fix(template): §7.4 Validate-SetupState -Remediate flag + Setup/Deploy tweaks

Fix emerged during §7.4 e2e test run (2026-05-10):
- Deploy: set UsoSvc to Manual explicitly (Server 2025 default = Automatic)
- Setup cleanup: re-apply Set-Service Disabled on wuauserv/UsoSvc after DISM
  StartComponentCleanup (WaaSMedicSvc resets StartType during component store cleanup)
- Deploy + Setup: add Administrator autologin (AutoAdminLogon, DefaultUserName,
  DefaultPassword, DefaultDomainName) in post-install.ps1; Assert-Step 5c validates it
- Add Validate-DeployState.ps1: standalone host-side check of all Deploy-set state
- Add Validate-SetupState.ps1: standalone host-side check of full post-Setup state
- Mark §7.4, §7.1 and §7.2 e2e validation items as complete in TODO.md
- Update docs: WINDOWS-TEMPLATE-SETUP.md (arch table, validation scripts section,
  autologin in confine Deploy/Setup); TEST-7.4-e2e.md checklist marked done

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

TODO.md

@@ -571,7 +571,7 @@ build più ampi senza toccare il template.
 Tool da aggiungere come step `Setup-WinBuild2025` (ognuno con `Assert-Step`):
 
 | Tool                | Versione                | Razionale                                                      |
-| ------------------- | ----------- | ------------------------------------------------------------ |
+| ------------------- | ----------------------- | -------------------------------------------------------------- |
 | **Git for Windows** | latest LTS              | Self-clone in VM (alt a host-zip-transfer), submodule fetch    |
 | **7-Zip**           | latest                  | Universale unpack/zip; molti installer e workflow ne dipendono |
 | **PowerShell 7.x**  | latest LTS              | Più veloce di 5.1, parallel pipelines, operatori moderni       |
@@ -623,84 +623,50 @@ OOBE telemetry, WU services disable — entrambi gli script li toccano.
 File: [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1),
 [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1).
 
-**Da MUOVERE Setup → Deploy**:
-
-| Concern Setup | Step attuale Setup | Azione Deploy |
-| ----------------------------- | ------------------ | ------------------------------------------- |
-| Firewall off all profiles     | Step 1             | Aggiungere `Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled False` in post-install (ora Deploy aggiunge solo regole RDP/ICMP) |
-| WinRM tuning memoria/timeout  | Step 3 (parziale)  | Aggiungere `MaxMemoryPerShellMB=2048`, `IdleTimeOut=7200000`, `MaxProcessesPerShell=25` in post-install dopo Enable-PSRemoting |
-
-**Da CONVERTIRE in Setup a Assert-Step (validation-only)**:
-
-| Step Setup | Diventa |
-| ---------- | ------- |
-| Step 1 Firewall | `Assert-Step` 3 profili Enabled=False (richiede prima la riga "Da MUOVERE" → Deploy: Set-NetFirewallProfile -Enabled False) |
-| Step 2 Defender | Già validation-only (refactor 2026-05-09) |
-| Step 3 WinRM tuning | `Assert-Step` MaxMemoryPerShellMB, IdleTimeOut, AllowUnencrypted, Basic |
-| Step 4b UAC | `Assert-Step` EnableLUA=0, LocalAccountTokenFilterPolicy=1 |
-| Step 5b Explorer LaunchTo | `Assert-Step` HKCU LaunchTo=1 |
-| Step 5c Server Manager / DisableCAD / OOBE | `Assert-Step` HKLM machine policy + DisableCAD=1 + OOBE policy |
-
-**Da MANTENERE in Setup (build env, non base OS)**:
-- Step 4: build user `ci_build` + admin
-- Step 5: `C:\CI\{build,output,scripts}` dirs
-- Step 7-9: .NET SDK, Python, VS Build Tools
-- Step 10: Toolchain cross-check
-- Cleanup, Final pre-snapshot gate
-
-**Test acceptance**:
-- Deploy stand-alone produce VM con tutte le validation Setup che passano (no Setup run)
-- Setup run dopo Deploy: tutte Assert-Step pass `[OK]` immediato (no work)
-- Test `--Skip` orthogonali (no regressione)
+- [x] Aggiungere `Set-NetFirewallProfile -Enabled False` (tutti i profili) in Deploy post-install.ps1
+- [x] Aggiungere `MaxMemoryPerShellMB=2048`, `IdleTimeOut=7200000`, `MaxProcessesPerShell=25`, `StartupType=Automatic` in Deploy dopo Enable-PSRemoting
+- [x] Aggiungere in Deploy items mancanti rispetto a Setup 5c: lock screen (`NoLockScreen`), SM GPO policy key (`DoNotOpenAtLogon`), SM scheduled task disable, `DisableCAD` in Winlogon, OOBE non-policy key
+- [x] Setup Step 1 (Firewall) → Assert-Step only
+- [x] Setup Step 2 (Defender) → già validation-only (refactor 2026-05-09)
+- [x] Setup Step 3 (WinRM tuning) → Assert-Step only (rimuovi Enable-PSRemoting, winrm set, Set-Item, Set-Service)
+- [x] Setup Step 4b (UAC) → Assert-Step only
+- [x] Setup Step 5b (Explorer LaunchTo) → Assert-Step only
+- [x] Setup Step 5c (Server Manager / DisableCAD / OOBE) → Assert-Step only
+- [x] E2e validation — completata §7.4 (2026-05-10)
 
 ### 7.2 [P1] WU lifecycle — strategia B (Deploy: GPO + Manual; Setup: lifecycle)
 File: [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1),
 [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1).
 
-**Stato attuale (conflitto ordering)**:
-- Deploy: `sc.exe config wuauserv start= disabled` + `sc.exe stop wuauserv` (idem UsoSvc, WaaSMedicSvc) + GPO `NoAutoUpdate=1`
-- Setup Step 6: necessita servizi UP per SchTask SYSTEM run WU
-- Setup Step 6b: re-disabilita servizi → doppio lavoro, fragile
+Strategia B: Deploy lascia servizi WU `start=demand` (Manual, default Windows) e scrive solo
+GPO `NoAutoUpdate=1` + `DisableWindowsUpdateAccess=1`. Setup Step 6 clears i GPO locks (Step A),
+avvia WU via SchTask SYSTEM, poi Step 6b disabilita servizi permanentemente post-update.
 
-**Strategia B — separazione pulita**:
-
-**Deploy** (post-install.ps1):
-- Lascia servizi WU `start=demand` (Manual, default Windows) — NON `disabled`, NON `stop`
-- Setta solo GPO `NoAutoUpdate=1`, `DisableWindowsUpdateAccess=1` → no background scheduled WU
-- Risultato: WU è invocabile on-demand ma non parte mai da solo
-
-**Setup** (Step 6 / 6b):
-- Step 6 (skip se `-SkipWindowsUpdate`): `sc.exe config wuauserv start= demand` (idempotent), avvia SchTask SYSTEM, attende exit code, parse 0/2/3/3010
-- Step 6b (sempre, anche con `-Skip`): `sc.exe config wuauserv start= disabled` + `sc.exe stop wuauserv` (idem UsoSvc, WaaSMedicSvc), conferma GPO presenti — snapshot capture WU permanently off
-
-**Pattern run periodico patches** (allineato §2.5 snapshot versionato):
-- Re-deploy template `BaseClean_<yyyyMMdd>` ogni N mesi via Deploy + Prepare (no `-Skip`) → patch applicate al template fresh
-
-**Validazione finale** (Setup Final gate):
-- `wuauserv.StartType == Disabled`
-- `UsoSvc.StartType == Disabled`
-- GPO `NoAutoUpdate=1`, `DisableWindowsUpdateAccess=1`
-
-**Test acceptance**:
-- Deploy stand-alone: `Get-Service wuauserv | Select StartType` → `Manual`, `Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name NoAutoUpdate` → 1
-- Setup `-SkipWindowsUpdate`: Final gate vede `StartType=Disabled` (impostato da Step 6b)
-- Setup senza `-Skip`: WU runs, exit 0/2/3, poi servizi disabled
+- [x] Deploy: rimuovere `sc.exe config wuauserv start= disabled` (e UsoSvc, WaaSMedicSvc)
+- [x] Deploy: aggiungere GPO `DisableWindowsUpdateAccess=1` (era mancante; `NoAutoUpdate=1` già presente)
+- [x] Setup Step 6 Step A: già rimuove `DisableWindowsUpdateAccess` + `NoAutoUpdate` prima del COM API — nessuna modifica necessaria
+- [x] Setup Step 6 Step D: già fa `Set-Service start=Manual` + `Start-Service` — idempotente con servizi già Manual
+- [x] Setup Step 6b: già disabilita wuauserv/UsoSvc + GPO keys — nessuna modifica necessaria
+- [x] E2e validation — completata §7.4 (2026-05-10)
 
 ### 7.3 [P2] Update header docs di entrambi gli script
-- [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1) `.DESCRIPTION`:
-  enumerare tutte le hardening voci che Deploy ora possiede (firewall, WinRM tuning,
-  WU GPO non disable)
-- [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1) `.DESCRIPTION`:
-  marcare Step 1/3/4b/5b/5c come "validation-only — set by Deploy"
-- [docs/WINDOWS-TEMPLATE-SETUP.md](docs/WINDOWS-TEMPLATE-SETUP.md): aggiornare descrizione
-  "Cosa fa Setup-WinBuild2025" — riflettere nuovo confine
 
-### 7.4 [P2] Test e2e refactor
-- Run Deploy stand-alone su VM test → verifica tutte le hardening voci presenti
-  (`reg query` per chiavi UAC/OOBE/Server Manager, `Get-NetFirewallProfile`, `Get-Service WMUauserv`)
-- Run Prepare-WinBuild2025 dopo Deploy → tutti `Assert-Step` pass `[OK]` senza work
-- Run Prepare con `-SkipWindowsUpdate` → comportamento invariato
-- Run Prepare senza `-Skip` → WU runs, services lifecycled correttamente
+- [x] [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1) `.DESCRIPTION`: aggiornato con tutte le hardening voci (firewall, WinRM tuning, WU GPO strategy B, lock screen, SM, OOBE)
+- [x] [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1) `.DESCRIPTION`: Steps 1/3/4b/5b/5c marcati "validation-only — set by Deploy"; step ordering rationale aggiornato
+- [x] [docs/WINDOWS-TEMPLATE-SETUP.md](docs/WINDOWS-TEMPLATE-SETUP.md): architettura "tre script", VMX path `CI-WinBuild.vmx`, Fase C step list + razionale + tabella validazioni aggiornati
+
+### 7.4 [P2] Test e2e refactor — COMPLETATO 2026-05-10
+
+- [x] Deploy stand-alone su VM test → `Get-NetFirewallProfile` tutti `Enabled=False`, `Get-Service wuauserv | Select StartType` → `Manual`, `NoAutoUpdate=1` GPO presente
+- [x] Prepare dopo Deploy con `-SkipWindowsUpdate` → tutti `Assert-Step` passano `[OK]` senza eseguire Set (log mostra solo validation output)
+- [x] Prepare senza `-SkipWindowsUpdate` → WU (0 update trovati, ResultCode=0), Step 6b disabilita wuauserv/UsoSvc (`StartType=Disabled`)
+- [x] Final gate del guest passa su tutti e 7 i check; snapshot `BaseClean` preso
+
+**Fix emersi durante §7.4** (applicati):
+- Deploy: `UsoSvc` impostato a `Manual` esplicitamente (default Server 2025 = Automatic)
+- Setup cleanup: `Set-Service -StartupType Disabled` ri-applicato su wuauserv/UsoSvc dopo DISM `StartComponentCleanup` (DISM/WaaSMedicSvc può resettare StartType)
+- Deploy + Setup: autologin Administrator (`AutoAdminLogon=1`) aggiunto in post-install.ps1 e validato in Assert-Step 5c
+- Nuovi script: `template/Validate-DeployState.ps1`, `template/Validate-SetupState.ps1`
 
 ### 7.5 [P3] Rinomina Setup → Setup-CITools (opzionale, futuro)
 Una volta che Setup fa solo build customization, nome `Setup-WinBuild2025` è impreciso —

