[ui] add a new selection dialog for Windows 11 setup customization

* This moves the extended Windows 11 options (bypass TPM & Secure Boot) away from "Image options" into a new explicit dialog, along with supplementary customization such as enabling offline account (for Windows 11 22H2) and skipping all data collection questions. * This customization is now enacted through an unattend.xml file rather than offline registry manipulation, so that this *should* also work with the Windows Store version. * Also update arch detection and rework/reorganize upcoming translation changes. * Note: The 'Remove "unsupported hardware" desktop watermark' option is *UNTESTED*.
pbatard · Jun 23, 2022 · a0d6692 · a0d6692
1 parent 9690742
commit a0d6692
Show file tree

Hide file tree

Showing 11 changed files with 316 additions and 178 deletions.
diff --git a/res/loc/ChangeLog.txt b/res/loc/ChangeLog.txt
@@ -5,12 +5,16 @@ To edit a translation, please make sure to follow:
 https://github.com/pbatard/rufus/wiki/Localization#Editing_an_existing_translation
 Or simply download https://rufus-web.akeo.ie/locale/pollock.exe and follow its directions.
 
-o v3.?? (????.??.??)
-  - *UPDATED*  MSG_305 Reworked the message to mention the new Windows 11 Extended option
-  - *NEW*      MSG_322 "Standard Windows 11 Installation (TPM 2.0 + Secure Boot)"
-  - *NEW*      MSG_323 "Extended Windows 11 Installation (no TPM / no Secure Boot)"
-  - *NEW*      MSG_324 "Removing Windows 11 installation restrictions: %s"
-  - *NEW*      MSG_325 "Unable to open or read '%s'"
+o v3.20 (2022.??.??)
+  - *NEW*      MSG_323 "Unable to open or read '%s'"
+  - *NEW*      MSG_325 "Applying Windows customization: %s"
+  - *NEW*      MSG_326 "Windows User Experience"
+  - *NEW*      MSG_327 "Customize Windows installation?"
+  - *NEW*      MSG_328 "Remove requirement for Secure Boot and TPM 2.0"
+  - *NEW*      MSG_329 "Remove requirement for 4GB+ RAM and 64GB+ disk"
+  - *NEW*      MSG_330 "Remove requirement for an online Microsoft account"
+  - *NEW*      MSG_331 "Remove \"unsupported hardware\" desktop watermark"
+  - *NEW*      MSG_332 "Disable data collection (Skip privacy questions)"
 
 o v3.14 (2021.03.31)
   - *UPDATED*  MSG_068 "Error while partitioning drive." -> "Could not partition drive."

diff --git a/res/loc/rufus.loc b/res/loc/rufus.loc
@@ -559,9 +559,7 @@ t MSG_301 "Show application settings"
 t MSG_302 "Show information about this application"
 t MSG_303 "Show the log"
 t MSG_304 "Create a disk image of the selected device"
-t MSG_305 "Use this option to indicate if you plan to install Windows to a different disk, or if you want to run Windows "
-	"directly from this drive (Windows To Go).\r\nIn 'Extended Windows 11 Installation' mode, Rufus will patch the "
-	"media so that Windows 11 can be installed on platforms that don't meet the TPM 2.0 or Secure Boot requirements."
+t MSG_305 "Use this option to indicate if you plan to install Windows to a different disk, or if you want to run Windows directly from this drive (Windows To Go)."
 # You can see this status message by pressing <Ctrl>-<Alt>-<Z> and then selecting START.
 # It's the same as MSG_286 but with a process that *may* be faster, hence the name.
 t MSG_306 "Fast-zeroing drive: %s"
@@ -583,10 +581,15 @@ t MSG_319 "Ignore Boot Marker"
 t MSG_320 "Refreshing partition layout (%s)..."
 t MSG_321 "The image you have selected is an ISOHybrid, but its creators have not made it compatible with ISO/File "
 	"copy mode.\nAs a result, DD image writing mode will be enforced."
-t MSG_322 "Standard Windows 11 Installation (TPM 2.0 + Secure Boot)"
-t MSG_323 "Extended Windows 11 Installation (no TPM / no Secure Boot)"
-t MSG_324 "Removing Windows 11 installation restrictions: %s"
-t MSG_325 "Unable to open or read '%s'"
+t MSG_322 "Unable to open or read '%s'"
+t MSG_325 "Applying Windows customization: %s"
+t MSG_326 "Windows User Experience"
+t MSG_327 "Customize Windows installation?"
+t MSG_328 "Remove requirement for Secure Boot and TPM 2.0"
+t MSG_329 "Remove requirement for 4GB+ RAM and 64GB+ disk"
+t MSG_330 "Remove requirement for an online Microsoft account"
+t MSG_331 "Remove \"unsupported hardware\" desktop watermark"
+t MSG_332 "Disable data collection (Skip privacy questions)"
 
