Fix bypass.ps1 crash, strip dead answer-file payload, refresh docs for 2026

.github/PSScriptAnalyzerSettings.psd1

@@ -0,0 +1,20 @@
+@{
+    # Rules excluded for BypassNRO:
+    #
+    # PSAvoidUsingWriteHost -- this is an interactive tool run from the OOBE
+    #                          Shift+F10 console, where coloured status output
+    #                          is the point. There is no pipeline to pollute.
+    ExcludeRules = @(
+        'PSAvoidUsingWriteHost'
+    )
+
+    # The script targets Windows PowerShell 5.1, which is what Shift+F10
+    # provides during OOBE.
+    Rules = @{
+        PSUseCompatibleCmdlets = @{
+            compatibility = @(
+                'desktop-5.1.14393.206-windows'
+            )
+        }
+    }
+}

.github/workflows/powershell.yml

@@ -35,11 +35,9 @@ jobs:
         uses: microsoft/psscriptanalyzer-action@6b2948b1944407914a58661c49941824d149734f
         with:
           # Check https://github.com/microsoft/action-psscriptanalyzer for more info about the options.
-          # The below set up runs PSScriptAnalyzer to your entire repository and runs some basic security rules.
           path: .\
           recurse: true
-          # Include your own basic security rules. Removing this option will run all the rules
-          # includeRule: '"PSAvoidGlobalAliases", "PSAvoidUsingConvertToSecureStringWithPlainText"'
+          settings: .github/PSScriptAnalyzerSettings.psd1
           output: results.sarif
 
       # Upload the SARIF file generated in the previous step

.gitignore

@@ -0,0 +1,14 @@
+# Windows
+Thumbs.db
+desktop.ini
+$RECYCLE.BIN/
+
+# Editors
+.vscode/
+.idea/
+*.swp
+
+# Local test output
+*.log
+*.bak
+*.bak-*

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Stensel8
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,14 +1,16 @@
 # Bypass NRO
 
-## Status of Bypass Methods (December 2025)
+## Status of Bypass Methods (August 2026)
 
-Since March 2025, Microsoft's `oobe\bypassnro` command has been removed from Windows 11 (24H2/25H2). Until October 2025, the alternative `start ms-cxh:localonly` (and `start ms-cxh://setaddlocalonly`) worked, but this was blocked starting with Insider Build 26220.6772 (October 6, 2025) and only works on the current 25H2 stable branch.
+Since March 2025, Microsoft's `oobe\bypassnro` command has been removed from Windows 11 (24H2/25H2). The alternative `start ms-cxh:localonly` (and `start ms-cxh://setaddlocalonly`) was blocked starting with Insider build 26220.6772 (October 6, 2025). Whether that block reached the retail 25H2 branch (26200.x) has not been re-tested here, so check your own image before relying on it.
 
 The **BypassNRO method in this project still works** because it uses Sysprep with a custom unattend.xml. This approach remains functional for now, because unattend.xml is part of Windows' official enterprise deployment tools and cannot easily be blocked by Microsoft without breaking enterprise scenarios.
 
+Rufus, and on Pro/Enterprise "Set up for work or school" > "Sign-in options" > "Domain join instead", also still reach a local account.
+
 **Timeline:**
 - Removal of `oobe\bypassnro`: March 2025
-- Blocking of `ms-cxh:localonly`: October 6, 2025 (Insider build 26220.6772 and higher)
+- Blocking of `ms-cxh:localonly`: October 6, 2025 (Insider builds 26220.6772 / 26120.6772)
 
 ## Download and Run (Shift+F10 during OOBE)
 
@@ -20,4 +22,24 @@ iex(irm bypassnro.stensel.nl)
 ### CMD Wrapper
 ```powershell
 powershell -c "iex(irm bypassnro.stensel.nl)"
-```
+```
+
+`iex` cannot pass parameters. Use a script block for those:
+```powershell
+& ([scriptblock]::Create((irm bypassnro.stensel.nl))) -Force      # skip confirmation
+& ([scriptblock]::Create((irm bypassnro.stensel.nl))) -NoReboot   # shut down instead
+```
+
+## Without Sysprep (faster)
+
+Save [`unattend.xml`](unattend.xml) to the root of the Windows 11 USB as `autounattend.xml`. Setup reads it during installation, so OOBE never asks for an account and there is no second reboot.
+
+## Accounts
+
+`unattend.xml` creates `Admin` (Administrators) and `User` (Users), both **without a password**, and signs `Admin` in automatically once. Set a password right after first logon.
+
+## Notes
+
+Only the `oobeSystem` pass applies. `Sysprep /oobe` without `/generalize` does not re-run `specialize`, so anything placed there is ignored. For debloating and tweaks use [WinDeploy](https://github.com/Stensel8/WinDeploy) or [WinUtil](https://github.com/ChrisTitusTech/winutil).
+
+Troubleshooting: Sysprep logs to `C:\Windows\System32\Sysprep\Panther\setuperr.log`.

SECURITY.md

@@ -0,0 +1,17 @@
+## Reporting a Vulnerability
+
+**Do not open a public GitHub issue for security vulnerabilities.**
+
+Report privately via [GitHub Security Advisories](https://github.com/Stensel8/bypassnro/security/advisories/new).
+
+Include:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if any)
+
+You will receive a response within 7 days. If the report is accepted, a fix will be released as soon as possible and you will be credited in the release notes.
+
+### Out of scope
+
+By design, `unattend.xml` creates accounts without a password and auto-logs in once, and the one-liner downloads and runs a remote script. These are documented in the README, not vulnerabilities.