docs/TEST-7.4-e2e.md

@@ -0,0 +1,169 @@
+# §7.4 — E2e test refactor Deploy↔Setup
+
+Valida che il refactor §7 (2026-05-10) funzioni su VM reale:
+Deploy possiede OS hardening → Setup valida senza re-applicare.
+
+**Non toccare l'existing template** (`CI-WinBuild.vmx` + snapshot `BaseClean`).
+Usare VM separata per i test.
+
+---
+
+## Prerequisiti
+
+- `F:\CI\ISO\26100.1742.240906-0331.ge_release_svc_refresh_SERVER_VOL_x64FRE_en-us.iso` presente
+- `F:\CI\ISO\VMware-tools-windows.iso` presente
+- VMware Workstation aperto, sufficiente spazio su `F:\CI\Templates\WinBuildTest\`
+
+---
+
+## Step 1 — Deploy su VM test
+
+```powershell
+cd N:\Code\Workspace\Local-CI-CD-System\template
+
+.\Deploy-WinBuild2025.ps1 `
+    -WinISO   'F:\CI\ISO\26100.1742.240906-0331.ge_release_svc_refresh_SERVER_VOL_x64FRE_en-us.iso' `
+    -ToolsISO 'F:\CI\ISO\VMware-tools-windows.iso' `
+    -VMXPath  'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' `
+    -VMName   'WinBuild2025-test' `
+    -ProductKey 'TVRH6-WHNXV-R9WG3-9XRFY-MY832'
+```
+
+Durata attesa: 30–90 min. Exit 0 = OK, snapshot `PostInstall` preso automaticamente.
+
+Se timeout su `install_complete.flag`: aumentare `-GuestPollMaxMinutes 120`.
+
+---
+
+## Step 2 — Verifica stato Deploy (§7.1 + §7.2)
+
+Sostituire `192.168.79.xxx` con IP reale della VM test (`ipconfig` dentro la VM).
+
+```powershell
+$ip   = '192.168.79.xxx'
+$cred = Get-Credential   # Administrator / WinBuild!
+$so   = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck
+
+Invoke-Command -ComputerName $ip -Credential $cred `
+    -Authentication Basic -SessionOption $so -ScriptBlock {
+
+    "=== §7.1 Firewall ==="
+    Get-NetFirewallProfile | Select-Object Name, Enabled
+
+    "=== §7.2 WU services ==="
+    Get-Service wuauserv, UsoSvc | Select-Object Name, StartType, Status
+
+    "=== §7.2 WU GPO ==="
+    $au = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'
+    $wu = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate'
+    [PSCustomObject]@{
+        NoAutoUpdate              = (Get-ItemProperty $au  -EA SilentlyContinue).NoAutoUpdate
+        DisableWindowsUpdateAccess = (Get-ItemProperty $wu -EA SilentlyContinue).DisableWindowsUpdateAccess
+    }
+
+    "=== §7.1 WinRM limits ==="
+    [PSCustomObject]@{
+        MaxMemoryPerShellMB = (Get-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB).Value
+        IdleTimeOut         = (Get-Item WSMan:\localhost\Shell\IdleTimeOut).Value
+    }
+
+    "=== §7.1 UAC ==="
+    Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' |
+        Select-Object EnableLUA, LocalAccountTokenFilterPolicy
+}
+```
+
+**Atteso**:
+| Check | Valore atteso |
+|---|---|
+| Firewall tutti profili | `Enabled=False` |
+| `wuauserv` StartType | `Manual` |
+| `UsoSvc` StartType | `Manual` |
+| `NoAutoUpdate` | `1` |
+| `DisableWindowsUpdateAccess` | `1` |
+| `MaxMemoryPerShellMB` | `>= 2048` |
+| `EnableLUA` | `0` |
+
+---
+
+## Step 3 — Prepare -SkipWindowsUpdate (Assert-Step validation)
+
+```powershell
+.\Prepare-WinBuild2025.ps1 `
+    -VMIPAddress 192.168.79.xxx `
+    -SkipWindowsUpdate
+```
+
+**Cosa verificare nel log**:
+- Step 1 (Firewall): solo `[OK]` — nessun `Set-NetFirewallProfile`
+- Step 3 (WinRM): solo `[OK]` — nessun `Enable-PSRemoting` né `winrm set`
+- Step 4b (UAC): solo `[OK]` — nessun `Set-ItemProperty EnableLUA`
+- Step 5b (Explorer): solo `[OK]`
+- Step 5c (CIUX): solo `[OK]`
+- Step 4 (user `ci_build`): crea utente — operativo, non validation
+- Step 5 (CI dirs): crea `C:\CI\{build,output,scripts}` — operativo
+- Step 6: `[Setup] Skipping Windows Update` — corretto con `-SkipWindowsUpdate`
+- Step 6b: disabilita wuauserv/UsoSvc — deve girare sempre
+- Step 7-10: .NET, Python, VS Build Tools installati
+- Final gate: tutti e 7 i check `[OK]`
+- Exit code: `0`
+
+Se un Assert-Step fallisce con `[FAIL]` su Step 1/3/4b/5b/5c → Deploy non ha applicato
+quel setting → debug Deploy post-install.ps1 (controllare log nella VM).
+
+---
+
+## Step 4 — Prepare senza -Skip (WU lifecycle §7.2)
+
+> Solo se Step 3 è passato. La VM deve avere internet (VMnet8 NAT).
+
+```powershell
+.\Prepare-WinBuild2025.ps1 -VMIPAddress 192.168.79.xxx
+```
+
+**Atteso**:
+- Step 6 Step A: rimuove `DisableWindowsUpdateAccess` e `NoAutoUpdate` GPO keys
+- Step 6 Step D: avvia wuauserv/UsoSvc/bits/cryptsvc (già Manual → solo Start)
+- Step 6: WU gira via SchTask SYSTEM, ResultCode ∈ {0, 2, 3}
+- Step 6b: `wuauserv StartType=Disabled`, `UsoSvc StartType=Disabled`, GPO keys re-scritti
+- Final gate `Windows Update permanently disabled` → `[OK]`
+- Exit code: `0` (o `3010` se WU richiede reboot — ripetere con `-SkipWindowsUpdate`)
+
+---
+
+## Step 5 — Snapshot e promozione (opzionale)
+
+Se tutti i check di Step 3 e 4 passano:
+
+```powershell
+# Spegni VM test
+& 'C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe' `
+    -T ws stop 'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' soft
+
+# Snapshot versionato
+& 'C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe' `
+    -T ws snapshot 'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' `
+    "BaseClean_$(Get-Date -Format yyyyMMdd)"
+```
+
+Per promuovere a produzione (rimpiazza template esistente):
+1. Copia `F:\CI\Templates\WinBuildTest\` → `F:\CI\Templates\WinBuild\` (backup prima)
+2. Aggiorna `GITEA_CI_TEMPLATE_PATH` in `runner/config.yaml` se path cambia
+3. Aggiorna `GITEA_CI_SNAPSHOT_NAME` se usi nome versionato (vedi TODO §2.5)
+
+---
+
+## Checklist §7.4 — COMPLETATA 2026-05-10
+
+- [x] Step 1: Deploy exit 0, snapshot `PostInstall` presente
+- [x] Step 2: Firewall=False, wuauserv=Manual, NoAutoUpdate=1, MaxMemory≥2048, UAC=0
+      (UsoSvc era Automatic — fix applicato in Deploy; corretto manualmente sulla VM test)
+- [x] Step 3: Prepare `-SkipWindowsUpdate` exit 0, nessun Set in Step 1/3/4b/5b/5c
+- [x] Step 4: Prepare senza `-Skip` exit 0 (WU: 0 update, ResultCode=0), wuauserv=Disabled post-Step 6b
+- [x] Snapshot `BaseClean` preso con successo
+
+**Fix applicati durante il test**:
+- Deploy: `UsoSvc` esplicitamente a `Manual` (era omesso, default Server 2025 = Automatic)
+- Setup cleanup: ri-applica `Disabled` su wuauserv/UsoSvc dopo DISM (WaaSMedicSvc resets StartType)
+- Deploy + Setup 5c: autologin Administrator (`AutoAdminLogon=1`, `DefaultUserName`, `DefaultPassword`, `DefaultDomainName`)
+- Nuovi: `Validate-DeployState.ps1`, `Validate-SetupState.ps1`

docs/WINDOWS-TEMPLATE-SETUP.md

@@ -9,12 +9,19 @@ credenziali archiviate, ISO Windows Server presente).
 
 ---
 
-## Architettura: due script
+## Architettura: tre script
 
 | Script                                   | Dove gira       | Scopo                                                               |
-| ---------------------------------------- | --------------- | -------------------------------------------------- |
-| `template/Prepare-WinBuild2025.ps1`     | **Host**        | Orchestratore: copia + esegue lo script in VM     |
-| `template/Setup-WinBuild2025.ps1`        | **Dentro VM**   | Provisioning effettivo (firewall, defender, tool) |
+| ---------------------------------------- | --------------- | ------------------------------------------------------------------- |
+| `template/Deploy-WinBuild2025.ps1`      | **Host**        | Opzionale: crea VM e installa Windows unattended da ISO             |
+| `template/Prepare-WinBuild2025.ps1`     | **Host**        | Orchestratore: copia + esegue Setup nel guest via WinRM             |
+| `template/Setup-WinBuild2025.ps1`       | **Dentro VM**   | CI toolchain (user, .NET, Python, VS) + validazione hardening Deploy |
+| `template/Validate-DeployState.ps1`     | **Host**        | Valida stato post-Deploy prima di eseguire Prepare                  |
+| `template/Validate-SetupState.ps1`      | **Host**        | Valida stato post-Setup (Deploy + Setup) prima dello snapshot       |
+
+**Confine Deploy / Setup** (refactor §7, 2026-05-10):
+- `Deploy-WinBuild2025.ps1` si occupa dell'**OS hardening** (Firewall, WinRM, UAC, Defender, UX tweaks, autologin Administrator, WU GPO locks). Se usato, Setup valida questi come Assert-Step senza re-applicarli.
+- `Setup-WinBuild2025.ps1` si occupa della **CI customization** (utente `ci_build`, cartelle `C:\CI`, toolchain .NET/Python/VS, Windows Update lifecycle, cleanup, final gate).
 
 `Prepare-WinBuild2025.ps1` apre una WinRM session, copia `Setup-WinBuild2025.ps1` in
 `C:\CI\`, lo esegue, raccoglie l'exit code, valida lo stato del guest.
@@ -30,7 +37,7 @@ credenziali archiviate, ISO Windows Server presente).
 | RAM                     | 6144 MB (6 GB)                                                  |
 | Disco                   | 80 GB thin provisioned                                          |
 | NIC                     | **VMnet8 (NAT)** — internet richiesto per WU + installer        |
-| VMX path                | `F:\CI\Templates\WinBuild\WinBuild.vmx`                         |
+| VMX path                | `F:\CI\Templates\WinBuild\CI-WinBuild.vmx`                      |
 | ISO                     | Windows Server 2025 (da `F:\CI\ISO\`)                           |
 
 ---
@@ -41,7 +48,7 @@ credenziali archiviate, ISO Windows Server presente).
 - File → New Virtual Machine → Custom
 - Hardware: 4 vCPU, 6144 MB, 80 GB thin
 - Network: **VMnet8 (NAT)**
-- VMX: `F:\CI\Templates\WinBuild\WinBuild.vmx`
+- VMX: `F:\CI\Templates\WinBuild\CI-WinBuild.vmx`
 - CD/DVD: monta ISO Windows Server 2025
 
 ### A.2 Installa Windows Server 2025
@@ -142,21 +149,22 @@ Ogni step ha validazione `Assert-Step` (throw on failure, `[OK]` su pass):
 
