Fix bypass.ps1 crash, strip dead answer-file payload, refresh docs for 2026 - #23
Closed
Stensel8 wants to merge 4 commits into
Closed
Fix bypass.ps1 crash, strip dead answer-file payload, refresh docs for 2026#23Stensel8 wants to merge 4 commits into
Stensel8 wants to merge 4 commits into
Conversation
…r 2026 bypass.ps1 had a guaranteed crash on its failure path: Write-Error does not take -ForegroundColor, so the final error handler threw a ParameterBindingException instead of reporting the problem. The file also carried two duplicate comment-based help blocks from an earlier merge. Rewrote it with the things a script that reboots your machine should have: a confirmation prompt (with -Force to skip), -WhatIf support via ShouldProcess, TLS 1.2 for images that still default to TLS 1.0, download to a temp file with XML validation before anything lands in C:\Windows\Panther, a backup of any existing answer file, and a pointer to setuperr.log when Sysprep refuses to run. unattend.xml went from 512 to 100 lines. Sysprep /oobe without /generalize does not re-run the specialize pass, so the ~40 app removals, 16 capability removals and all the script-extraction machinery parked there never executed - while making the file look like it debloated the machine. Removed rather than left in place looking functional. The oobeSystem pass, which is what actually performs the bypass, is kept and now also carries HideOnlineAccountScreens/HideLocalAccountScreen, plus self-contained FirstLogonCommands that no longer depend on files the specialize pass was supposed to have written. README rechecked against the current state (August 2026): ms-cxh:localonly is now blocked in stable, not just Insider, so the previous "only works on the current 25H2 stable branch" note was out of date. Added the working alternatives (Rufus, domain join on Pro, the BypassNRO registry value and its caveat) and documented putting the file on the USB as autounattend.xml, which avoids Sysprep and the second OOBE pass entirely. Also documented what was previously unstated: both accounts are created without a password and Admin autologs in once. Added the missing LICENSE, SECURITY.md, .gitignore and a PSScriptAnalyzer settings file, and wired the settings into CI. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pt5Q3XvjMT6HMdubvkyLMW
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
DevSkim flags this as an error on the PR (DS440000 and DS440020, both "Do not hardcode SSL/TLS versions within an application", severity important). Verified against the rule definitions: DS440020 applies to PowerShell and matches SecurityProtocolType, DS440000 matches the Tls12 literal. The scanner is right. Windows 11 is the only supported target here, and it already negotiates TLS 1.2/1.3 through SystemDefault. Pinning a version only stops the OS from handing us a better protocol later. The TLS 1.0 default this was guarding against belongs to Windows 7/8.1-era images, which this script does not support. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pt5Q3XvjMT6HMdubvkyLMW
…m DS104456 Two unrelated corrections. I overstated the ms-cxh:localonly row. I wrote that the block had "since rolled into stable", but I never verified that. Every primary source was unreachable from this environment (the egress proxy blocks learn.microsoft.com, the tech press and the forums), so the claim rested on search-result summaries saying "not supported anymore on the latest Windows 11 builds" - which is vague, and the build numbers actually cited are Insider ones (Dev 26220.6772, Beta 26120.6772). The retail 25H2 branch is 26200.x, and whether the block reached it is exactly the part I could not confirm. The previous README said it still worked on stable, so this was a change to a factual claim on thin evidence. The row now says "Blocked on Insider; retail unconfirmed" and states plainly that it has not been re-tested. Added a short note on how current the table is, so readers can see which rows are verified and which are compiled from public reporting. Separately: DevSkim reported two errors on this PR, DS104456 "Use of restricted functions". Fetched the check-run annotations to get the exact lines rather than guessing - both were the bare token `iex` in the comment-based help, which DevSkim matches because it does not treat a <# #> block as a comment. Reworded both .EXAMPLE entries to the script-block form, which is what supports parameters anyway; the one-liner stays documented in the README, which was not flagged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pt5Q3XvjMT6HMdubvkyLMW
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pt5Q3XvjMT6HMdubvkyLMW
Stensel8
added a commit
that referenced
this pull request
Sep 2, 2026
- Update bypass.ps1 with fixes from PR #23 - Update unattend.xml (cleaned up) - Update README.md with cleaned up version from PR #23 - Add SECURITY.md and LICENSE from PR #23 - Update .gitignore with Windows-specific entries - Add PSScriptAnalyzer workflow from PR #23 - Update checksums for new bypass.ps1 - Update all links to use bypassnro.thectic.nl domain Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Audit of the repo: does the bypass still work, is the documented information still accurate, and are there better routes now?
The bypass still works, but the answer file was doing far less than it appeared to, and the script had a guaranteed crash on its failure path.
Bugs
Write-Error ... -ForegroundColor Redcannot bind —Write-Errorhas no-ForegroundColorparameter, so the final error handler threw aParameterBindingExceptioninstead of reporting the problem. Reproduced on PowerShell 7.5.4. There were also two duplicate comment-based help blocks from an earlier merge.The answer file was mostly dead code
Sysprep /oobewithout/generalizedoes not re-run thespecializepass, so everything in it never executed: ~40 app removals, 16 capability removals, 4 optional-feature removals and theExtractScriptmachinery. BecauseExtractScriptnever ran,FirstLogon.ps1was never written either, so theFirstLogonCommandsentry pointing at it failed every time — leavingAutoLogonCountunreset and the answer file undeleted.512 to 100 lines. What remains is the
oobeSystempass, which is what actually performs the bypass, with self-containedFirstLogonCommands. Removed rather than repaired: someone running a tool called "bypassnro" to get a local account should not silently lose Notepad and Paint.Script
bypass.ps1now has a confirmation prompt (-Forceto skip),-WhatIfviaShouldProcess,$ProgressPreferenceoff for speed, download to a temp file with XML validation before anything lands inC:\Windows\Panther, a backup of any existing answer file, and a pointer tosetuperr.logwhen Sysprep refuses to run.Documentation
README said December 2025. Updated, and one claim corrected:
ms-cxh:localonlyis confirmed blocked on Insider builds (Dev 26220.6772 / Beta 26120.6772), but whether that reached retail 25H2 (26200.x) is not something I could verify, so the README now says so instead of asserting it.Added the faster route — put the file on the USB as
autounattend.xmland Setup consumes it directly, no Sysprep and no second OOBE pass. Also documented that both accounts are created without a password andAdminsigns in automatically, which was previously unstated.Repo hygiene
Added the missing
LICENSE(MIT, matching WinDeploy),SECURITY.md,.gitignoreand aPSScriptAnalyzerSettings.psd1wired into the workflow.Testing
PowerShell 7.5.4 and PSScriptAnalyzer 1.24: parses clean, 0 findings, comment-based help parses,
unattend.xmlwell-formed with CRLF preserved.Not tested against a real Sysprep run — the specialize-pass finding is based on Microsoft's documented behaviour, so worth a spot-check on a VM before merging.
🤖 Generated with Claude Code
https://claude.ai/code/session_01Pt5Q3XvjMT6HMdubvkyLMW
Generated by Claude Code