From 9972896ea8a65d6f2bd6a4134d7286ada2a2533d Mon Sep 17 00:00:00 2001
From: Simone <simone.chifari@gmail.com>
Date: Tue, 9 Jun 2026 23:28:37 +0200
Subject: [PATCH] fix(deploy-win): don't set cmd shell in autounattend (it
 blocks post-install)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

autounattend FirstLogonCommands — which run post-install.ps1 — are triggered
by explorer starting as the shell. Setting Winlogon\Shell=cmd.exe in the
specialize pass stopped explorer, so post-install never ran on a fresh
deploy.

Remove the shell switch from specialize; explorer runs once for the first
logon (deploy-win does no heavy servicing, so no crash-loop risk) and
post-install.ps1 sets Shell=cmd.exe at its end — subsequent boots and all of
prepare-win run under cmd. Keep the (shell-independent) Server Manager
auto-launch disable in specialize.
---
 .../winimage/assets/autounattend.win2025.xml  | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/src/ci_orchestrator/winimage/assets/autounattend.win2025.xml b/src/ci_orchestrator/winimage/assets/autounattend.win2025.xml
index f833d68..bbb37b7 100644
--- a/src/ci_orchestrator/winimage/assets/autounattend.win2025.xml
+++ b/src/ci_orchestrator/winimage/assets/autounattend.win2025.xml
@@ -128,9 +128,17 @@
       <RegisteredOrganization>CI Lab</RegisteredOrganization>
     </component>
 
-    <!-- Set the interactive shell to cmd.exe before the first logon, so a
-         headless CI build VM never starts explorer (which crash-loops during
-         heavy servicing). post-install.ps1 / prepare-win re-affirm this. -->
+    <!-- Stop Server Manager auto-launching even at the first logon: the
+         ServerManager scheduled task is the actual launcher on WS2025; the
+         registry keys are belt-and-suspenders. These are shell-independent.
+
+         NOTE: the interactive shell is intentionally NOT switched to cmd.exe
+         here. autounattend FirstLogonCommands (which run post-install.ps1) are
+         triggered by explorer starting as the shell — replacing the shell in
+         specialize stops explorer, so post-install would never run. explorer
+         runs once for the first logon (deploy-win does no heavy servicing), and
+         post-install.ps1 sets Shell=cmd.exe at its end; subsequent boots, and
+         all of prepare-win, then run under cmd. -->
     <component name="Microsoft-Windows-Deployment"
                processorArchitecture="amd64"
                publicKeyToken="31bf3856ad364e35"
@@ -139,24 +147,16 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d cmd.exe /f</Path>
-          <Description>Set interactive shell to cmd.exe</Description>
-        </RunSynchronousCommand>
-        <!-- Stop Server Manager auto-launching even at the first logon: the
-             ServerManager scheduled task is the actual launcher on WS2025;
-             the registry keys are belt-and-suspenders. -->
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
           <Path>schtasks /Change /TN "\Microsoft\Windows\Server Manager\ServerManager" /Disable</Path>
           <Description>Disable Server Manager auto-launch task</Description>
         </RunSynchronousCommand>
         <RunSynchronousCommand wcm:action="add">
-          <Order>3</Order>
+          <Order>2</Order>
           <Path>reg add "HKLM\SOFTWARE\Microsoft\ServerManager" /v DoNotOpenServerManagerAtLogon /t REG_DWORD /d 1 /f</Path>
           <Description>Do not open Server Manager at logon (HKLM)</Description>
         </RunSynchronousCommand>
         <RunSynchronousCommand wcm:action="add">
-          <Order>4</Order>
+          <Order>3</Order>
           <Path>reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\ServerManager" /v DoNotOpenAtLogon /t REG_DWORD /d 1 /f</Path>
           <Description>Do not open Server Manager at logon (policy)</Description>
         </RunSynchronousCommand>