 ## Fase C — Cosa fa `Setup-WinBuild2025.ps1` (dentro la VM)
 
-Eseguito automaticamente da Prepare in Fase B. Ordine ottimizzato per ridurre overhead:
-tutti i tweak UI/registro sono raggruppati **prima** di Windows Update (operazione lenta).
-Ogni step ha validazione `Assert-Step`.
+Eseguito automaticamente da Prepare in Fase B. Steps 1/2/3/4b/5b/5c sono
+**validation-only** — verificano che Deploy abbia già applicato l'hardening OS.
+Steps 4/5/6/6b/7-10 eseguono la CI customization effettiva.
+Ogni step ha validazione `Assert-Step` (throw on failure).
 
 ```
-Step 1   Firewall off (Domain/Private/Public)             ── primo, rimuove blocchi
-Step 2   Defender + Antimalware off (Set-MpPreference + GPO)
-                                                           ── prima di WinRM e WU
-Step 3   WinRM hardening (Basic, AllowUnencrypted, 2 GB shell mem, 2h timeout)
-Step 4   Build user account (ci_build, admin, no expire)  ── prima di WU
-Step 4b  UAC off (EnableLUA=0, LocalAccountTokenFilterPolicy=1)
+Step 1   Firewall: validation only — Deploy disabled all profiles             [Assert-Step]
+Step 2   Defender: validation only — Deploy set DisableAntiSpyware GPO + RTP off [Assert-Step]
+Step 3   WinRM: validation only — Deploy set Basic/Unencrypted/MaxMem/Timeout [Assert-Step]
+Step 4   Build user account (ci_build, admin, no expire)  ── crea utente CI
+Step 4b  UAC: validation only — Deploy set EnableLUA=0 + TokenFilterPolicy    [Assert-Step]
 Step 5   CI dirs: C:\CI\{build, output, scripts}          ── C:\CI deve esistere prima di WU
-Step 5b  Explorer LaunchTo=1 (This PC)
-Step 5c  CI UX hardening: Server Manager off, DisableCAD, OOBE/telemetry off
-Step 6   Windows Update via Scheduled Task SYSTEM         ── senza scan Defender, C:\CI presente
+Step 5b  Explorer LaunchTo=1: validation only — Deploy set HKCU + Default hive [Assert-Step]
+Step 5c  CI UX hardening: validation only — Deploy set lock screen, SM policy/task,
+         DisableCAD, OOBE, telemetry, autologin Administrator                  [Assert-Step]
+Step 6   Windows Update via Scheduled Task SYSTEM         ── clears Deploy GPO locks, runs WU
 Step 6b  Windows Update permanently disabled (post-update lockdown)
 Step 7   .NET SDK install (channel via dotnet-install.ps1)
 Step 8   Python install (3.13.3, all-users, C:\Python)
@@ -168,41 +176,36 @@ Final    Pre-snapshot gate — 7 check cross-cutting + no installer leftover
 
 ### Razionale dell'ordine
 
-- **Firewall first** — Windows blocca alcune chiamate WinRM finché non è classificato il
-  profilo di rete. Off subito → niente race condition durante Step 3.
-- **Defender second** — disabilitato prima di WinRM e WU. WU scarica/installa update
-  senza scan (5-15 min risparmiati). Step 7-9 (download + install ~200-400 MB di
-  payload .NET/Python/VS) non vengono scansionati.
-- **WinRM third** — già non interferito da firewall/defender. Hardening pulito.
-- **User + UAC (4/4b)** — operazioni registro rapide; UAC off prima di dir/tool evita
-  prompt di elevazione; nessun motivo di aspettare WU.
+- **Steps 1-3 (validazioni)** — verificano prima le precondizioni Deploy (firewall off,
+  Defender off, WinRM pronto) in modo che i failure emergano subito, non a metà toolchain.
+- **User + UAC (4/4b)** — crea `ci_build`; valida UAC off (set da Deploy); UAC off prima
+  di dir/tool evita prompt di elevazione negli step 7-9.
 - **CI dirs prima di WU (Step 5)** — il worker WU scrive file temp in `C:\CI\`
   (`wu_worker.ps1`, `wu_result.txt`, ecc.); la directory deve esistere prima.
-- **UI tweaks (5b/5c)** — tutti i tweak registro raggruppati prima del WU (lento);
-  scritture veloci, nessuna dipendenza da WU o toolchain.
-- **WU sixth** — gira con tutto già off + `C:\CI` presente; condizioni ottimali.
-- **WU disable subito dopo** — snapshot cattura WU permanentemente off.
+- **UI tweaks (5b/5c)** — validazioni registro rapide; raggruppate prima di WU (lento).
+- **WU (Step 6)** — clears i GPO lock di Deploy (Step A), avvia COM API via SYSTEM task,
+  poi Step 6b re-disabilita tutto → snapshot cattura WU permanentemente off.
 - **Toolchain (7-9) last** — WU completato, nessun scan su payload installer.
 
 ### Validazioni per step (sintesi)
 
-| Step | Check chiave                                                                    |
-| ---- | ------------------------------------------------------------------------------- |
-| 1    | `Get-NetFirewallProfile -Profile Domain/Private/Public → Enabled=False`         |
-| 2    | 6 GPO key + `Set-MpPreference DisableRealtimeMonitoring=true` + ExclusionPath   |
-| 3    | WinRM Running+Automatic, AllowUnencrypted=true, Auth/Basic=true, MaxMem≥2048    |
-| 4    | User exists, enabled, PasswordNeverExpires, member of Administrators            |
-| 4b   | EnableLUA=0, LocalAccountTokenFilterPolicy=1                                    |
-| 5    | Ogni dir Test-Path -PathType Container                                          |
-| 5b   | HKCU LaunchTo=1                                                                 |
-| 5c   | ServerManager machine policy DoNotOpenAtLogon=1, HKCU DoNotOpenServerManagerAtLogon=1, DisableCAD=1, OOBE DisablePrivacyExperience=1, AllowTelemetry=0 |
-| 6    | ResultCode ∈ {0,2,3}, no reboot required (else exit 3010)                       |
-| 6b   | wuauserv StartType=Disabled, NoAutoUpdate=1, DisableWindowsUpdateAccess=1       |
-| 7    | `dotnet --version` channel match, machine PATH contiene `C:\dotnet`             |
-| 8    | `C:\Python\python.exe` esiste, version match esatto, PATH contiene `C:\Python`  |
-| 9    | MSBuild.exe esiste, esegue, PATH, `\VC\` dir presente                           |
-| 10   | dotnet+python+msbuild tutti risolvibili (throw, non più warn)                   |
-| Final| WinRM, firewall, user+admin, UAC, WU disabled, tutti tool, no leftover installer in `C:\CI` |
+| Step | Natura     | Check chiave                                                                   |
+| ---- | ---------- | ------------------------------------------------------------------------------ |
+| 1    | Assert     | `Get-NetFirewallProfile -Profile Domain/Private/Public → Enabled=False`        |
+| 2    | Assert     | GPO DisableAntiSpyware=1 (set da Deploy)                                       |
+| 3    | Assert     | WinRM Running+Automatic, AllowUnencrypted=true, Auth/Basic=true, MaxMem≥2048   |
+| 4    | Operativo  | User exists, enabled, PasswordNeverExpires, member of Administrators           |
+| 4b   | Assert     | EnableLUA=0, LocalAccountTokenFilterPolicy=1                                   |
+| 5    | Operativo  | Ogni dir Test-Path -PathType Container                                         |
+| 5b   | Assert     | HKCU LaunchTo=1                                                                |
+| 5c   | Assert+Op  | NoLockScreen=1, SM policy DoNotOpenAtLogon=1, SM task Disabled, DisableCAD=1, OOBE DisablePrivacyExperience=1, AllowTelemetry=0; AutoAdminLogon=1+DefaultUserName=Administrator re-affermati se assenti (Windows OOBE può resettarli al primo boot) |
+| 6    | Operativo  | ResultCode ∈ {0,2,3}, no reboot required (else exit 3010)                      |
+| 6b   | Operativo  | wuauserv StartType=Disabled, NoAutoUpdate=1, DisableWindowsUpdateAccess=1      |
+| 7    | Operativo  | `dotnet --version` channel match, machine PATH contiene `C:\dotnet`            |
+| 8    | Operativo  | `C:\Python\python.exe` esiste, version match esatto, PATH contiene `C:\Python` |
+| 9    | Operativo  | MSBuild.exe esiste, esegue, PATH, `\VC\` dir presente                          |
+| 10   | Operativo  | dotnet+python+msbuild tutti risolvibili (throw)                                |
+| Final| Cross-cut  | WinRM, firewall, user+admin, UAC, WU disabled, tutti tool, no leftover installer in `C:\CI` |
 
 ---
 
@@ -219,6 +222,35 @@ Final    Pre-snapshot gate — 7 check cross-cutting + no installer leftover
 
 ---
 
+## Validation scripts standalone
+
+Due script per validare il guest in punti specifici del flusso, indipendentemente da
+Prepare. Utili per debug, re-verifica dopo modifiche manuali, e CI automatizzata.
+
+### Dopo Deploy — prima di Prepare
+
+```powershell
+.\template\Validate-DeployState.ps1 -VMIPAddress 192.168.79.129
+```
+
+Controlla: Firewall off, Defender GPO, WinRM (Running/Automatic/AllowUnencrypted/Basic/MaxMem),
+UAC off, Explorer LaunchTo, NoLockScreen, Server Manager (policy+HKLM+task+HKCU),
+DisableCAD, OOBE, AllowTelemetry, **AutoAdminLogon=1**, WU GPO, wuauserv/UsoSvc=Manual.
+
+### Dopo Prepare — prima di snapshot
+
+```powershell
+.\template\Validate-SetupState.ps1 -VMIPAddress 192.168.79.129
+```
+
+Tutti i check Deploy + ci_build (exists/enabled/admin/PasswordNeverExpires),
+`C:\CI\{build,output,scripts}`, wuauserv/UsoSvc=Disabled, WU GPO,
+.NET SDK channel match, Python version match, MSBuild present, no leftover installer files.
+
+Exit 0 = tutto OK. Exit 1 = almeno un check fallito (output indica quale).
+
+---
+
 ## Fase E — Verifica finale
 
 Dall'host:

template/Deploy-WinBuild2025.ps1

@@ -14,11 +14,11 @@
                 via IMAPI2FS COM (built-in Windows, zero deps)
       Step 4  — Create the VMDK (80 GB single-file thin) via vmware-vdiskmanager
       Step 5  — Generate the .vmx (UEFI no SecureBoot, NVMe disk, e1000e NIC,
-                three CD-ROMs: Win install + autounattend + VMware Tools)
-      Step 6  — Power on the VM (vmrun start nogui)
+                two CD-ROMs: Win install + autounattend; Tools bundled inside autounattend)
+      Step 6  — Power on the VM (vmrun start gui/nogui — async to avoid Workstation hang)
       Step 7  — Wait for the install_complete.flag file inside the guest
                 (created by post-install.ps1 once Tools install finishes)
-      Step 8  — Graceful soft-stop, swap NIC e1000e → vmxnet3 in the .vmx
+      Step 8  — Graceful soft-stop, remove CD-ROM controller + USB from VMX, swap NIC e1000e → vmxnet3
       Step 9  — Power on, wait for guest IP via vmrun (vmxnet3 verified)
       Step 10 — Take snapshot named $SnapshotName
       Final   — Print summary (VM path, IP, snapshot name)
@@ -36,13 +36,22 @@
 
     Hardening done by post-install.ps1 inside the guest:
       - UAC off (EnableLUA=0, LocalAccountTokenFilterPolicy=1)
-      - Defender real-time protection off
+      - Defender real-time protection off + DisableAntiSpyware=1 GPO
       - DiagTrack/Telemetry off
-      - Windows Update services disabled
-      - RDP enabled (no NLA, lab only) + firewall rule
-      - WinRM enabled HTTP 5985 + HTTPS 5986 (self-signed cert), Basic auth,
-        AllowUnencrypted, TrustedHosts=*
+      - Windows Update GPO locks (NoAutoUpdate=1, DisableWindowsUpdateAccess=1);
+        services remain Manual — Setup-WinBuild2025 Step 6b permanently disables
+        them after applying updates (§7.2 Strategy B)
+      - Windows Firewall all profiles disabled (VMnet8 NAT lab; Setup Step 1 validates)
+      - RDP enabled (no NLA, lab only) + firewall rules for RDP/ICMP/WinRM-HTTPS
+      - WinRM HTTP 5985 + HTTPS 5986 (self-signed cert), Basic auth,
+        AllowUnencrypted, TrustedHosts=*, MaxMemory=2048MB, IdleTimeout=2h, MaxProcesses=25
       - ICMPv4 inbound allowed
+      - Lock screen disabled, Server Manager (policy + HKLM + task + HKCU + Default hive),
+        DisableCAD (Policies\System + Winlogon), OOBE/telemetry suppressed;
+        Setup-WinBuild2025 Step 5b/5c validate all of these
+      - Taskbar search bar hidden, Task View button hidden
+      - Windows Terminal set as default terminal (DelegationConsole/Terminal HKCU + Default hive)
+      - Azure Arc auto-start, scheduled tasks, and himds service disabled
       - VMware Tools installed (Complete) from Tools ISO
       - install_complete.flag dropped in C:\Windows\Temp
 
@@ -50,7 +59,8 @@
     Path to the Windows Server 2025 install ISO.
 
 .PARAMETER ToolsISO
-    Path to the VMware Tools ISO (windows.iso).
+    Path to the VMware Tools ISO (windows.iso). Contents are extracted and bundled
+    inside the autounattend ISO at build time (Step 3); not mounted as a separate CD-ROM.
 
 .PARAMETER VMXPath
     Full path of the .vmx file to create. The folder is created if missing.
@@ -138,7 +148,7 @@ param(
     # ── Hardware ──
     [int] $DiskSizeGB    = 80,
     [int] $MemoryMB      = 6144,
-    [int] $VCPUCount     = 2,
+    [int] $VCPUCount     = 4,
     [int] $CoresPerSocket = 2,
 
     # ── Locale ──
@@ -159,7 +169,14 @@ param(
 
     # When set, vmrun powers on the VM with the Workstation GUI visible.
     # Default: headless (nogui) for unattended pipelines.
-    [switch] $ShowGui
+    [switch] $ShowGui,
+
+    # Skip straight to this step number. All derived paths are still computed;
+    # artifacts from skipped steps must already exist on disk.
+    # Steps: 1=preflight 2=render XML 3=autounattend ISO 4=VMDK+noPromptISO
+    #        5=VMX 6=power on 7=wait flag 8=stop+NIC 9=power on vmxnet3 10=snapshot
+    [ValidateRange(1,10)]
+    [int] $StartFromStep = 1
 )
 
 $vmrunUiMode = if ($ShowGui) { 'gui' } else { 'nogui' }
@@ -172,8 +189,13 @@ $ErrorActionPreference = 'Stop'
 # ─────────────────────────────────────────────────────────────────────────────
 
 function Write-Step {
-    param([string]$Message)
+    param([string] $Message, [int] $Step = 0)
+    $skipped = $Step -gt 0 -and $script:StartFromStep -gt $Step
+    if ($skipped) {
+        Write-Host "`n=== $Message === [SKIP]" -ForegroundColor DarkGray
+    } else {
         Write-Host "`n=== $Message ===" -ForegroundColor Cyan
+    }
 }
 
 function Assert-Step {
@@ -344,8 +366,14 @@ function New-WinIsoNoPrompt {
 
 function Invoke-Vmrun {
     param([Parameter(Mandatory)] [string[]] $Arguments,
-          [switch] $IgnoreErrors)
+          [switch] $IgnoreErrors,
+          [switch] $Async)
     $vmrun = Join-Path $VMwareWorkstationDir 'vmrun.exe'
+    if ($Async) {
+        # vmrun start can block indefinitely on some Workstation versions; fire async.
+        Start-Process -FilePath $vmrun -ArgumentList $Arguments -NoNewWindow
+        return
+    }
     $stdout = & $vmrun @Arguments 2>&1
     $code = $LASTEXITCODE
     if ($code -ne 0 -and -not $IgnoreErrors) {
@@ -371,15 +399,80 @@ function Set-VmxKey {
     Set-Content -LiteralPath $VmxPath -Value $newLines -Encoding ASCII
 }
 
+function Remove-VmxLines {
+    param([Parameter(Mandatory)] [string] $VmxPath,
+          [Parameter(Mandatory)] [string] $KeyPrefix)
+    $pat = "^\s*$([regex]::Escape($KeyPrefix))"
+    $lines = Get-Content -LiteralPath $VmxPath | Where-Object { $_ -notmatch $pat }
+    Set-Content -LiteralPath $VmxPath -Value $lines -Encoding ASCII
+}
+
+function Test-VmInList {
+    param([Parameter(Mandatory)] [string] $VmxPath)
+    $list    = Invoke-Vmrun -Arguments @('-T','ws','list') -IgnoreErrors
+    $forward = $VmxPath -replace '\\', '/'
+    $back    = $VmxPath -replace '/', '\'
+    return ($list -match [regex]::Escape($forward)) -or ($list -match [regex]::Escape($back))
+}
+
+function Invoke-VmrunBounded {
+    # Run vmrun synchronously but kill the vmrun process after $TimeoutSeconds.
+    # Useful for 'stop soft': vmrun blocks until guest shuts down, but the ACPI
+    # signal is sent within seconds — killing vmrun doesn't cancel the guest shutdown.
+    param([Parameter(Mandatory)] [string[]] $Arguments,
+          [int] $TimeoutSeconds = 30)
+    $exe  = Join-Path $VMwareWorkstationDir 'vmrun.exe'
+    $proc = Start-Process -FilePath $exe -ArgumentList $Arguments -NoNewWindow -PassThru
+    $null = $proc.WaitForExit($TimeoutSeconds * 1000)
+    if (-not $proc.HasExited) { $proc.Kill() }
+}
+
+function Stop-Vm {
