Simone/local-ci-cd-system
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(deploy-win): use cmd.exe as the template shell, not explorer

Browse Source 
A headless CI build VM never needs the interactive desktop (builds run over
WinRM in Session 0), and a running explorer is fragile: heavy servicing
(Windows Update / DISM component cleanup) destabilises the live shell and
explorer crash-loops until the next reboot, spiking CPU and tripping the
pre-snapshot idle check.

Set Winlogon\Shell = cmd.exe in post-install so explorer never auto-starts
— removing that whole failure class at the root. Autologin is unchanged;
explorer remains launchable on demand (run explorer.exe, or via RDP).
Verified on the live WinBuildTest VM: post-reboot no explorer, 0 shell-stop
events, ~2% idle CPU.
This commit is contained in:
Simone
2026-06-09 22:13:56 +02:00
parent d4d349dee2
commit 94a29beb26
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ci_orchestrator/winimage/assets/post-install.win.ps1.tmpl
+8 -1
View File
@@ -179,9 +179,16 @@ reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' /v AutoAdmi
reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' /v DefaultUserName /t REG_SZ /d "{{ADMIN_USER}}" /f | Out-Null
reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' /v DefaultPassword /t REG_SZ /d "{{ADMIN_PWD}}" /f | Out-Null
reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' /v DefaultDomainName /t REG_SZ /d '.' /f | Out-Null
# Interactive shell = cmd.exe instead of explorer.exe. A headless CI build VM
# never needs the desktop shell (builds run over WinRM in Session 0), and a
# running explorer is fragile: heavy servicing (Windows Update / DISM component
# cleanup) destabilises the live shell and explorer crash-loops until the next
# reboot. cmd as the shell removes that surface entirely; explorer can still be
# launched on demand (run "explorer.exe", or over RDP).
reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' /v Shell /t REG_SZ /d 'cmd.exe' /f | Out-Null
# OOBE non-policy key (supplements the Policies\Windows\OOBE key set above)
reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE' /v DisablePrivacyExperience /t REG_DWORD /d 1 /f | Out-Null
L 'Lock screen, SM GPO policy + task, CAD Winlogon, autologin Administrator, OOBE non-policy key set'
L 'Lock screen, SM GPO policy + task, CAD Winlogon, autologin Administrator, shell=cmd.exe, OOBE non-policy key set'
# ── IE Enhanced Security Configuration off (Admin) ───────────────────────
# Long-known CI papercut: ESC blocks every URL in admin sessions.