diff --git a/.azure-pipelines/release.yml b/.azure-pipelines/release.yml
new file mode 100644
index 000000000..c2c644db8
--- /dev/null
+++ b/.azure-pipelines/release.yml
@@ -0,0 +1,32 @@
+name: Release-$(Date:yyyyMMdd)$(Rev:.r)
+trigger: none
+pr: none
+
+resources:
+  repositories:
+    - repository: 1ESPipelines
+      type: git
+      name: 1ESPipelineTemplates/1ESPipelineTemplates
+      ref: refs/tags/release
+
+parameters:
+  - name: 'esrp'
+    type: boolean
+    default: false
+    displayName: 'Enable ESRP code signing'
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelines
+  parameters:
+    stages:
+      - stage: windows
+        displayName: 'Windows'
+        jobs:
+          - job: win_x86_build
+            displayName: 'Windows Build and Sign (x86)'
+            pool:
+              name: GitClient-1ESHostedPool-intel-pc
+              image: win-x86_64-ado1es
+              os: windows
+            steps:
+              - checkout: self
diff --git a/src/windows/Installer.Windows/layout.ps1 b/src/windows/Installer.Windows/layout.ps1
index 070c9bf49..818ee01c6 100644
--- a/src/windows/Installer.Windows/layout.ps1
+++ b/src/windows/Installer.Windows/layout.ps1
@@ -1,20 +1,22 @@
 # Inputs
-param ([Parameter(Mandatory)] $CONFIGURATION, [Parameter(Mandatory)] $OUTPUT, $SYMBOLOUTPUT)
+param ([Parameter(Mandatory)] $Configuration, [Parameter(Mandatory)] $Output, $SymbolOutput)
 
-Write-Output "Output: $OUTPUT"
+Write-Output "Output: $Output"
 
 # Directories
-$THISDIR = $pwd.path
-$ROOT = (Get-Item $THISDIR).parent.parent.parent.FullName
-$SRC = "$ROOT/src"
-$GCM_SRC = "$SRC/shared/Git-Credential-Manager"
+$THISDIR = $PSScriptRoot
+$ROOT = (Get-Item $THISDIR).Parent.Parent.Parent.FullName
+$SRC = "$ROOT\src"
+$GCM_SRC = "$SRC\shared\Git-Credential-Manager"
 
 # Perform pre-execution checks
-$PAYLOAD = "$OUTPUT"
-if ($SYMBOLOUTPUT)
+$PAYLOAD = "$Output"
+if ($SymbolOutput)
+{
+    $SYMBOLS = "$SymbolOutput"
+}
+else
 {
-    $SYMBOLS = "$SYMBOLOUTPUT"
-} else {
     $SYMBOLS = "$PAYLOAD.sym"
 }
 
@@ -32,37 +34,37 @@ if (Test-Path -Path $SYMBOLS)
 }
 
 # Ensure payload and symbol directories exist
-mkdir -p "$PAYLOAD","$SYMBOLS"
+mkdir -p "$PAYLOAD","$SYMBOLS" | Out-Null
 
 # Publish core application executables
 Write-Output "Publishing core application..."
 dotnet publish "$GCM_SRC" `
 	--framework net472 `
-	--configuration "$CONFIGURATION" `
+	--configuration "$Configuration" `
 	--runtime win-x86 `
 	--output "$PAYLOAD"
 
 # Delete libraries that are not needed for Windows but find their way
 # into the publish output.
-Remove-Item -Path "$PAYLOAD/*.dylib" -Force
+Remove-Item -Path "$PAYLOAD/*.dylib" -Force -ErrorAction Ignore
 
 # Delete extraneous files that get included for other architectures
 # We only care about x86 as the core GCM executable is only targeting x86
-Remove-Item -Path "$PAYLOAD/arm/" -Recurse -Force
-Remove-Item -Path "$PAYLOAD/arm64/" -Recurse -Force
-Remove-Item -Path "$PAYLOAD/x64/" -Recurse -Force
-Remove-Item -Path "$PAYLOAD/musl-x64/" -Recurse -Force
-Remove-Item -Path "$PAYLOAD/runtimes/win-arm64/" -Recurse -Force
-Remove-Item -Path "$PAYLOAD/runtimes/win-x64/" -Recurse -Force
+Remove-Item -Path "$PAYLOAD/arm/" -Recurse -Force -ErrorAction Ignore
+Remove-Item -Path "$PAYLOAD/arm64/" -Recurse -Force -ErrorAction Ignore
+Remove-Item -Path "$PAYLOAD/x64/" -Recurse -Force -ErrorAction Ignore
+Remove-Item -Path "$PAYLOAD/musl-x64/" -Recurse -Force -ErrorAction Ignore
+Remove-Item -Path "$PAYLOAD/runtimes/win-arm64/" -Recurse -Force -ErrorAction Ignore
+Remove-Item -Path "$PAYLOAD/runtimes/win-x64/" -Recurse -Force -ErrorAction Ignore
 
 # The Avalonia and MSAL binaries in these directories are already included in
 # the $PAYLOAD directory directly, so we can delete these extra copies.
-Remove-Item -Path "$PAYLOAD/x86/libSkiaSharp.dll" -Recurse -Force
-Remove-Item -Path "$PAYLOAD/x86/libHarfBuzzSharp.dll" -Recurse -Force
-Remove-Item -Path "$PAYLOAD/runtimes/win-x86/native/msalruntime_x86.dll" -Recurse -Force
+Remove-Item -Path "$PAYLOAD/x86/libSkiaSharp.dll" -Recurse -Force -ErrorAction Ignore
+Remove-Item -Path "$PAYLOAD/x86/libHarfBuzzSharp.dll" -Recurse -Force -ErrorAction Ignore
+Remove-Item -Path "$PAYLOAD/runtimes/win-x86/native/msalruntime_x86.dll" -Recurse -Force -ErrorAction Ignore
 
 # Delete localized resource assemblies - we don't localize the core GCM assembly anyway
-Get-ChildItem "$PAYLOAD" -Recurse -Include "*.resources.dll" | Remove-Item -Force
+Get-ChildItem "$PAYLOAD" -Recurse -Include "*.resources.dll" | Remove-Item -Force -ErrorAction Ignore
 
 # Delete any empty directories
 Get-ChildItem "$PAYLOAD" -Recurse -Directory `