+    param([Parameter(Mandatory)] [string] $VmxPath,
+          [int] $SoftTimeoutMinutes = 5)
+    # Send soft-stop (ACPI); vmrun may block until guest finishes — kill vmrun after 30 s.
+    # Guest OS continues shutdown independently once the signal is received.
+    Invoke-VmrunBounded -Arguments @('-T','ws','stop',$VmxPath,'soft') -TimeoutSeconds 30
+    $deadline = (Get-Date).AddMinutes($SoftTimeoutMinutes)
+    do {
+        Start-Sleep -Seconds 5
+    } while ((Get-Date) -lt $deadline -and (Test-VmInList -VmxPath $VmxPath))
+    if (Test-VmInList -VmxPath $VmxPath) {
+        Write-Host '  soft stop timed out — hard stop'
+        Invoke-VmrunBounded -Arguments @('-T','ws','stop',$VmxPath,'hard') -TimeoutSeconds 15
+        Start-Sleep -Seconds 5
+    }
+}
+
 # ─────────────────────────────────────────────────────────────────────────────
 # Step 1: Pre-flight validation
 # ─────────────────────────────────────────────────────────────────────────────
-Write-Step 'Step 1: pre-flight validation'
-
+# ── Derived paths — always computed regardless of -StartFromStep ─────────────
 $vmrunPath  = Join-Path $VMwareWorkstationDir 'vmrun.exe'
 $vdiskMgr   = Join-Path $VMwareWorkstationDir 'vmware-vdiskmanager.exe'
 $scriptRoot = Split-Path -Parent $PSCommandPath
 $xmlTemplate = Join-Path $scriptRoot 'autounattend.template.xml'
+$vmDir           = Split-Path -Parent $VMXPath
+$vmdkName        = [IO.Path]::GetFileNameWithoutExtension($VMXPath) + '.vmdk'
+$vmdkPath        = Join-Path $vmDir $vmdkName
+$autounattendIso = Join-Path $vmDir 'autounattend.iso'
+$stagingDir      = Join-Path $vmDir '_autounattend_staging'
+$guestOS         = 'windows2019srvnext-64'
+$guestIP         = $null   # set in Step 9; pre-init for strict-mode safety
+if ([string]::IsNullOrWhiteSpace($WinISONoPromptPath)) {
+    $srcDir  = Split-Path -Parent $WinISO
+    $srcBase = [IO.Path]::GetFileNameWithoutExtension($WinISO)
+    $WinISONoPromptPath = Join-Path $srcDir "$srcBase.patched.iso"
+}
+if ($StartFromStep -gt 1) {
+    Write-Host "  [SKIP] Steps 1..$($StartFromStep - 1) — starting from Step $StartFromStep" -ForegroundColor Yellow
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Step 1: pre-flight validation
+# ─────────────────────────────────────────────────────────────────────────────
+Write-Step 'Step 1: pre-flight validation' -Step 1
+if ($StartFromStep -le 1) {
 
 Assert-Step 'PreFlight' "vmrun.exe found at $vmrunPath"               { Test-Path $vmrunPath }
 Assert-Step 'PreFlight' "vmware-vdiskmanager.exe found at $vdiskMgr"  { Test-Path $vdiskMgr }
@@ -389,26 +482,21 @@ Assert-Step 'PreFlight' "autounattend template exists: $xmlTemplate"  { Test-Pat
 Assert-Step 'PreFlight' "ComputerName valid (1-15 chars, no spaces)"  {
     $ComputerName -match '^[A-Za-z0-9-]{1,15}$'
 }
-
-$vmDir = Split-Path -Parent $VMXPath
 if (-not (Test-Path $vmDir)) {
     New-Item -ItemType Directory -Path $vmDir -Force | Out-Null
 }
 Assert-Step 'PreFlight' "VM directory ready: $vmDir" { Test-Path $vmDir }
-
 if (Test-Path $VMXPath) {
     throw "[PreFlight] $VMXPath already exists. Remove the existing VM folder before re-running."
 }
 
-$vmdkName  = [IO.Path]::GetFileNameWithoutExtension($VMXPath) + '.vmdk'
-$vmdkPath  = Join-Path $vmDir $vmdkName
-$autounattendIso = Join-Path $vmDir 'autounattend.iso'
-$stagingDir      = Join-Path $vmDir '_autounattend_staging'
+} # end Step 1
 
 # ─────────────────────────────────────────────────────────────────────────────
 # Step 2: render autounattend.xml + post-install.ps1
 # ─────────────────────────────────────────────────────────────────────────────
-Write-Step 'Step 2: render autounattend.xml + post-install.ps1'
+Write-Step 'Step 2: render autounattend.xml + post-install.ps1' -Step 2
+if ($StartFromStep -le 2) {
 
 if (Test-Path $stagingDir) { Remove-Item $stagingDir -Recurse -Force }
 New-Item -ItemType Directory -Path $stagingDir -Force | Out-Null
@@ -506,15 +594,23 @@ sc.exe config DiagTrack start= disabled | Out-Null
 sc.exe stop   DiagTrack                 | Out-Null
 L 'Telemetry disabled'
 
-# ── Windows Update services disabled ──────────────────────────────────────
-foreach (`$svc in 'wuauserv','UsoSvc','WaaSMedicSvc') {
-    sc.exe config `$svc start= disabled | Out-Null
-    sc.exe stop   `$svc                  | Out-Null
-}
+# ── Windows Update GPO locks — services left Manual (§7.2 Strategy B) ───
+# Set both WU services to Manual so they can be invoked on-demand by Setup
+# Step 6 (WU COM API via SYSTEM task) but won't auto-start between Deploy and Setup.
+# UsoSvc defaults to Automatic on Windows Server 2025; must be explicit here.
+# GPO keys below also block background triggers. Step 6b permanently disables both.
+Set-Service -Name wuauserv -StartupType Manual -ErrorAction SilentlyContinue
+Set-Service -Name UsoSvc   -StartupType Manual -ErrorAction SilentlyContinue
+reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate'    /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f | Out-Null
 reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' /v NoAutoUpdate              /t REG_DWORD /d 1 /f | Out-Null
-L 'Windows Update disabled'
+L 'Windows Update GPO locks set + wuauserv/UsoSvc Manual (Setup Step 6b permanently disables)'
 
-# ── Firewall: profiles stay default; allow RDP + ICMP + WinRM HTTPS ──────
+# ── Firewall: all profiles disabled + allow RDP + ICMP + WinRM HTTPS ─────
+# Disabling all profiles removes any block on subsequent WinRM config and WU
+# downloads. This VM lives on VMnet8 NAT behind the VMware NAT gateway — no
+# inbound exposure from outside the host. Setup-WinBuild2025 Step 1 validates.
+Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled False
+L 'Windows Firewall disabled on all profiles'
 reg add 'HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server' /v fDenyTSConnections /t REG_DWORD /d 0 /f | Out-Null
 reg add 'HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' /v UserAuthentication /t REG_DWORD /d 0 /f | Out-Null
 Enable-NetFirewallRule -DisplayGroup 'Remote Desktop' -ErrorAction SilentlyContinue
@@ -533,6 +629,11 @@ try {
     New-NetFirewallRule -DisplayName 'WinRM-HTTPS' -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow -Profile Any | Out-Null
     L 'WinRM HTTPS listener configured'
 } catch { L "WinRM HTTPS failed: `$(`$_.Exception.Message)" }
+winrm set winrm/config/winrs '@{MaxProcessesPerShell="25"}' | Out-Null
+Set-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB 2048   -Force 3>`$null
+Set-Item WSMan:\localhost\Shell\IdleTimeOut         7200000 -Force 3>`$null
+Set-Service -Name WinRM -StartupType Automatic 3>`$null
+L 'WinRM shell limits: MaxMemory=2048MB IdleTimeout=2h MaxProcesses=25; StartType=Automatic'
 
 # ── Server Manager / WAC popup / first-logon UX ──────────────────────────
 # Server Manager auto-start off — machine-wide + current Administrator + Default
@@ -549,6 +650,24 @@ reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v Disa
 # OOBE privacy experience suppressed
 reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE' /v DisablePrivacyExperience /t REG_DWORD /d 1 /f | Out-Null
 L 'Server Manager + WAC + CAD + OOBE prompts disabled'
+# Supplemental UX hardening validated by Setup-WinBuild2025 Step 5c:
+# Lock screen: suppress at CI console sessions (no interactive user ever logs in)
+reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization' /v NoLockScreen /t REG_DWORD /d 1 /f | Out-Null
+# Server Manager GPO policy key (authoritative path on WS2025; HKLM key above is not always honoured)
+reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\ServerManager' /v DoNotOpenAtLogon /t REG_DWORD /d 1 /f | Out-Null
+# Server Manager scheduled task — the actual launcher on WS2025; registry alone insufficient
+schtasks /Change /TN '\Microsoft\Windows\Server Manager\ServerManager' /Disable 2>&1 | Out-Null
+# DisableCAD in Winlogon (belt-and-suspenders with Policies\System key set above)
+reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' /v DisableCAD /t REG_DWORD /d 1 /f | Out-Null
+# Autologin — Administrator auto-signs in after every boot (CI template convenience).
+# Password stored plaintext in registry; acceptable for isolated VMnet8 NAT lab VM.
+reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' /v AutoAdminLogon   /t REG_SZ /d 1             /f | Out-Null
+reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' /v DefaultUserName  /t REG_SZ /d Administrator /f | Out-Null
+reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' /v DefaultPassword  /t REG_SZ /d "$AdminPassword" /f | Out-Null
+reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' /v DefaultDomainName /t REG_SZ /d '.'           /f | Out-Null
+# OOBE non-policy key (supplements the Policies\Windows\OOBE key set above)
+reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE' /v DisablePrivacyExperience /t REG_DWORD /d 1 /f | Out-Null
+L 'Lock screen, SM GPO policy + task, CAD Winlogon, autologin Administrator, OOBE non-policy key set'
 
 # ── IE Enhanced Security Configuration off (Admin) ───────────────────────
 # Long-known CI papercut: ESC blocks every URL in admin sessions.
@@ -557,6 +676,13 @@ reg add 'HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37E
 Stop-Process -Name iexplore -ErrorAction SilentlyContinue
 L 'IE ESC disabled'
 
+# ── Remove drive letter from EFI System Partition ────────────────────────
+# Windows setup sometimes assigns 'S:' to the ESP making it visible in Explorer.
+Get-Partition | Where-Object { `$_.DriveLetter -eq 'S' } | ForEach-Object {
+    `$_ | Remove-PartitionAccessPath -AccessPath 'S:\' -ErrorAction SilentlyContinue
+}
+L 'EFI partition drive letter removed (if any)'
+
 # ── Hibernate off (frees ~RAM-size on C:, no need on VMs) ────────────────
 powercfg /h off 2>&1 | Out-Null
 # Power plan High Performance — never sleep, never throttle CPU
@@ -591,11 +717,51 @@ foreach (`$task in @(
 }
 L 'CEIP / feedback scheduled tasks disabled'
 
+# ── Azure Arc auto-start / tray icon off ────────────────────────────────
+# Server 2025 ships with Azure Arc integration enabled; suppress for CI VMs.
+foreach (`$arcTask in @(
+    '\Microsoft\Azure Arc\Onboarding\EnableAzureArcSetup',
+    '\Microsoft\Azure Arc\Onboarding\ArcScan',
+    '\Microsoft\AzureArcSeamlessOnboarding\ArcSetup'
+)) {
+    schtasks /Change /TN `$arcTask /Disable 2>&1 | Out-Null
+}
+foreach (`$arcSvc in 'himds','ArcProxyAgent') {
+    `$s = Get-Service -Name `$arcSvc -ErrorAction SilentlyContinue
+    if (`$s) {
+        sc.exe config `$arcSvc start= disabled | Out-Null
+        sc.exe stop   `$arcSvc                 2>&1 | Out-Null
+    }
+}
+reg add 'HKLM\SOFTWARE\Microsoft\AzureArc' /v OnboardingState /t REG_DWORD /d 4 /f 2>&1 | Out-Null
+reg delete 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' /v AzureArcSetup /f 2>&1 | Out-Null
+L 'Azure Arc auto-start disabled'
+
 # ── Explorer UX: show file extensions + open to This PC ──────────────────
 reg add 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' /v HideFileExt /t REG_DWORD /d 0 /f | Out-Null
 reg add 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' /v LaunchTo    /t REG_DWORD /d 1 /f | Out-Null
 L 'Explorer UX tweaks applied (HKCU)'
 
+# ── Taskbar / terminal UX tweaks ─────────────────────────────────────────
+# SearchboxTaskbarMode=0   hide search bar
+# ShowTaskViewButton=0     hide Task View button
+# DelegationConsole/Terminal  Windows Terminal as default terminal
+# LayoutModification.xml   pre-pin Windows Terminal for new user profiles
+
+# HKCU (SYSTEM context at FirstLogon)
+reg add 'HKCU\Software\Microsoft\Windows\CurrentVersion\Search'            /v SearchboxTaskbarMode /t REG_DWORD /d 0 /f | Out-Null
+reg add 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' /v ShowTaskViewButton    /t REG_DWORD /d 0 /f | Out-Null
+reg add 'HKCU\Console\%Startup' /v DelegationConsole  /t REG_SZ /d '{E12CFF52-A866-4C77-9A90-F570A7AA2C6B}' /f | Out-Null
+reg add 'HKCU\Console\%Startup' /v DelegationTerminal /t REG_SZ /d '{E12CFF52-A866-4C77-9A90-F570A7AA2C6B}' /f | Out-Null
+# Default hive — Administrator + any future user inherits on first interactive logon
+reg load HKU\DefaultUser2 'C:\Users\Default\NTUSER.DAT' 2>&1 | Out-Null
+reg add 'HKU\DefaultUser2\Software\Microsoft\Windows\CurrentVersion\Search'            /v SearchboxTaskbarMode /t REG_DWORD /d 0 /f | Out-Null
+reg add 'HKU\DefaultUser2\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' /v ShowTaskViewButton    /t REG_DWORD /d 0 /f | Out-Null
+reg add 'HKU\DefaultUser2\Console\%Startup' /v DelegationConsole  /t REG_SZ /d '{E12CFF52-A866-4C77-9A90-F570A7AA2C6B}' /f | Out-Null
+reg add 'HKU\DefaultUser2\Console\%Startup' /v DelegationTerminal /t REG_SZ /d '{E12CFF52-A866-4C77-9A90-F570A7AA2C6B}' /f | Out-Null
+reg unload HKU\DefaultUser2 2>&1 | Out-Null
+L 'Taskbar: search hidden, task view hidden, WT default terminal'
+
 # ── Wait for VMware Tools install to settle (kicked off at top) ──────────
 # Wrapper returned immediately while msiexec runs async. Poll until:
 #   (a) no setup/setup64/vminst wrapper process (excludes system msiexec /V)
@@ -634,9 +800,11 @@ if (`$toolsExe) {
 New-Item -ItemType File -Path 'C:\Windows\Temp\install_complete.flag' -Force | Out-Null
 L 'install_complete.flag dropped'
 
-# ── Reboot to apply Tools/UAC/services state cleanly ──────────────────────
-L 'rebooting in 15s'
-shutdown /r /t 15 /f /c "post-install complete"
+# ── Shut down (not restart) so host Step 8 can swap NIC and snapshot ──────
+# Delay 60s: host polls every 30s, needs one cycle after flag appears.
+# Step 8 sends vmrun stop soft on top of this — Windows handles both.
+L 'shutting down in 60s'
+shutdown /s /t 60 /f /c "post-install complete"
 "@
 $psOut = Join-Path $stagingDir 'post-install.ps1'
 Set-Content -LiteralPath $psOut -Value $postInstall -Encoding UTF8
@@ -660,10 +828,13 @@ Assert-Step 'Render' 'Tools setup bundled in staging\Tools' {
     (Test-Path (Join-Path $toolsStage 'setup64.exe'))
 }
 
+} # end Step 2
+
 # ─────────────────────────────────────────────────────────────────────────────
 # Step 3: build autounattend ISO
 # ─────────────────────────────────────────────────────────────────────────────
-Write-Step 'Step 3: build autounattend ISO via IMAPI2FS'
+Write-Step 'Step 3: build autounattend ISO via IMAPI2FS' -Step 3
+if ($StartFromStep -le 3) {
 
 New-IsoFromFolder -SourceFolder $stagingDir -IsoPath $autounattendIso -VolumeLabel 'AUTOUNATTEND'
 Assert-Step 'IsoBuild' "autounattend.iso created at $autounattendIso" { Test-Path $autounattendIso }
@@ -678,10 +849,13 @@ if (Test-Path $stagingDir) {
     Write-Host "  [warn] staging dir not fully cleaned, leaving in place: $stagingDir" -ForegroundColor Yellow
 }
 
+} # end Step 3
+
 # ─────────────────────────────────────────────────────────────────────────────
-# Step 4: create VMDK
+# Step 4: create VMDK + no-prompt Windows ISO
 # ─────────────────────────────────────────────────────────────────────────────
-Write-Step "Step 4: create $DiskSizeGB GB VMDK (single-file growable)"
+Write-Step "Step 4: create $DiskSizeGB GB VMDK (single-file growable)" -Step 4
+if ($StartFromStep -le 4) {
 
 # -t 0 = single growable file (thin); -a lsilogic affects descriptor only,
 # the disk attaches to the NVMe controller defined in the VMX.
@@ -693,13 +867,7 @@ Assert-Step 'Vmdk' "VMDK file present: $vmdkPath" { Test-Path $vmdkPath }
 # ─────────────────────────────────────────────────────────────────────────────
 # Step 4b: rebuild Windows ISO with EFI no-prompt boot image
 # ─────────────────────────────────────────────────────────────────────────────
-Write-Step 'Step 4b: build no-prompt Windows ISO (skips "Press any key")'
