scripts with consistent headers and improved structure.
15+
- Cloudflare API endpoints restored and verified working.
16+
- Cleaned up documentation and removed outdated assets.
17+
18+
### Fixed
19+
- Improved script reliability after extensive internal testing.
20+
- Various consistency improvements across the codebase.
21+
22+
### Removed
23+
- Removed vendor-specific RMM integrations in favor of generic USB-based approach.
24+
25+
---
26+
27+
## [0.5.8] - 2025-11-25
28+
29+
### Added
30+
- Additional documentation for Intune setup.
31+
32+
### Changed
33+
- Updated dependabot config to use latest actions/checkout version.
34+
35+
## [0.5.7] - 2025-11-21
36+
37+
### Added
38+
- Additional security messages in Harden-Windows.ps1: Can be manually enabled by the user via GUI.
39+
- Informational links to each hardening item in Harden-Windows.ps1 output for more details.
40+
41+
### Changed
42+
- Updated URLs in Harden-Windows.ps1 links to correct and more relevant sources.
43+
- Changed the order of script execution so the RMM Agent is installed first.
44+
45+
### Fixed
46+
- Bitlocker enablement issue: Sometimes Bitlocker failed to enable due to the TPM not being ready.
47+
- Fixed an issue with RMM Agents not installing correctly. [#11](https://github.com/Stensel8/WinDeploy/issues/11)
48+
- Fixed a rare hang where deployment would stall after detecting the RMM installer on USB. The installer was being invoked via PowerShell incorrectly which could prevent it from receiving silent switches; changed to run the installer directly and wait for completion, added longer timeouts and improved logging.
49+
50+
## [0.5.6] - 2025-11-20
51+
52+
### Added
53+
- BitLocker enablement in Harden-Windows.ps1: Added registry policies to enable BitLocker and set XTS-AES-256 encryption, plus automated enabling on the OS drive with TPM protection and used-space-only encryption. Which is the recommended approach.
54+
55+
### Changed
56+
- Enhanced bloatware removal: The Snipping Tool is no longer removed on Windows 11 systems, as it is now integrated into the core OS and provides better screenshot and video capture features compared to the legacy version.
57+
- Updated Set-Theme.ps1: Added desktop wallpaper configuration to set "C:\Windows\Web\Wallpaper\Windows\img19.jpg" for current and default users alongside dark mode settings.
58+
59+
---
60+
61+
## [0.5.5] - 2025-11-20
62+
63+
### Added
64+
- Additional fallback to CDN if Microsoft 365 apps fail to install via Winget.
65+
- Added additional error messages during application installation to keep users informed of the process status.
66+
- Memory integrity will now be enabled during hardening if supported by the system.
67+
- Extra Try/Catch blocks around critical sections to improve error handling.
68+
- Short demo GIF showcasing the deployment process added to the README.md.
69+
70+
### Changed
71+
- Enhanced the startup banner to reflect session details, such as admin/non-admin status, PowerShell version (5 or 7), and Windows Terminal usage. This informs users about script execution and available controls. Also added a 15-second timer to allow cancellation if the script was launched unintentionally.
72+
73+
## [0.5.4] - 2025-11-19
74+
75+
### Added
76+
- Additional security hardening based on CISO recommendations.
77+
- Additional Winget exit codes to better understand installation results.
78+
79+
### Changed
80+
- Merged Autorun disable options into Harden-Windows.ps1 for better maintainability and understandability.
81+
82+
### Fixed
83+
- Improved handling of situations where the script was not run as admin and PowerShell 7 was not present on the system.
84+
- Implemented PSScriptAnalyzer suggestions to enhance code quality and best practices.
85+
- Improved GitHub API usage: Scripts now perform more attempts to obtain a good release.
86+
- Fixed an issue where the deployment tried to use the wrong command to silently update a Dell device driver.
87+
- Fixed an issue where the logs did not properly capture the output of Driver installs.
88+
89+
---
90+
91+
## [0.5.3] - 2025-11-18
92+
93+
### Fixed
94+
- Fixed PowerShell 7 path refresh issue after installation by hardcoding `$env:ProgramFiles\PowerShell\7\pwsh.exe` to ensure correct executable usage.
95+
- Fixed: Autounatend scripts not shown in some scenarios.
96+
97+
## [0.5.2] - 2025-11-18
98+
99+
### Added
100+
- Added documentation images for finding Microsoft Store ID and installing via Microsoft Store
101+
102+
### Changed
103+
- Changed API for GitHub Releases
104+
- Updated README.md to improve legend
105+
- Updated Start.ps1 script
106+
- Updated Deploy.ps1 script
107+
108+
### Fixed
109+
- Bugfixes to autologin and locales in autounattend.xml
110+
- General bugfixes
111+
112+
---
113+
114+
## [0.5.0] - 2025-11-14
115+
116+
### Fixed
117+
- Fixed bloatware removal printing duplicate messages on screen by removing redundant Write-Output calls
118+
- Improved admin elevation handling in Start.ps1 and Deploy.ps1 to prevent script crashes when not run as administrator
119+
120+
### Added
121+
- Added documentation for Intune Autopilot device preparation setup (`Docs/Intune-Autopilot-Setup.md`)
122+
- Added RMM agent installation support with USB detection and download fallback
123+
124+
### Changed
125+
- Simplified and improved project structure for better maintainability
126+
- Streamlined deployment scripts with cleaner, more maintainable code
127+
- Updated README.md with comprehensive documentation and updated flowchart
128+
- Reorganized scripts into `Scripts/Deployment/` for better organization
129+
130+
### Removed
131+
- Removed complex modular architecture in favor of inline scripts
132+
- Removed unused utility modules and scripts
133+
134+
### Fixed
135+
- Improved error handling and logging across all scripts
136+
- Enhanced compatibility and reliability of deployment process
137+
138+
---
139+
140+
## [0.1.2] - 2025-10-22
141+
142+
### Changed
143+
- Enhanced startup banner with script source detection and color-coded execution info
144+
- Standardized script headers and documentation blocks for consistency
145+
- Optimized WinGet preparation and application installation process
146+
- Improved output formatting for Windows updates
147+
148+
### Fixed
149+
- Added error logging to catch blocks and improved error messages
150+
- Increased resiliency in bloatware removal and application installation
151+
- `Install-WindowsUpdates.ps1`: Removed unused parameter
152+
153+
### Removed
154+
- Removed all author, company, and version metadata from individual script files
155+
- Removed redundant `.LINK` sections from documentation blocks
156+
- Removed verbose bullet lists and "Features:" sections from descriptions
157+
158+
---
159+
160+
## [0.1.1] - 2025-10-21
161+
162+
### Initial Public Release
163+
164+
First open-source release of WinDeploy - Windows Deployment Automation Toolkit. This is the first release under the new name and repository.
165+
166+
---
167+
168+
[0.6.0]: https://github.com/Stensel8/WinDeploy/releases/tag/v0.6.0
169+
[0.5.5]: https://github.com/Stensel8/WinDeploy/releases/tag/v0.5.5
170+
[0.5.4]: https://github.com/Stensel8/WinDeploy/releases/tag/v0.5.4
171+
[0.5.3]: https://github.com/Stensel8/WinDeploy/releases/tag/v0.5.3
172+
[0.5.2]: https://github.com/Stensel8/WinDeploy/releases/tag/v0.5.2
173+
[0.5.0]: https://github.com/Stensel8/WinDeploy/releases/tag/v0.5.0
174+
[0.1.2]: https://github.com/Stensel8/WinDeploy/releases/tag/v0.1.2
175+
[0.1.1]: https://github.com/Stensel8/WinDeploy/releases/tag/v0.1.1

