WinDeploy
Zero-touch Windows 11 deployment: drivers, applications, bloatware removal, security hardening and BitLocker
Run it
As Administrator, in PowerShell 7:
iex (irm "https://raw.githubusercontent.com/THectic-NL/WinDeploy/$((irm https://api.github.com/repos/THectic-NL/WinDeploy/releases/latest).tag_name)/Scripts/Start.ps1")Start.ps1 elevates if needed, installs PowerShell 7 and WinGet if they are missing, then hands off to Deploy.ps1, which downloads and runs each deployment step from that release in sequence.
Every run is pinned to one GitHub release tag, start to finish. A deployment that starts against v0.9.0 keeps using v0.9.0’s scripts even if main changes mid-run.
For USB / offline installs via autounattend.xml, and the full configuration reference, see the GitHub repository.
What it does
| Step | |
|---|---|
| RMM agent | Installs a monitoring agent from a USB drive, if present |
| Drivers | Dell Command Update or HP Client Management, model-detected |
| Hardening | SMB signing, LSA protection, HVCI, Defender ASR rules, screen lock — see below |
| Applications | WinGet + Microsoft 365 via CDN/ODT |
| Bloatware removal | Removes consumer apps, blocks their reinstall via policy |
| Tweaks | A WinUtil Standard preset, applied automatically |
| Theme, hostname | Dark mode, PC-<serial> naming |
| Windows Update | Installs everything available |
BitLocker asks before it runs, times out after 90 seconds and defaults to no, so an unattended run never stalls. Pass -NonInteractive to skip it outright. The WinUtil tweaks apply automatically with no prompt; pass -Tweaks No to skip them.
Security hardening
Applied automatically: SMBv1 removed, SMB signing required, insecure guest logons blocked, LSA protection (RunAsPPL), WDigest plaintext credential caching disabled, anonymous SAM/share enumeration restricted, LLMNR disabled, memory integrity (HVCI), 9 Defender Attack Surface Reduction rules, AutoRun disabled, secure screen lock.
BitLocker, on confirmation, encrypts C: with XTS-AES-256, creates a recovery password, saves it to the operator’s Documents folder and prints it on screen.
Credits
Built on PowerShell, WinGet, PSWindowsUpdate, winget-install by asheroto, and — for the optional tweaks step — WinUtil by Chris Titus.