-
-if ([string]::IsNullOrWhiteSpace($WinISONoPromptPath)) {
-    $srcDir  = Split-Path -Parent $WinISO
-    $srcBase = [IO.Path]::GetFileNameWithoutExtension($WinISO)
-    $WinISONoPromptPath = Join-Path $srcDir "$srcBase.patched.iso"
-}
+Write-Step 'Step 4b: build no-prompt Windows ISO (skips "Press any key")' -Step 4
 
 $srcMtime = (Get-Item $WinISO).LastWriteTime
 $rebuild  = $true
@@ -717,21 +885,24 @@ if ($rebuild) {
 Assert-Step 'NoPromptIso' "no-prompt ISO present: $WinISONoPromptPath" { Test-Path $WinISONoPromptPath }
 Assert-Step 'NoPromptIso' 'no-prompt ISO non-empty (>500 MB)' { (Get-Item $WinISONoPromptPath).Length -gt 500MB }
 
+} # end Step 4
+
 # ─────────────────────────────────────────────────────────────────────────────
 # Step 5: generate VMX
 # ─────────────────────────────────────────────────────────────────────────────
-Write-Step 'Step 5: generate VMX'
+Write-Step 'Step 5: generate VMX' -Step 5
+if ($StartFromStep -le 5) {
 
 # guestOS:
 #   "windows2019srvnext-64" is the generic forward-compat ID for new Windows
 #   Server releases on Workstation. Workstation 17.6+ accepts it for Server 2025.
 #   If your Workstation version supports the explicit ID, change it here.
-$guestOS = 'windows2019srvnext-64'
+# ($guestOS is set unconditionally in the derived-paths block above.)
 
 # CD-ROM ordering (sata):
 #   sata0:0 = Windows install ISO (bootable) ← EFI picks this on first boot
-#   sata0:1 = autounattend ISO              (non-bootable, scanned by Setup)
-#   sata0:2 = VMware Tools ISO              (Tools installer source)
+#   sata0:1 = autounattend ISO (non-bootable, scanned by Setup; Tools bundled inside)
+# Both disconnected in Step 8 after install — snapshot/clone boots clean with no ISOs.
 $vmxLines = @(
     '.encoding = "windows-1252"',
     'config.version = "8"',
@@ -774,7 +945,7 @@ $vmxLines = @(
     "nvme0:0.fileName = `"$vmdkName`"",
     'nvme0:0.deviceType = "disk"',
     '',
-    '# Three SATA CD-ROMs: install / autounattend / Tools',
+    '# Two SATA CD-ROMs: install ISO + autounattend ISO (Tools bundled in autounattend)',
     'sata0.present = "TRUE"',
     'sata0.pciSlotNumber = "32"',
     'sata0:0.present = "TRUE"',
@@ -785,10 +956,6 @@ $vmxLines = @(
     'sata0:1.deviceType = "cdrom-image"',
     "sata0:1.fileName = `"$autounattendIso`"",
     'sata0:1.startConnected = "TRUE"',
-    'sata0:2.present = "TRUE"',
-    'sata0:2.deviceType = "cdrom-image"',
-    "sata0:2.fileName = `"$ToolsISO`"",
-    'sata0:2.startConnected = "TRUE"',
     '',
     '# NIC: e1000e for install (broad compat); switched to vmxnet3 after Tools',
     'ethernet0.present = "TRUE"',
@@ -822,19 +989,23 @@ $vmxLines = @(
 Set-Content -LiteralPath $VMXPath -Value $vmxLines -Encoding ASCII
 Assert-Step 'Vmx' "VMX written: $VMXPath" { Test-Path $VMXPath }
 
+} # end Step 5
+
 # ─────────────────────────────────────────────────────────────────────────────
 # Step 6: power on VM
 # ─────────────────────────────────────────────────────────────────────────────
-Write-Step 'Step 6: power on VM (vmrun start nogui)'
-Invoke-Vmrun -Arguments @('-T','ws','start',$VMXPath,$vmrunUiMode) | Out-Null
-Start-Sleep -Seconds 5
-$running = Invoke-Vmrun -Arguments @('-T','ws','list') -IgnoreErrors
-Assert-Step 'PowerOn' 'VM appears in vmrun list' { $running -match [regex]::Escape($VMXPath) }
+Write-Step "Step 6: power on VM (vmrun start $vmrunUiMode)" -Step 6
+if ($StartFromStep -le 6) {
+Invoke-Vmrun -Arguments @('-T','ws','start',$VMXPath,$vmrunUiMode) -Async
+Start-Sleep -Seconds 10
+Assert-Step 'PowerOn' 'VM appears in vmrun list' { Test-VmInList -VmxPath $VMXPath }
+} # end Step 6
 
 # ─────────────────────────────────────────────────────────────────────────────
 # Step 7: wait for install_complete.flag inside guest
 # ─────────────────────────────────────────────────────────────────────────────
-Write-Step "Step 7: wait for guest install_complete.flag (max ${GuestPollMaxMinutes} min)"
+Write-Step "Step 7: wait for guest install_complete.flag (max ${GuestPollMaxMinutes} min)" -Step 7
+if ($StartFromStep -le 7) {
 
 $deadline = (Get-Date).AddMinutes($GuestPollMaxMinutes)
 $flagPath = 'C:\Windows\Temp\install_complete.flag'
@@ -853,22 +1024,24 @@ while ((Get-Date) -lt $deadline) {
 }
 Assert-Step 'GuestReady' "install_complete.flag observed in guest" { $flagSeen }
 
-# ─────────────────────────────────────────────────────────────────────────────
-# Step 8: graceful soft-stop, swap NIC e1000e → vmxnet3
-# ─────────────────────────────────────────────────────────────────────────────
-Write-Step 'Step 8: stop VM softly, swap NIC to vmxnet3'
+} # end Step 7
 
-Invoke-Vmrun -Arguments @('-T','ws','stop',$VMXPath,'soft') -IgnoreErrors | Out-Null
+# ─────────────────────────────────────────────────────────────────────────────
+# Step 8: stop VM, disconnect ISOs, swap NIC e1000e → vmxnet3
+# ─────────────────────────────────────────────────────────────────────────────
+Write-Step 'Step 8: stop VM, disconnect ISOs, swap NIC to vmxnet3' -Step 8
+if ($StartFromStep -le 8) {
 
-# Wait for VM to drop out of running list (max 3 min).
-$stopDeadline = (Get-Date).AddMinutes(3)
-do {
-    Start-Sleep -Seconds 5
-    $still = Invoke-Vmrun -Arguments @('-T','ws','list') -IgnoreErrors
-} while ((Get-Date) -lt $stopDeadline -and ($still -match [regex]::Escape($VMXPath)))
-Assert-Step 'Stop' 'VM no longer in vmrun list' {
-    $list = Invoke-Vmrun -Arguments @('-T','ws','list') -IgnoreErrors
-    -not ($list -match [regex]::Escape($VMXPath))
+Stop-Vm -VmxPath $VMXPath
+Assert-Step 'Stop' 'VM no longer in vmrun list' { -not (Test-VmInList -VmxPath $VMXPath) }
+
+# Remove CD-ROM controller and USB from VMX — not needed post-install.
+foreach ($prefix in 'sata0','usb','ehci','usb_xhci') {
+    Remove-VmxLines -VmxPath $VMXPath -KeyPrefix $prefix
+}
+Assert-Step 'CleanVmx' 'CD-ROM and USB entries removed from VMX' {
+    $vmx = Get-Content -LiteralPath $VMXPath -Raw
+    ($vmx -notmatch '(?m)^\s*sata0') -and ($vmx -notmatch '(?m)^\s*usb')
 }
 
 Set-VmxKey -VmxPath $VMXPath -Key 'ethernet0.virtualDev' -Value 'vmxnet3'
@@ -876,12 +1049,16 @@ Assert-Step 'NicSwap' 'ethernet0.virtualDev = vmxnet3' {
     (Get-Content -LiteralPath $VMXPath) -match '^\s*ethernet0\.virtualDev\s*=\s*"vmxnet3"\s*$'
 }
 
+} # end Step 8
+
 # ─────────────────────────────────────────────────────────────────────────────
 # Step 9: power on, verify vmxnet3 + DHCP IP
 # ─────────────────────────────────────────────────────────────────────────────
-Write-Step 'Step 9: power on with vmxnet3, verify DHCP IP'
+Write-Step 'Step 9: power on with vmxnet3, verify DHCP IP' -Step 9
+if ($StartFromStep -le 9) {
 
-Invoke-Vmrun -Arguments @('-T','ws','start',$VMXPath,$vmrunUiMode) | Out-Null
+Invoke-Vmrun -Arguments @('-T','ws','start',$VMXPath,$vmrunUiMode) -Async
+Start-Sleep -Seconds 10
 $ipDeadline = (Get-Date).AddMinutes(10)
 $guestIP = $null
 do {
@@ -891,27 +1068,23 @@ do {
 } while ((Get-Date) -lt $ipDeadline -and -not ($guestIP -match '^\d+\.\d+\.\d+\.\d+'))
 Assert-Step 'IPCheck' 'Guest IP obtained on vmxnet3' { $guestIP -match '^\d+\.\d+\.\d+\.\d+' }
 
+} # end Step 9
+
 # ─────────────────────────────────────────────────────────────────────────────
 # Step 10: shutdown → snapshot (cold) → power on
 # ─────────────────────────────────────────────────────────────────────────────
-Write-Step "Step 10: graceful shutdown, snapshot '$SnapshotName' (cold), power on"
+Write-Step "Step 10: graceful shutdown, snapshot '$SnapshotName' (cold), power on" -Step 10
+if ($StartFromStep -le 10) {
 
-Invoke-Vmrun -Arguments @('-T','ws','stop',$VMXPath,'soft') -IgnoreErrors | Out-Null
-$stopDeadline = (Get-Date).AddMinutes(3)
-do {
-    Start-Sleep -Seconds 5
-    $running = Invoke-Vmrun -Arguments @('-T','ws','list') -IgnoreErrors
-} while ((Get-Date) -lt $stopDeadline -and ($running -match [regex]::Escape($VMXPath)))
-Assert-Step 'Snapshot' 'VM powered off before snapshot' {
-    $list = Invoke-Vmrun -Arguments @('-T','ws','list') -IgnoreErrors
-    -not ($list -match [regex]::Escape($VMXPath))
-}
+Stop-Vm -VmxPath $VMXPath
+Assert-Step 'Snapshot' 'VM powered off before snapshot' { -not (Test-VmInList -VmxPath $VMXPath) }
 
 Invoke-Vmrun -Arguments @('-T','ws','snapshot',$VMXPath,$SnapshotName) | Out-Null
 $snaps = Invoke-Vmrun -Arguments @('-T','ws','listSnapshots',$VMXPath)
 Assert-Step 'Snapshot' "Snapshot '$SnapshotName' present" { $snaps -match [regex]::Escape($SnapshotName) }
 
-Invoke-Vmrun -Arguments @('-T','ws','start',$VMXPath,$vmrunUiMode) | Out-Null
+Invoke-Vmrun -Arguments @('-T','ws','start',$VMXPath,$vmrunUiMode) -Async
+Start-Sleep -Seconds 10
 $ipDeadline = (Get-Date).AddMinutes(5)
 do {
     Start-Sleep -Seconds 10
@@ -919,6 +1092,8 @@ do {
 } while ((Get-Date) -lt $ipDeadline -and -not ($guestIP -match '^\d+\.\d+\.\d+\.\d+'))
 Assert-Step 'Snapshot' 'VM back online after snapshot' { $guestIP -match '^\d+\.\d+\.\d+\.\d+' }
 
+} # end Step 10
+
 # ─────────────────────────────────────────────────────────────────────────────
 # Final summary
 # ─────────────────────────────────────────────────────────────────────────────
@@ -935,4 +1110,8 @@ Write-Host "  RDP : mstsc /v:$guestIP"
 Write-Host "  WinRM HTTP  : 5985"
 Write-Host "  WinRM HTTPS : 5986 (self-signed)"
 Write-Host ""
-Write-Host "  VM is powered on with vmxnet3 + DHCP. Live snapshot taken." -ForegroundColor Green
+Write-Host "  Next steps (from template\ dir):"
+Write-Host "    .\Validate-DeployState.ps1 -VMIPAddress $guestIP"
+Write-Host "    .\Prepare-WinBuild2025.ps1 -VMIPAddress $guestIP [-SkipWindowsUpdate]"
+Write-Host ""
+Write-Host "  VM is powered on with vmxnet3 + DHCP. Snapshot '$SnapshotName' taken." -ForegroundColor Green

template/Prepare-WinBuild2025.ps1

@@ -380,6 +380,7 @@ try {
         BuildPassword      = $BuildPassword
         BuildUsername      = $BuildUsername
         DotNetSdkVersion   = $DotNetSdkVersion
+        AdminPassword      = $AdminPassword
     }
     if ($SkipWindowsUpdate) { $setupArgs['SkipWindowsUpdate'] = $true }
     if ($SkipCleanup)       { $setupArgs['SkipCleanup']       = $true }
@@ -437,7 +438,17 @@ try {
         Write-Host "[Prepare] Output from guest:"
         Write-Host "------------------------------------------------------------"
 
+        $result = $null
+        try {
             $result = Invoke-GuestSetup -Session $session -ScriptPath $guestScriptPath -ScriptArgs $setupArgs
+        } catch [System.Management.Automation.Remoting.PSRemotingTransportException] {
+            # VM rebooted mid-update (WU triggered OS restart before Setup could return 3010).
+            # Treat as reboot-required: close dead session, fall through to the reboot-wait block.
+            Write-Host "[Prepare] WinRM transport error — VM rebooted mid-update. Treating as reboot-required..."
+            Remove-PSSession $session -ErrorAction SilentlyContinue
+            $session = $null
+            $result  = 3010
+        }
 
         Write-Host "------------------------------------------------------------"
         Write-Host "[Prepare] Iteration $iter exit code: $result"
@@ -448,18 +459,19 @@ try {
             throw "Setup-WinBuild2025.ps1 exited with code $result"
         }
 
-        # exit 3010 → WU applied updates needing reboot. Reboot guest, wait,
-        # reopen session, loop. -SkipWindowsUpdate must NOT be set on retry —
-        # we want the next iteration to drain remaining updates.
+        # exit 3010 (or transport error treated as 3010) → WU needs reboot.
+        # Reboot guest if session still alive, wait for WinRM, reopen session, loop.
         if ($iter -eq $maxWuIterations) {
             throw "Windows Update did not converge after $maxWuIterations iterations (still returning 3010)"
         }
 
         Write-Host "[Prepare] WU applied patches → reboot required. Rebooting guest..."
+        if ($session) {
             try {
                 Invoke-Command -Session $session -ScriptBlock { Restart-Computer -Force } -ErrorAction SilentlyContinue
             } catch { }
             Remove-PSSession $session -ErrorAction SilentlyContinue
+        }
 
         Start-Sleep -Seconds 30  # let WinRM tear down before polling
         Write-Host "[Prepare] Waiting for guest WinRM to come back (max $rebootDeadlineMin min)..."

template/Setup-WinBuild2025.ps1

@@ -8,40 +8,40 @@
     This script is run ONE TIME inside the template VM before taking the
     "BaseClean" snapshot. After the snapshot is taken, never modify the VM.
 
-    Installs and configures (each step followed by Assert-Step validation):
-      Step 1  — Firewall: all profiles disabled first — removes any block on subsequent steps
+    Prerequisite: Deploy-WinBuild2025.ps1 must have completed first (unattended OS
+    install + post-install.ps1 hardening). Steps 1, 3, 4b, 5b, 5c are validation-only
+    — they assert that Deploy already set the expected state rather than re-applying it.
+    Steps 4, 5, 6/6b, 7-10 perform actual CI customisation.
+
+    Steps and Assert-Step validation:
+      Step 1  — Firewall: validation only — Deploy disabled all profiles.
                 Validation: Domain/Private/Public all Enabled=False
-      Step 2  — Defender state validation only (disabled by Deploy-WinBuild2025
-                during unattended install via DisableAntiSpyware GPO + RTP off).
-                Validation: GPO DisableAntiSpyware=1. No exclusion paths — with
-                Defender off the scanner isn't running, so exclusions are moot.
-      Step 3  — WinRM: Basic auth, AllowUnencrypted, MaxMemoryPerShellMB=2048, 2h timeout
-                Firewall + Defender already off — no interference during config
+      Step 2  — Defender: validation only — Deploy set DisableAntiSpyware=1 GPO + RTP off.
+                Validation: GPO DisableAntiSpyware=1
+      Step 3  — WinRM: validation only — Deploy ran Enable-PSRemoting, Basic auth,
+                AllowUnencrypted, MaxMemory=2048MB, IdleTimeout=2h, MaxProcesses=25.
                 Validation: service Running+Automatic, AllowUnencrypted, Auth/Basic, memory
       Step 4  — Local build user account ($BuildUsername, PasswordNeverExpires, Administrators)
                 Validation: user exists, enabled, PasswordNeverExpires, admin membership
-      Step 4b — UAC disabled (EnableLUA=0, LocalAccountTokenFilterPolicy=1)
+      Step 4b — UAC: validation only — Deploy set EnableLUA=0, LocalAccountTokenFilterPolicy=1.
                 Validation: both registry values verified
       Step 5  — CI working directories: C:\CI\build, C:\CI\output, C:\CI\scripts
                 Must run before Windows Update — WU worker writes temp files to C:\CI
                 Validation: each path exists as Container
-      Step 5b — Explorer LaunchTo=1 (This PC) for current user + Default profile hive
+      Step 5b — Explorer LaunchTo=1: validation only — Deploy set HKCU + Default hive.
                 Validation: HKCU LaunchTo=1
-      Step 5c — CI UX hardening (all UI tweaks before the long-running WU step):
-                  Server Manager auto-start off (machine policy + HKCU Administrator +
-                  Default User hive → ci_build inherits at first logon)
-                  Ctrl+Alt+Del at login disabled (DisableCAD=1) — CI VMs never need it
-                  OOBE privacy/telemetry prompt suppressed (DisablePrivacyExperience=1,
-                  AllowTelemetry=0) — prevents first-logon interactive prompt in clones
-                Validation: machine policy key, HKCU key, DisableCAD, OOBE policy, telemetry
-      Step 6  — Windows Update via Scheduled Task as SYSTEM (avoids WinRM token limit)