‎CONTRIBUTING.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Contributing to WinDeploy
2+
3+
Thanks — small, tested PRs help most.
4+
5+
### Quick start
6+
1. Fork → branch → change → PR.
7+
2. Test on Windows 11.
8+
9+
### Guidelines
10+
- Commit: `<type>: short summary` (feat, fix, docs, style, refactor, test, chore).
11+
- Follow PowerShell conventions (PascalCase funcs, camelCase vars, verb-noun, comment-based help).
12+
- Avoid hard-coded paths; use config/variables.
13+
14+
### Testing
15+
- Test on a clean Windows 11 machine.
16+
- Run PSScriptAnalyzer: Install-Module PSScriptAnalyzer; Invoke-ScriptAnalyzer -Path .\ -Recurse.
17+
- No syntax errors; logs show expected behavior.
18+
19+
### Pull requests
20+
- Update docs if needed, include test notes and related issue references.
21+
- Checklist: tested, linter passed, clear description/screenshots.
22+
23+
### Issues
24+
Include: short description, reproduction steps, expected vs actual, logs and env (Windows/PowerShell versions).
25+
26+
### Allowed / Not allowed
27+
Welcome: bug fixes, docs, tests, small features.
28+
Not accepted: malware, proprietary deps, breaking changes without prior discussion.

‎Docs/Deployment_Flow.png‎

125 KB
Loading

‎Docs/Deployment_Success.png‎

69.4 KB
Loading

‎Docs/Finding-msstore-id.png‎

5.39 KB
Loading

0 commit comments

Comments
 (0)