# OOBE unattend (Phase 3c)

Put `oobe-unattend.xml` here: an **oobeSystem-only** answer file built with
https://schneegans.de/windows/unattend-generator/ that:

- hides EULA / online-account / privacy pages
- creates the local deployment admin (throwaway password; FirstLogon randomizes it)
- auto-logs on once
- `FirstLogonCommands`: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\ProgramData\CommandN\FirstLogon.ps1`

**Do not overwrite** `C:\Windows\Panther\Unattend.xml` written by OSDCloud. After the first VM
deploy, inspect it, then add a merge step to `Start-CommandN.ps1` that inserts your
`<settings pass="oobeSystem">` block.

This file contains a password (even a throwaway one), so keep it out of `web/` once it's real:
move it to `workspace-config/` (baked into media) or fetch it via the PIN-protected profile API.