-                Runs with Firewall + Defender off, C:\CI present — faster, no scan overhead
+      Step 5c — CI UX hardening: validation only — Deploy set lock screen, Server Manager
+                (policy + HKLM + task + HKCU + Default hive), DisableCAD (Policies\System
+                + Winlogon), OOBE/telemetry suppressed.
+                Validation: NoLockScreen, SM policy, SM task, DisableCAD, OOBE, telemetry
+      Step 6  — Windows Update via Scheduled Task as SYSTEM (avoids WinRM token limit).
+                Clears Deploy's GPO locks (Step A), starts services (Step D), runs COM API,
+                reports result code. Skipped with -SkipWindowsUpdate.
                 Validation: result code 0/2/3, no reboot required (else exit 3010)
-      Step 6b — Windows Update permanently disabled (post-update lockdown)
+      Step 6b — Windows Update permanently disabled (post-update lockdown — always runs).
                 wuauserv + UsoSvc set to Disabled; GPO keys NoAutoUpdate=1,
-                DisableWindowsUpdateAccess=1; WU scheduled tasks disabled
-                Runs unconditionally (even with -SkipWindowsUpdate) so snapshot
-                captures WU off — linked clones never trigger background updates
+                DisableWindowsUpdateAccess=1; WU scheduled tasks disabled.
+                Snapshot captures WU permanently off — linked clones never auto-update.
                 Validation: wuauserv StartType=Disabled, GPO keys present
       Step 7  — .NET SDK (channel $DotNetSdkVersion) via dotnet-install.ps1
                 Validation: dotnet resolvable, version channel match, machine PATH
@@ -50,28 +50,27 @@
       Step 9  — Visual Studio Build Tools 2026 via Scheduled Task as SYSTEM
                 Validation: MSBuild.exe exists, executes, PATH, VC dir present
       Step 10 — Toolchain cross-check (dotnet, python, msbuild)
-                Throws on any missing tool (was: warn-only)
+                Throws on any missing tool
       Cleanup — Disk cleanup: cleanmgr, SoftwareDistribution, CBS, TEMP, Prefetch, DISM
                 wuauserv already Disabled (Step 6b) — not restarted after cache clear
-                SoftwareDistribution\Download cleared best-effort (WaaSMedicSvc may repopulate)
-                Validation: wuauserv StartType Disabled (SoftwareDistribution check removed —
-                            WaaSMedicSvc tamper-protection restores files immediately)
+                Validation: wuauserv StartType Disabled
       Final   — Pre-snapshot gate: 7 cross-cutting checks across all steps
                 Throws if any check fails — prevents snapshot of broken state
 
     Step ordering rationale:
-      Firewall first  — removes any network block before WinRM config and WU downloads
-      Defender second — eliminates scan overhead before WinRM, WU, and installer downloads
-      WinRM third     — configured clean with no Firewall/Defender interference
-      User + UAC      — quick registry ops; UAC off before dirs/tools avoids elevation prompts
-      CI dirs         — C:\CI must exist before WU worker writes temp files there
-      UI tweaks       — all fast registry writes batched before the slow WU step
-      WU sixth        — all prereqs (dirs, user, tweaks) done; Firewall+Defender off
-      WU disable      — immediately after WU completes; snapshot captures WU permanently off
-      Toolchain       — .NET / Python / VS last; WU done, no scan on installer payloads
+      Firewall (Step 1)  — validates Deploy disabled all profiles; assertion before WinRM/WU
+      Defender (Step 2)  — validates Deploy disabled RTP; assertion before tool install
+      WinRM (Step 3)     — validates Deploy configured WinRM; assertion before remote steps
+      User (Step 4)      — creates ci_build; must exist before UAC and dirs assertions
+      UAC (Step 4b)      — validates Deploy disabled UAC (elevation-free installs in 7-9)
+      CI dirs (Step 5)   — C:\CI must exist before WU worker writes temp files there
+      UI tweaks (5b/5c)  — validates Deploy UX settings; fast assertions before slow WU
+      WU (Step 6)        — all prereqs validated; WU runs with Firewall+Defender already off
+      WU disable (Step 6b) — immediately after WU; snapshot captures WU permanently off
+      Toolchain (7-9)    — .NET/Python/VS last; WU done, no scan on installer payloads
 
-    NOTE: Git is NOT installed. The host clones the repository and copies
-    the source tree into the VM via WinRM (Option B isolation model).
+    NOTE: Git is NOT installed by default. See §6.6 (Tier-1 Toolchain) in TODO.md
+    for the planned addition. The host clones and copies source via WinRM until then.
 
     ╔══════════════════════════════════════════════════════════════════════╗
     ║  NETWORK REQUIREMENT DURING SETUP                                    ║
@@ -132,7 +131,11 @@ param(
     [switch] $SkipWindowsUpdate,
 
     # Skip disk cleanup step (cleanmgr + DISM + cache clear) — speeds up re-runs during dev/debug
-    [switch] $SkipCleanup
+    [switch] $SkipCleanup,
+
+    # Administrator password — used only to write DefaultPassword for autologin.
+    # Optional: if empty, DefaultPassword registry value is left as-is (Deploy may have set it).
+    [string] $AdminPassword = ''
 )
 
 Set-StrictMode -Version Latest
@@ -173,16 +176,12 @@ foreach ($f in $knownTempFiles) {
     }
 }
 
-# ── Step 1: Firewall ──────────────────────────────────────────────────────────
-Write-Step "Disabling Windows Firewall (all profiles) — isolated lab VM"
+# ── Step 1: Firewall (validation only — disabled by Deploy-WinBuild2025) ──────
+Write-Step "Firewall state (validation only — disabled at deploy time)"
 
-# Disable first: removes any block on subsequent WinRM config and WU downloads.
-# This VM lives on VMnet8 NAT behind the VMware NAT gateway — no inbound exposure
-# from outside the host, so full disable is acceptable.
-Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled False
-Write-Host "Windows Firewall disabled on all profiles."
+# Deploy-WinBuild2025.ps1 post-install.ps1 called Set-NetFirewallProfile -Enabled False
+# on all profiles. Validated here before WinRM and WU assertions proceed.
 
-# Validation
 foreach ($p in 'Domain','Private','Public') {
     Assert-Step 'Firewall' "$p profile disabled" {
         (Get-NetFirewallProfile -Profile $p -ErrorAction Stop).Enabled -eq $false
@@ -201,29 +200,13 @@ Assert-Step 'Defender' 'GPO DisableAntiSpyware=1 (set by Deploy-WinBuild2025)' {
     ((Get-ItemProperty -Path $key -Name DisableAntiSpyware -ErrorAction SilentlyContinue).DisableAntiSpyware -eq 1)
 }
 
-# ── Step 3: WinRM ─────────────────────────────────────────────────────────────
-Write-Step "Configuring WinRM"
+# ── Step 3: WinRM (validation only — configured by Deploy-WinBuild2025) ───────
+Write-Step "WinRM state (validation only — configured at deploy time)"
 
-# Firewall and Defender already off — no interference during WinRM hardening.
-Enable-PSRemoting -Force -SkipNetworkProfileCheck 3>$null | Out-Null
+# Deploy-WinBuild2025.ps1 post-install.ps1 ran Enable-PSRemoting, set Basic auth,
+# AllowUnencrypted, TrustedHosts=*, MaxMemory=2048MB, IdleTimeout=2h, MaxProcesses=25,
+# and StartupType=Automatic. Validated here before the build user and toolchain steps.
 
-# Allow unencrypted (HTTP/5985) — acceptable for an isolated lab network.
-# Migrate to HTTPS/5986 with a self-signed cert for hardened environments.
-winrm set winrm/config/service '@{AllowUnencrypted="true"}' | Out-Null
-winrm set winrm/config/service/auth '@{Basic="true"}' | Out-Null
-
-# Increase shell memory and timeout limits for long builds
-winrm set winrm/config/winrs '@{MaxProcessesPerShell="25"}' | Out-Null
-Set-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB 2048   -Force 3>$null
-Set-Item WSMan:\localhost\Shell\IdleTimeOut         7200000 -Force 3>$null  # 2 hours
-
-# Ensure WinRM starts automatically
-Set-Service -Name WinRM -StartupType Automatic 3>$null
-Start-Service WinRM 3>$null
-
-Write-Host "WinRM configured."
-
-# Validation
 Assert-Step 'WinRM' 'service Running' {
     (Get-Service WinRM -ErrorAction Stop).Status -eq 'Running'
 }
@@ -294,19 +277,13 @@ Assert-Step 'User' "user '$BuildUsername' member of Administrators" {
     [bool](& net localgroup Administrators 2>&1 | Select-String -SimpleMatch $BuildUsername)
 }
 
-# ── Step 4b: Disable UAC ─────────────────────────────────────────────────────
-Write-Step "Disabling UAC (isolated lab VM)"
+# ── Step 4b: UAC (validation only — disabled by Deploy-WinBuild2025) ─────────
+Write-Step "UAC state (validation only — disabled at deploy time)"
 
-# EnableLUA=0 disables UAC entirely — admin processes get full token without prompt.
-# LocalAccountTokenFilterPolicy=1 ensures remote admin connections (WinRM) also
-# get an elevated token (avoids the filtered-token issue with runProgramInGuest).
-Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' `
-    -Name EnableLUA -Value 0 -Type DWord -Force
-Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' `
-    -Name LocalAccountTokenFilterPolicy -Value 1 -Type DWord -Force
-Write-Host "UAC disabled."
+# Deploy-WinBuild2025.ps1 post-install.ps1 set EnableLUA=0 (no prompt for admin
+# processes) and LocalAccountTokenFilterPolicy=1 (WinRM remote connections get full
+# elevated token, required for runProgramInGuest and remote admin commands).
 
-# Validation
 $uacPolicyKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
 Assert-Step 'UAC' 'EnableLUA=0' {
     (Get-ItemProperty -Path $uacPolicyKey -Name EnableLUA -ErrorAction Stop).EnableLUA -eq 0
@@ -335,109 +312,32 @@ foreach ($dir in $ciDirs) {
     }
 }
 
-# ── Step 5b: Explorer settings ───────────────────────────────────────────────
-Write-Step "Configuring Explorer defaults"
+# ── Step 5b: Explorer settings (validation only — configured by Deploy-WinBuild2025) ──
+Write-Step "Explorer defaults (validation only — configured at deploy time)"
+
+# Deploy-WinBuild2025.ps1 post-install.ps1 set LaunchTo=1 for HKCU (Administrator)
+# and the Default User hive (so ci_build and any new user inherits at first logon).
 
-# Open Explorer to 'This PC' (Devices and Drives) instead of Quick Access.
-# LaunchTo=1 = This PC, LaunchTo=2 = Quick Access (default)
 $explorerAdvKey = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced'
-Set-ItemProperty -Path $explorerAdvKey -Name 'LaunchTo' -Value 1 -Type DWord -Force
-
-# Also apply to the Default User profile so ci_build and any new user inherits it.
-$defaultHive = 'C:\Users\Default\NTUSER.DAT'
-$mountName   = 'TempDefaultUser'
-if (Test-Path $defaultHive) {
-    reg load "HKU\$mountName" $defaultHive | Out-Null
-    $defKey = "Registry::HKU\$mountName\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
-    if (-not (Test-Path $defKey)) { New-Item -Path $defKey -Force | Out-Null }
-    Set-ItemProperty -Path $defKey -Name 'LaunchTo' -Value 1 -Type DWord -Force
-    [gc]::Collect()
-    reg unload "HKU\$mountName" | Out-Null
-    Write-Host "Explorer: 'This PC' set for current user and default profile."
-}
-else {
-    Write-Host "Explorer: 'This PC' set for current user (default hive not found)."
-}
-
-# Validation
 Assert-Step 'Explorer' "LaunchTo=1 (HKCU current user)" {
     (Get-ItemProperty -Path $explorerAdvKey -Name LaunchTo -ErrorAction Stop).LaunchTo -eq 1
 }
 
-# ── Step 5c: CI UX hardening ─────────────────────────────────────────────────
-Write-Step "CI UX hardening (lock screen off, Server Manager off, no CAD, no OOBE)"
+# ── Step 5c: CI UX hardening (validation only — configured by Deploy-WinBuild2025) ─
+Write-Step "CI UX hardening state (validation only — configured at deploy time)"
 
-# All UI tweaks batched here — fast registry writes before the slow WU step.
+# Deploy-WinBuild2025.ps1 post-install.ps1 set: lock screen (NoLockScreen=1), Server
+# Manager (policy + HKLM + task + HKCU + Default hive), DisableCAD (Policies\System +
+# Winlogon), OOBE DisablePrivacyExperience (policy + non-policy), AllowTelemetry=0.
 
-# 1 — Lock screen: disable entirely (CI VMs never need a lock screen)
-# NoLockScreen=1 suppresses the lock screen shown before login on console sessions.
 $personPolicyKey = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization'
-if (-not (Test-Path $personPolicyKey)) { New-Item -Path $personPolicyKey -Force | Out-Null }
-Set-ItemProperty -Path $personPolicyKey -Name 'NoLockScreen' -Value 1 -Type DWord -Force
-Write-Host "Lock screen disabled."
-
-# 2 — Server Manager: do not auto-open at logon
-# Three layers needed on WS2025:
-#   a) Machine policy key (GPO path — read by ServerManager policy check)
-#   b) HKLM non-policy key (read directly by ServerManager.exe on WS2025)
-#   c) Scheduled Task '\Microsoft\Windows\Server Manager\ServerManager'
-#      — this is the actual launcher; registry alone is insufficient on WS2025
-#   d) HKCU + Default hive for per-user belt-and-suspenders
 $smPolicyKey     = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\ServerManager'
-if (-not (Test-Path $smPolicyKey)) { New-Item -Path $smPolicyKey -Force | Out-Null }
-Set-ItemProperty -Path $smPolicyKey -Name 'DoNotOpenAtLogon' -Value 1 -Type DWord -Force
-
 $smHKLMKey       = 'HKLM:\SOFTWARE\Microsoft\ServerManager'
-if (-not (Test-Path $smHKLMKey)) { New-Item -Path $smHKLMKey -Force | Out-Null }
-Set-ItemProperty -Path $smHKLMKey -Name 'DoNotOpenServerManagerAtLogon' -Value 1 -Type DWord -Force
-
-Disable-ScheduledTask -TaskPath '\Microsoft\Windows\Server Manager\' `
-    -TaskName 'ServerManager' -ErrorAction SilentlyContinue | Out-Null
-
-# Current session user (Administrator)
 $smUserKey       = 'HKCU:\SOFTWARE\Microsoft\ServerManager'
-if (-not (Test-Path $smUserKey)) { New-Item -Path $smUserKey -Force | Out-Null }
-Set-ItemProperty -Path $smUserKey -Name 'DoNotOpenServerManagerAtLogon' -Value 1 -Type DWord -Force
-
-# Default User hive — ci_build and any future account inherits at first logon
-$smDefaultHive = 'C:\Users\Default\NTUSER.DAT'
-$smMountName   = 'TempDefaultUserSM'
-if (Test-Path $smDefaultHive) {
-    reg load "HKU\$smMountName" $smDefaultHive | Out-Null
-    $smDefKey = "Registry::HKU\$smMountName\SOFTWARE\Microsoft\ServerManager"
-    if (-not (Test-Path $smDefKey)) { New-Item -Path $smDefKey -Force | Out-Null }
-    Set-ItemProperty -Path $smDefKey -Name 'DoNotOpenServerManagerAtLogon' -Value 1 -Type DWord -Force
-    [gc]::Collect()
-    reg unload "HKU\$smMountName" | Out-Null
-    Write-Host "Server Manager: policy + HKLM + task + Administrator HKCU + Default hive set."
-}
-else {
-    Write-Host "Server Manager: policy + HKLM + task + Administrator HKCU set (Default hive not found)."
-}
-
-# 3 — Disable Ctrl+Alt+Del at interactive login
-# Set in both locations: Winlogon (classic) + Policies\System (policy, authoritative on WS2025).
-Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' `
-    -Name 'DisableCAD' -Value 1 -Type DWord -Force
 $systemPolicyKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
-Set-ItemProperty -Path $systemPolicyKey -Name 'DisableCAD' -Value 1 -Type DWord -Force
-Write-Host "Ctrl+Alt+Del at login disabled (Winlogon + Policies\System)."
-
-# 4 — Suppress OOBE privacy/telemetry prompt
 $oobePolicyKey   = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\OOBE'
-if (-not (Test-Path $oobePolicyKey)) { New-Item -Path $oobePolicyKey -Force | Out-Null }
-Set-ItemProperty -Path $oobePolicyKey -Name 'DisablePrivacyExperience' -Value 1 -Type DWord -Force
-
-$oobeKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE'
-if (-not (Test-Path $oobeKey)) { New-Item -Path $oobeKey -Force | Out-Null }
