fix(template): §7.4 Validate-SetupState -Remediate flag + Setup/Deploy tweaks

template/Setup-WinBuild2025.ps1

@@ -131,7 +131,11 @@ param(
     [switch] $SkipWindowsUpdate,
 
     # Skip disk cleanup step (cleanmgr + DISM + cache clear) — speeds up re-runs during dev/debug
-    [switch] $SkipCleanup
+    [switch] $SkipCleanup,
+
+    # Administrator password — used only to write DefaultPassword for autologin.
+    # Optional: if empty, DefaultPassword registry value is left as-is (Deploy may have set it).
+    [string] $AdminPassword = ''
 )
 
 Set-StrictMode -Version Latest
@@ -360,8 +364,23 @@ Assert-Step 'CIUX' 'OOBE policy DisablePrivacyExperience=1' {
 Assert-Step 'CIUX' 'DataCollection AllowTelemetry=0' {
     (Get-ItemProperty -Path $dcKey -Name AllowTelemetry -ErrorAction Stop).AllowTelemetry -eq 0
 }
+# AutoAdminLogon: operativo — Deploy sets this, but Windows Server 2025 OOBE/first-boot
+# tasks can reset AutoAdminLogon to 0 after the initial login. Re-affirm without touching
+# DefaultPassword (already written by Deploy's post-install.ps1 and still present).
+$wlKey = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'
+$wlNow = Get-ItemProperty -Path $wlKey -ErrorAction SilentlyContinue
+if ($wlNow.AutoAdminLogon -ne '1' -or $wlNow.DefaultUserName -ne 'Administrator') {
+    Set-ItemProperty -Path $wlKey -Name AutoAdminLogon    -Value '1'             -Type String -Force
+    Set-ItemProperty -Path $wlKey -Name DefaultUserName   -Value 'Administrator' -Type String -Force
+    Set-ItemProperty -Path $wlKey -Name DefaultDomainName -Value '.'             -Type String -Force
+}
+# DefaultPassword written unconditionally when available — previous run may have set
+# AutoAdminLogon=1 without knowing the password (AdminPassword was added later).
+if ($AdminPassword -ne '') {
+    Set-ItemProperty -Path $wlKey -Name DefaultPassword -Value $AdminPassword -Type String -Force
+}
 Assert-Step 'CIUX' 'autologin Administrator enabled (AutoAdminLogon=1)' {
-    $wl = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' -ErrorAction Stop
+    $wl = Get-ItemProperty -Path $wlKey -ErrorAction Stop
     $wl.AutoAdminLogon -eq '1' -and $wl.DefaultUserName -eq 'Administrator'
 }