-Set-ItemProperty -Path $oobeKey -Name 'DisablePrivacyExperience' -Value 1 -Type DWord -Force
-
 $dcKey           = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection'
-if (-not (Test-Path $dcKey)) { New-Item -Path $dcKey -Force | Out-Null }
-Set-ItemProperty -Path $dcKey -Name 'AllowTelemetry' -Value 0 -Type DWord -Force
-Write-Host "OOBE privacy prompt and telemetry disabled."
 
-# Validation
 Assert-Step 'CIUX' 'lock screen disabled (NoLockScreen=1)' {
     (Get-ItemProperty -Path $personPolicyKey -Name NoLockScreen -ErrorAction Stop).NoLockScreen -eq 1
 }
@@ -464,6 +364,25 @@ Assert-Step 'CIUX' 'OOBE policy DisablePrivacyExperience=1' {
 Assert-Step 'CIUX' 'DataCollection AllowTelemetry=0' {
     (Get-ItemProperty -Path $dcKey -Name AllowTelemetry -ErrorAction Stop).AllowTelemetry -eq 0
 }
+# AutoAdminLogon: operativo — Deploy sets this, but Windows Server 2025 OOBE/first-boot
+# tasks can reset AutoAdminLogon to 0 after the initial login. Re-affirm without touching
+# DefaultPassword (already written by Deploy's post-install.ps1 and still present).
+$wlKey = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'
+$wlNow = Get-ItemProperty -Path $wlKey -ErrorAction SilentlyContinue
+if ($wlNow.AutoAdminLogon -ne '1' -or $wlNow.DefaultUserName -ne 'Administrator') {
+    Set-ItemProperty -Path $wlKey -Name AutoAdminLogon    -Value '1'             -Type String -Force
+    Set-ItemProperty -Path $wlKey -Name DefaultUserName   -Value 'Administrator' -Type String -Force
+    Set-ItemProperty -Path $wlKey -Name DefaultDomainName -Value '.'             -Type String -Force
+}
+# DefaultPassword written unconditionally when available — previous run may have set
+# AutoAdminLogon=1 without knowing the password (AdminPassword was added later).
+if ($AdminPassword -ne '') {
+    Set-ItemProperty -Path $wlKey -Name DefaultPassword -Value $AdminPassword -Type String -Force
+}
+Assert-Step 'CIUX' 'autologin Administrator enabled (AutoAdminLogon=1)' {
+    $wl = Get-ItemProperty -Path $wlKey -ErrorAction Stop
+    $wl.AutoAdminLogon -eq '1' -and $wl.DefaultUserName -eq 'Administrator'
+}
 
 # ── Step 6: Windows Update ────────────────────────────────────────────────────
 # Firewall + Defender already off: WU downloads and installs run without scanning.
@@ -1023,6 +942,12 @@ Write-Host "DISM exited (code $($dism.ExitCode))."
 
 Write-Host "Disk cleanup complete."
 
+# DISM StartComponentCleanup / WaaSMedicSvc may reset service StartType during cleanup.
+# Re-enforce Disabled on both WU services after DISM completes.
+foreach ($svc in 'wuauserv', 'UsoSvc') {
+    Set-Service -Name $svc -StartupType Disabled -ErrorAction SilentlyContinue
+}
+
 # Validation — leftover artifacts from this run should be gone
 # Note: do NOT assert SoftwareDistribution\Download empty.
 # WaaSMedicSvc (Windows Update Medic Service) is tamper-protected — cannot be stopped —
@@ -1033,7 +958,7 @@ $sdFiles = Get-ChildItem 'C:\Windows\SoftwareDistribution\Download' -Recurse -Fi
 $sdMB    = [math]::Round(($sdFiles | Measure-Object -Property Length -Sum).Sum / 1MB, 1)
 Write-Host "  SoftwareDistribution\Download: $($sdFiles.Count) file(s), ${sdMB} MB remaining (WaaSMedicSvc best-effort, WU is disabled)."
 
-Assert-Step 'Cleanup' 'wuauserv StartType still Disabled after cache clear' {
+Assert-Step 'Cleanup' 'wuauserv StartType Disabled after cache clear' {
     (Get-Service wuauserv -ErrorAction Stop).StartType -eq 'Disabled'
 }
 } # end if (-not $SkipCleanup)

template/Validate-DeployState.ps1

@@ -0,0 +1,187 @@
+#Requires -Version 5.1
+<#
+.SYNOPSIS
+    Validates that Deploy-WinBuild2025.ps1 has correctly configured a guest VM.
+
+.DESCRIPTION
+    Connects to the VM via WinRM (HTTP/Basic) and runs all checks that
+    Setup-WinBuild2025.ps1 Steps 1/2/3/4b/5b/5c assert as validation-only.
+    Use this after Deploy completes and before running Prepare/Setup.
+
+.PARAMETER VMIPAddress
+    IP address of the guest VM on VMnet8 (e.g. 192.168.79.129).
+
+.PARAMETER AdminUsername
+    Admin account inside the VM (default: Administrator).
+
+.PARAMETER AdminPassword
+    Password for the admin account. Prompted if omitted.
+
+.EXAMPLE
+    .\Validate-DeployState.ps1 -VMIPAddress 192.168.79.129
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)] [string] $VMIPAddress,
+    [string] $AdminUsername = 'Administrator',
+    [string] $AdminPassword
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+if (-not $AdminPassword) {
+    $secure      = Read-Host "Password for $AdminUsername@$VMIPAddress" -AsSecureString
+    $AdminPassword = [Runtime.InteropServices.Marshal]::PtrToStringAuto(
+        [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure))
+}
+
+$cred = New-Object System.Management.Automation.PSCredential(
+    $AdminUsername,
+    (ConvertTo-SecureString $AdminPassword -AsPlainText -Force)
+)
+$so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck
+
+$prevAllowUnenc   = (Get-Item WSMan:\localhost\Client\AllowUnencrypted).Value
+$prevTrustedHosts = (Get-Item WSMan:\localhost\Client\TrustedHosts).Value
+
+try {
+    Set-Item WSMan:\localhost\Client\AllowUnencrypted $true -Force
+    $cur = (Get-Item WSMan:\localhost\Client\TrustedHosts).Value
+    if ($cur -ne '*' -and $cur -notmatch [regex]::Escape($VMIPAddress)) {
+        $newHosts = if ($cur) { "$cur,$VMIPAddress" } else { $VMIPAddress }
+        Set-Item WSMan:\localhost\Client\TrustedHosts -Value $newHosts -Force
+    }
+
+    Write-Host "`nValidating Deploy state on $VMIPAddress..." -ForegroundColor Cyan
+
+    $checks = Invoke-Command -ComputerName $VMIPAddress -Credential $cred `
+        -Authentication Basic -SessionOption $so -ScriptBlock {
+
+        $results = [System.Collections.Generic.List[PSCustomObject]]::new()
+
+        function Chk {
+            param([string]$Name, [scriptblock]$Test)
+            try   { $ok = [bool](& $Test); $err = '' }
+            catch { $ok = $false; $err = $_.Exception.Message }
+            $results.Add([PSCustomObject]@{ Name=$Name; Pass=$ok; Err=$err })
+        }
+
+        # ── Firewall ─────────────────────────────────────────────────────────
+        foreach ($p in Get-NetFirewallProfile) {
+            $n = $p.Name; $e = $p.Enabled
+            Chk "Firewall $n disabled" { $e -eq $false }
+        }
+
+        # ── Defender ─────────────────────────────────────────────────────────
+        Chk 'Defender GPO DisableAntiSpyware=1' {
+            (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' `
+                -Name DisableAntiSpyware -EA Stop).DisableAntiSpyware -eq 1
+        }
+
+        # ── WinRM ─────────────────────────────────────────────────────────────
+        Chk 'WinRM service Running'   { (Get-Service WinRM -EA Stop).Status    -eq 'Running'   }
+        Chk 'WinRM service Automatic' { (Get-Service WinRM -EA Stop).StartType -eq 'Automatic' }
+        Chk 'WinRM AllowUnencrypted=true' {
+            (Get-Item WSMan:\localhost\Service\AllowUnencrypted -EA Stop).Value -eq 'true'
+        }
+        Chk 'WinRM Auth/Basic=true' {
+            (Get-Item WSMan:\localhost\Service\Auth\Basic -EA Stop).Value -eq 'true'
+        }
+        Chk 'WinRM MaxMemoryPerShellMB >= 2048' {
+            [int](Get-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB -EA Stop).Value -ge 2048
+        }
+
+        # ── UAC ───────────────────────────────────────────────────────────────
+        $polSys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
+        Chk 'UAC EnableLUA=0' {
+            (Get-ItemProperty $polSys -Name EnableLUA -EA Stop).EnableLUA -eq 0
+        }
+        Chk 'UAC LocalAccountTokenFilterPolicy=1' {
+            (Get-ItemProperty $polSys -Name LocalAccountTokenFilterPolicy -EA Stop).LocalAccountTokenFilterPolicy -eq 1
+        }
+
+        # ── Explorer ──────────────────────────────────────────────────────────
+        Chk 'Explorer LaunchTo=1 (HKCU)' {
+            (Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' `
+                -Name LaunchTo -EA Stop).LaunchTo -eq 1
+        }
+
+        # ── UX hardening ─────────────────────────────────────────────────────
+        Chk 'NoLockScreen=1' {
+            (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization' `
+                -Name NoLockScreen -EA Stop).NoLockScreen -eq 1
+        }
+        Chk 'Server Manager policy DoNotOpenAtLogon=1' {
+            (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\ServerManager' `
+                -Name DoNotOpenAtLogon -EA Stop).DoNotOpenAtLogon -eq 1
+        }
+        Chk 'Server Manager HKLM DoNotOpenServerManagerAtLogon=1' {
+            (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\ServerManager' `
+                -Name DoNotOpenServerManagerAtLogon -EA Stop).DoNotOpenServerManagerAtLogon -eq 1
+        }
+        Chk 'Server Manager task Disabled' {
+            $t = Get-ScheduledTask -TaskPath '\Microsoft\Windows\Server Manager\' `
+                -TaskName 'ServerManager' -EA SilentlyContinue
+            (-not $t) -or ($t.State -eq 'Disabled')
+        }
+        Chk 'Server Manager HKCU DoNotOpenServerManagerAtLogon=1' {
+            (Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\ServerManager' `
+                -Name DoNotOpenServerManagerAtLogon -EA Stop).DoNotOpenServerManagerAtLogon -eq 1
+        }
+        Chk 'DisableCAD=1 (Policies\System)' {
+            (Get-ItemProperty $polSys -Name DisableCAD -EA Stop).DisableCAD -eq 1
+        }
+        Chk 'OOBE DisablePrivacyExperience=1' {
+            (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\OOBE' `
+                -Name DisablePrivacyExperience -EA Stop).DisablePrivacyExperience -eq 1
+        }
+        Chk 'DataCollection AllowTelemetry=0' {
+            (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' `
+                -Name AllowTelemetry -EA Stop).AllowTelemetry -eq 0
+        }
+        Chk 'AutoAdminLogon=1, DefaultUserName=Administrator' {
+            $wl = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' -EA Stop
+            $wl.AutoAdminLogon -eq '1' -and $wl.DefaultUserName -eq 'Administrator'
+        }
+
+        # ── Windows Update GPO + services ─────────────────────────────────────
+        Chk 'WU GPO NoAutoUpdate=1' {
+            (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' `
+                -Name NoAutoUpdate -EA Stop).NoAutoUpdate -eq 1
+        }
+        Chk 'WU GPO DisableWindowsUpdateAccess=1' {
+            (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' `
+                -Name DisableWindowsUpdateAccess -EA Stop).DisableWindowsUpdateAccess -eq 1
+        }
+        Chk 'wuauserv StartType=Manual' { (Get-Service wuauserv -EA Stop).StartType -eq 'Manual' }
+        Chk 'UsoSvc StartType=Manual'   { (Get-Service UsoSvc   -EA Stop).StartType -eq 'Manual' }
+
+        return $results.ToArray()
+    }
+
+    Write-Host ''
+    $failed = 0
+    foreach ($r in $checks) {
+        if ($r.Pass) {
+            Write-Host "  [OK]   $($r.Name)" -ForegroundColor Green
+        } else {
+            $detail = if ($r.Err) { "  ($($r.Err))" } else { '' }
+            Write-Host "  [FAIL] $($r.Name)$detail" -ForegroundColor Red
+            $failed++
+        }
+    }
+
+    Write-Host ''
+    if ($failed -eq 0) {
+        Write-Host "All $($checks.Count) Deploy checks passed." -ForegroundColor Green
+        exit 0
+    } else {
+        Write-Host "$failed / $($checks.Count) Deploy checks FAILED." -ForegroundColor Red
+        exit 1
+    }
+
+} finally {
+    Set-Item WSMan:\localhost\Client\AllowUnencrypted $prevAllowUnenc   -Force -EA SilentlyContinue
+    Set-Item WSMan:\localhost\Client\TrustedHosts     $prevTrustedHosts -Force -EA SilentlyContinue
+}

template/Validate-SetupState.ps1

@@ -0,0 +1,374 @@
+#Requires -Version 5.1
+<#
+.SYNOPSIS
+    Validates full post-Setup state of a template VM (Deploy + Setup).
+
+.DESCRIPTION
+    Connects to the VM via WinRM (HTTP/Basic) and runs all checks for the
+    final BaseClean snapshot state: Deploy OS hardening + Setup CI toolchain.
+    Run this after Prepare-WinBuild2025.ps1 completes (exit 0) to confirm
+    the VM is ready for snapshot and production use.
+
+.PARAMETER VMIPAddress
+    IP address of the guest VM on VMnet8 (e.g. 192.168.79.129).
+
+.PARAMETER AdminUsername
+    Admin account inside the VM (default: Administrator).
+
+.PARAMETER AdminPassword
+    Password for the admin account. Prompted if omitted.
+
+.PARAMETER BuildUsername
+    CI build account created by Setup (default: ci_build).
+
+.PARAMETER DotNetChannel
+    Expected .NET SDK channel prefix (default: 10.0).
+
+.PARAMETER PythonVersion
+    Expected exact Python version string (default: 3.13.3).
+
+.PARAMETER Remediate
+    If set, automatically applies fixes for known remediable failures
+    (AutoAdminLogon, wuauserv/UsoSvc StartType=Disabled) then re-runs all checks.
+
+.EXAMPLE
+    .\Validate-SetupState.ps1 -VMIPAddress 192.168.79.129
+
+.EXAMPLE
+    .\Validate-SetupState.ps1 -VMIPAddress 192.168.79.129 -Remediate
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)] [string] $VMIPAddress,
+    [string] $AdminUsername  = 'Administrator',
+    [string] $AdminPassword,
+    [string] $BuildUsername  = 'ci_build',
+    [string] $DotNetChannel  = '10.0',
+    [string] $PythonVersion  = '3.13.3',
+    [switch] $Remediate
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+if (-not $AdminPassword) {
+    $secure      = Read-Host "Password for $AdminUsername@$VMIPAddress" -AsSecureString
+    $AdminPassword = [Runtime.InteropServices.Marshal]::PtrToStringAuto(
+        [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure))
+}
+
+$cred = New-Object System.Management.Automation.PSCredential(
+    $AdminUsername,
+    (ConvertTo-SecureString $AdminPassword -AsPlainText -Force)
+)
+$so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck
+
+$prevAllowUnenc   = (Get-Item WSMan:\localhost\Client\AllowUnencrypted).Value
+$prevTrustedHosts = (Get-Item WSMan:\localhost\Client\TrustedHosts).Value
+
+try {
+    Set-Item WSMan:\localhost\Client\AllowUnencrypted $true -Force
+    $cur = (Get-Item WSMan:\localhost\Client\TrustedHosts).Value
+    if ($cur -ne '*' -and $cur -notmatch [regex]::Escape($VMIPAddress)) {
+        $newHosts = if ($cur) { "$cur,$VMIPAddress" } else { $VMIPAddress }
+        Set-Item WSMan:\localhost\Client\TrustedHosts -Value $newHosts -Force
+    }
+
+    Write-Host "`nValidating full Setup state on $VMIPAddress..." -ForegroundColor Cyan
+
+    $checks = Invoke-Command -ComputerName $VMIPAddress -Credential $cred `
+        -Authentication Basic -SessionOption $so -ScriptBlock {
+
+        param($BuildUsername, $DotNetChannel, $PythonVersion)
+
+        $results = [System.Collections.Generic.List[PSCustomObject]]::new()
+
+        function Chk {
+            param([string]$Name, [scriptblock]$Test)
+            try   { $ok = [bool](& $Test); $err = '' }
+            catch { $ok = $false; $err = $_.Exception.Message }
+            $results.Add([PSCustomObject]@{ Name=$Name; Pass=$ok; Err=$err })
+        }
+
+        # ════════════════════════════════════════════════════════════════════
+        # DEPLOY checks (same as Validate-DeployState.ps1)
+        # ════════════════════════════════════════════════════════════════════
+
+        # Firewall
+        foreach ($p in Get-NetFirewallProfile) {
+            $n = $p.Name; $e = $p.Enabled
+            Chk "Firewall $n disabled" { $e -eq $false }
+        }
+
+        # Defender
+        Chk 'Defender GPO DisableAntiSpyware=1' {
+            (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' `
+                -Name DisableAntiSpyware -EA Stop).DisableAntiSpyware -eq 1
+        }
+
+        # WinRM
+        Chk 'WinRM service Running'   { (Get-Service WinRM -EA Stop).Status    -eq 'Running'   }
+        Chk 'WinRM service Automatic' { (Get-Service WinRM -EA Stop).StartType -eq 'Automatic' }
+        Chk 'WinRM AllowUnencrypted=true' {
+            (Get-Item WSMan:\localhost\Service\AllowUnencrypted -EA Stop).Value -eq 'true'
+        }
+        Chk 'WinRM Auth/Basic=true' {
+            (Get-Item WSMan:\localhost\Service\Auth\Basic -EA Stop).Value -eq 'true'
+        }
+        Chk 'WinRM MaxMemoryPerShellMB >= 2048' {
+            [int](Get-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB -EA Stop).Value -ge 2048
+        }
+
+        # UAC
+        $polSys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
+        Chk 'UAC EnableLUA=0' {
+            (Get-ItemProperty $polSys -Name EnableLUA -EA Stop).EnableLUA -eq 0
+        }
+        Chk 'UAC LocalAccountTokenFilterPolicy=1' {
+            (Get-ItemProperty $polSys -Name LocalAccountTokenFilterPolicy -EA Stop).LocalAccountTokenFilterPolicy -eq 1
+        }
+
+        # Explorer
+        Chk 'Explorer LaunchTo=1 (HKCU)' {
+            (Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' `
+                -Name LaunchTo -EA Stop).LaunchTo -eq 1
+        }
+
+        # UX hardening
+        Chk 'NoLockScreen=1' {
+            (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization' `
+                -Name NoLockScreen -EA Stop).NoLockScreen -eq 1
+        }
+        Chk 'Server Manager policy DoNotOpenAtLogon=1' {
+            (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\ServerManager' `
+                -Name DoNotOpenAtLogon -EA Stop).DoNotOpenAtLogon -eq 1
+        }
+        Chk 'Server Manager HKLM DoNotOpenServerManagerAtLogon=1' {
+            (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\ServerManager' `
+                -Name DoNotOpenServerManagerAtLogon -EA Stop).DoNotOpenServerManagerAtLogon -eq 1
+        }
+        Chk 'Server Manager task Disabled' {
+            $t = Get-ScheduledTask -TaskPath '\Microsoft\Windows\Server Manager\' `
+                -TaskName 'ServerManager' -EA SilentlyContinue
+            (-not $t) -or ($t.State -eq 'Disabled')
+        }
+        Chk 'Server Manager HKCU DoNotOpenServerManagerAtLogon=1' {
+            (Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\ServerManager' `
+                -Name DoNotOpenServerManagerAtLogon -EA Stop).DoNotOpenServerManagerAtLogon -eq 1
+        }
+        Chk 'DisableCAD=1 (Policies\System)' {
+            (Get-ItemProperty $polSys -Name DisableCAD -EA Stop).DisableCAD -eq 1
+        }
+        Chk 'OOBE DisablePrivacyExperience=1' {
+            (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\OOBE' `
+                -Name DisablePrivacyExperience -EA Stop).DisablePrivacyExperience -eq 1
+        }
+        Chk 'DataCollection AllowTelemetry=0' {
+            (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' `
+                -Name AllowTelemetry -EA Stop).AllowTelemetry -eq 0
+        }
+        Chk 'AutoAdminLogon=1, DefaultUserName=Administrator' {
+            $wl = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' -EA Stop
+            $wl.AutoAdminLogon -eq '1' -and $wl.DefaultUserName -eq 'Administrator'
+        }
+
+        # ════════════════════════════════════════════════════════════════════
+        # SETUP checks (post-Prepare state)
+        # ════════════════════════════════════════════════════════════════════
+
+        # CI build user
+        Chk "user $BuildUsername exists" {
+            $null -ne (Get-LocalUser -Name $BuildUsername -EA Stop)
+        }
+        Chk "user $BuildUsername enabled" {
+            (Get-LocalUser -Name $BuildUsername -EA Stop).Enabled
+        }
+        Chk "user $BuildUsername PasswordNeverExpires" {
+            (Get-LocalUser -Name $BuildUsername -EA Stop).PasswordExpires -eq $null
+        }
+        Chk "user $BuildUsername member of Administrators" {
+            [bool](& net localgroup Administrators 2>&1 | Select-String -SimpleMatch $BuildUsername)
+        }
+
+        # CI directories
+        foreach ($dir in 'C:\CI\build','C:\CI\output','C:\CI\scripts') {
+            Chk "$dir exists" { Test-Path $dir -PathType Container }
+        }
+
+        # Windows Update permanently disabled
+        Chk 'wuauserv StartType=Disabled' { (Get-Service wuauserv -EA Stop).StartType -eq 'Disabled' }
+        Chk 'UsoSvc StartType=Disabled'   { (Get-Service UsoSvc   -EA Stop).StartType -eq 'Disabled' }
+        Chk 'WU GPO NoAutoUpdate=1' {
+            (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' `
+                -Name NoAutoUpdate -EA Stop).NoAutoUpdate -eq 1
+        }
+        Chk 'WU GPO DisableWindowsUpdateAccess=1' {
+            (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' `
+                -Name DisableWindowsUpdateAccess -EA Stop).DisableWindowsUpdateAccess -eq 1
+        }
+
+        # Toolchain
+        Chk ".NET SDK channel $DotNetChannel" {
+            $v = (& dotnet --version 2>&1) -as [string]
+            $v -and $v.StartsWith($DotNetChannel)
+        }
+        Chk 'Python C:\Python\python.exe present' { Test-Path 'C:\Python\python.exe' }
+        Chk "Python version $PythonVersion" {
+            $v = (& 'C:\Python\python.exe' --version 2>&1) -as [string]
+            $v -and $v.Trim() -eq "Python $PythonVersion"
+        }
+        Chk 'MSBuild.exe present' {
+            $msb = Get-Command msbuild -ErrorAction SilentlyContinue
+            $msb -and (Test-Path $msb.Source)
+        }
+
+        # No leftover installer files in C:\CI root
+        Chk 'no leftover installer scripts in C:\CI' {
+            $leftovers = Get-ChildItem 'C:\CI' -File -EA SilentlyContinue |
+                Where-Object { $_.Name -match 'wu_worker|wu_result|vs_buildtools|dotnet-install' }
+            $leftovers.Count -eq 0
+        }
+
+        return $results.ToArray()
+
+    } -ArgumentList $BuildUsername, $DotNetChannel, $PythonVersion
+
+    Write-Host ''
+    $failed   = 0
+    $deployCnt = 0
+    $setupCnt  = 0
+    $inSetup   = $false
+
+    foreach ($r in $checks) {
+        if (-not $inSetup -and $r.Name -match "^user $BuildUsername|^C:\\CI\\|wuauserv Start|UsoSvc Start|WU GPO|\.NET SDK|Python|MSBuild|leftover") {
+            Write-Host "`n  --- Setup checks ---" -ForegroundColor DarkCyan
+            $inSetup = $true
+        }
+        if ($r.Pass) {
+            Write-Host "  [OK]   $($r.Name)" -ForegroundColor Green
+        } else {
+            $detail = if ($r.Err) { "  ($($r.Err))" } else { '' }
+            Write-Host "  [FAIL] $($r.Name)$detail" -ForegroundColor Red
+            $failed++
+        }
+    }
+
+    Write-Host ''
+    if ($failed -eq 0) {
+        Write-Host "All $($checks.Count) checks passed — VM ready for BaseClean snapshot." -ForegroundColor Green
+        exit 0
+    }
+
+    if (-not $Remediate) {
+        Write-Host "$failed / $($checks.Count) checks FAILED." -ForegroundColor Red
+        Write-Host "Re-run with -Remediate to auto-fix known issues." -ForegroundColor Yellow
+        exit 1
+    }
+
+    # ── Remediation pass ─────────────────────────────────────────────────────
+    $failedNames = @($checks | Where-Object { -not $_.Pass } | Select-Object -ExpandProperty Name)
+    Write-Host "Applying remediation for $($failedNames.Count) failed check(s)..." -ForegroundColor Yellow
+
+    Invoke-Command -ComputerName $VMIPAddress -Credential $cred `
+        -Authentication Basic -SessionOption $so -ScriptBlock {
+
+        param([string[]] $FailedNames, [string] $AdminPassword)
+
+        if ($FailedNames -contains 'AutoAdminLogon=1, DefaultUserName=Administrator') {
+            $wl = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'
+            Set-ItemProperty $wl AutoAdminLogon    '1'             -Type String
+            Set-ItemProperty $wl DefaultUserName   'Administrator' -Type String
+            Set-ItemProperty $wl DefaultDomainName '.'             -Type String
+            Set-ItemProperty $wl DefaultPassword   $AdminPassword  -Type String
+            Write-Host "  [FIX] AutoAdminLogon keys written."
+        }
+        if ($FailedNames -contains 'wuauserv StartType=Disabled') {
+            Set-Service -Name wuauserv -StartupType Disabled -ErrorAction SilentlyContinue
+            Write-Host "  [FIX] wuauserv set to Disabled."
+        }
+        if ($FailedNames -contains 'UsoSvc StartType=Disabled') {
+            Set-Service -Name UsoSvc -StartupType Disabled -ErrorAction SilentlyContinue
+            Write-Host "  [FIX] UsoSvc set to Disabled."
+        }
+
+    } -ArgumentList $failedNames, $AdminPassword
+
+    # ── Re-run checks ─────────────────────────────────────────────────────────
+    Write-Host "`nRe-validating after remediation..." -ForegroundColor Cyan
+    $checks = Invoke-Command -ComputerName $VMIPAddress -Credential $cred `
+        -Authentication Basic -SessionOption $so -ScriptBlock {
+
+        param($BuildUsername, $DotNetChannel, $PythonVersion)
+        $results = [System.Collections.Generic.List[PSCustomObject]]::new()
+        function Chk {
+            param([string]$Name, [scriptblock]$Test)
+            try   { $ok = [bool](& $Test); $err = '' }
+            catch { $ok = $false; $err = $_.Exception.Message }
+            $results.Add([PSCustomObject]@{ Name=$Name; Pass=$ok; Err=$err })
+        }
+        foreach ($p in Get-NetFirewallProfile) { $n=$p.Name;$e=$p.Enabled; Chk "Firewall $n disabled" { $e -eq $false } }
+        Chk 'Defender GPO DisableAntiSpyware=1' { (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name DisableAntiSpyware -EA Stop).DisableAntiSpyware -eq 1 }
+        Chk 'WinRM service Running'   { (Get-Service WinRM -EA Stop).Status    -eq 'Running'   }
+        Chk 'WinRM service Automatic' { (Get-Service WinRM -EA Stop).StartType -eq 'Automatic' }
+        Chk 'WinRM AllowUnencrypted=true' { (Get-Item WSMan:\localhost\Service\AllowUnencrypted -EA Stop).Value -eq 'true' }
+        Chk 'WinRM Auth/Basic=true'       { (Get-Item WSMan:\localhost\Service\Auth\Basic -EA Stop).Value -eq 'true' }
+        Chk 'WinRM MaxMemoryPerShellMB >= 2048' { [int](Get-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB -EA Stop).Value -ge 2048 }
+        $polSys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
+        Chk 'UAC EnableLUA=0' { (Get-ItemProperty $polSys -Name EnableLUA -EA Stop).EnableLUA -eq 0 }
+        Chk 'UAC LocalAccountTokenFilterPolicy=1' { (Get-ItemProperty $polSys -Name LocalAccountTokenFilterPolicy -EA Stop).LocalAccountTokenFilterPolicy -eq 1 }
+        Chk 'Explorer LaunchTo=1 (HKCU)' { (Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' -Name LaunchTo -EA Stop).LaunchTo -eq 1 }
+        Chk 'NoLockScreen=1' { (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization' -Name NoLockScreen -EA Stop).NoLockScreen -eq 1 }
+        Chk 'Server Manager policy DoNotOpenAtLogon=1' { (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\ServerManager' -Name DoNotOpenAtLogon -EA Stop).DoNotOpenAtLogon -eq 1 }
+        Chk 'Server Manager HKLM DoNotOpenServerManagerAtLogon=1' { (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\ServerManager' -Name DoNotOpenServerManagerAtLogon -EA Stop).DoNotOpenServerManagerAtLogon -eq 1 }
+        Chk 'Server Manager task Disabled' { $t=Get-ScheduledTask -TaskPath '\Microsoft\Windows\Server Manager\' -TaskName 'ServerManager' -EA SilentlyContinue; (-not $t) -or ($t.State -eq 'Disabled') }
+        Chk 'Server Manager HKCU DoNotOpenServerManagerAtLogon=1' { (Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\ServerManager' -Name DoNotOpenServerManagerAtLogon -EA Stop).DoNotOpenServerManagerAtLogon -eq 1 }
+        Chk 'DisableCAD=1 (Policies\System)' { (Get-ItemProperty $polSys -Name DisableCAD -EA Stop).DisableCAD -eq 1 }
+        Chk 'OOBE DisablePrivacyExperience=1' { (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\OOBE' -Name DisablePrivacyExperience -EA Stop).DisablePrivacyExperience -eq 1 }
+        Chk 'DataCollection AllowTelemetry=0' { (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' -Name AllowTelemetry -EA Stop).AllowTelemetry -eq 0 }
+        Chk 'AutoAdminLogon=1, DefaultUserName=Administrator' { $wl=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' -EA Stop; $wl.AutoAdminLogon -eq '1' -and $wl.DefaultUserName -eq 'Administrator' }
+        Chk 'wuauserv StartType=Disabled' { (Get-Service wuauserv -EA Stop).StartType -eq 'Disabled' }
+        Chk 'UsoSvc StartType=Disabled'   { (Get-Service UsoSvc   -EA Stop).StartType -eq 'Disabled' }
+        Chk 'WU GPO NoAutoUpdate=1' { (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name NoAutoUpdate -EA Stop).NoAutoUpdate -eq 1 }
+        Chk 'WU GPO DisableWindowsUpdateAccess=1' { (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' -Name DisableWindowsUpdateAccess -EA Stop).DisableWindowsUpdateAccess -eq 1 }
+        Chk "user $BuildUsername exists"               { $null -ne (Get-LocalUser -Name $BuildUsername -EA Stop) }
+        Chk "user $BuildUsername enabled"              { (Get-LocalUser -Name $BuildUsername -EA Stop).Enabled }
+        Chk "user $BuildUsername PasswordNeverExpires" { (Get-LocalUser -Name $BuildUsername -EA Stop).PasswordExpires -eq $null }
+        Chk "user $BuildUsername member of Administrators" { [bool](& net localgroup Administrators 2>&1 | Select-String -SimpleMatch $BuildUsername) }
+        foreach ($dir in 'C:\CI\build','C:\CI\output','C:\CI\scripts') { Chk "$dir exists" { Test-Path $dir -PathType Container } }
+        Chk ".NET SDK channel $DotNetChannel" { $v=(& dotnet --version 2>&1) -as [string]; $v -and $v.StartsWith($DotNetChannel) }
+        Chk 'Python C:\Python\python.exe present' { Test-Path 'C:\Python\python.exe' }
+        Chk "Python version $PythonVersion" { $v=(& 'C:\Python\python.exe' --version 2>&1) -as [string]; $v -and $v.Trim() -eq "Python $PythonVersion" }
+        Chk 'MSBuild.exe present' { $msb=Get-Command msbuild -EA SilentlyContinue; $msb -and (Test-Path $msb.Source) }
+        Chk 'no leftover installer scripts in C:\CI' { $l=Get-ChildItem 'C:\CI' -File -EA SilentlyContinue | Where-Object { $_.Name -match 'wu_worker|wu_result|vs_buildtools|dotnet-install' }; $l.Count -eq 0 }
+        return $results.ToArray()
+    } -ArgumentList $BuildUsername, $DotNetChannel, $PythonVersion
+
+    Write-Host ''
+    $failed  = 0
+    $inSetup = $false
+    foreach ($r in $checks) {
+        if (-not $inSetup -and $r.Name -match "^user $BuildUsername|^C:\\CI\\|wuauserv Start|UsoSvc Start|WU GPO|\.NET SDK|Python|MSBuild|leftover") {
+            Write-Host "`n  --- Setup checks ---" -ForegroundColor DarkCyan
+            $inSetup = $true
+        }
+        if ($r.Pass) {
+            Write-Host "  [OK]   $($r.Name)" -ForegroundColor Green
+        } else {
+            $detail = if ($r.Err) { "  ($($r.Err))" } else { '' }
+            Write-Host "  [FAIL] $($r.Name)$detail" -ForegroundColor Red
+            $failed++
+        }
+    }
+    Write-Host ''
+    if ($failed -eq 0) {
+        Write-Host "All $($checks.Count) checks passed — VM ready for BaseClean snapshot." -ForegroundColor Green
+        exit 0
+    } else {
+        Write-Host "$failed / $($checks.Count) checks still FAILED after remediation." -ForegroundColor Red
+        exit 1
+    }
+
+} finally {
+    Set-Item WSMan:\localhost\Client\AllowUnencrypted $prevAllowUnenc   -Force -EA SilentlyContinue
+    Set-Item WSMan:\localhost\Client\TrustedHosts     $prevTrustedHosts -Force -EA SilentlyContinue
+}