 #########################################################################
 l "ar-SA" "Arabic (العربية)" 0x0401, 0x0801, 0x0c01, 0x1001, 0x1401, 0x1801, 0x1c01, 0x2001, 0x2401, 0x2801, 0x2c01, 0x3001, 0x3401, 0x3801, 0x3c01, 0x4001
@@ -2061,7 +2064,7 @@ t MSG_301 "顯示應用程式設定"
 t MSG_302 "顯示此應用程式資訊"
 t MSG_303 "顯示記錄檔"
 t MSG_304 "建立選擇的裝置的磁碟映像"
-t MSG_305 "是否要使用此裝置來安裝 Windows 在另一個磁碟上，或是要直接在此磁碟上執行 Windows (Windows To Go)。\r\n在「擴充 Windows 11 安裝」模式中，Rufus 將修補裝置，以使 Windows 11 能夠安裝在不符合 TPM 2.0 或安全開機要求的系統上。"
+t MSG_305 "是否要使用此裝置來安裝 Windows 在另一個磁碟上，或是要直接在此磁碟上執行 Windows (Windows To Go)。"
 t MSG_306 "正在快速寫入零: %s"
 t MSG_307 "可能需要一段時間"
 t MSG_308 "虛擬硬碟偵測"
@@ -2078,10 +2081,7 @@ t MSG_318 "預設執行緒優先順序: %d"
 t MSG_319 "忽略 Boot Marker"
 t MSG_320 "正在重新整理磁區分割 (%s)..."
 t MSG_321 "你選擇的映像檔是 ISOHybrid，但是檔案作者沒有使之與 ISO/檔案複製模式相容。\n因此強制使用 DD 映像寫入模式。"
-t MSG_322 "標準 Windows 11 安裝 (TPM 2.0 + 安全開機)"
-t MSG_323 "擴充 Windows 11 安裝 (無 TPM 和安全開機)"
-t MSG_324 "正在移除 Windows 11 安裝限制: %s"
-t MSG_325 "無法開啟或讀取 '%s'"
+t MSG_322 "無法開啟或讀取 '%s'"
 
 #########################################################################
 l "hr-HR" "Croatian (Hrvatski)" 0x041a, 0x081a, 0x101a
@@ -4285,7 +4285,7 @@ t MSG_301 "Affiche les paramètres de l'application"
 t MSG_302 "Affiche des informations à propos de cette application"
 t MSG_303 "Affiche le log"
 t MSG_304 "Crée une image disque à partir du périphérique sélectionné"
-t MSG_305 "Utilisez cette option pour indiquer si vous voulez installer Windows sur un autre disque, ou bien exécuter Windows directement depuis ce périphérique (Windows To Go).\r\nEn mode 'Installation Windows 11 étendue', Rufus modifiera le périphérique de manière à ce que Windows 11 puisse être installé sur les plateformes qui ne sont pas compatibles avec les exigences matérielles TPM 2.0 ou Secure Boot."
+t MSG_305 "Utilisez cette option pour indiquer si vous voulez installer Windows sur un autre disque, ou bien exécuter Windows directement depuis ce périphérique (Windows To Go)."
 t MSG_306 "Effacement 'rapide' à zéro : %s"
 t MSG_307 "peut prendre du temps"
 t MSG_308 "Détection VHD"
@@ -4302,9 +4302,6 @@ t MSG_318 "Priorité de thread part default : %d"
 t MSG_319 "Ignorer le marqueur de démarrage"
 t MSG_320 "Rafraichissement du schéma de partition (%s)..."
 t MSG_321 "L’image que vous avez sélectionnée est de type ISOHybrid, mais ses créateurs ne l’ont pas rendue compatible avec le mode ISO (i.e. copie de fichier).\nA cause de cela, seule l’écriture en mode DD est applicable."
-t MSG_322 "Installation standard de Windows 11 (TPM 2.0 + Secure Boot)"
-t MSG_323 "Installation Windows 11 étendue (sans TPM / sans Secure Boot)"
-t MSG_324 "Elimination des restrictions d’installation de Windows 11: %s"
 
 #########################################################################
 l "de-DE" "German (Deutsch)" 0x0407, 0x0807, 0x0c07, 0x1007, 0x1407
@@ -5774,7 +5771,7 @@ t MSG_301 "Az alkalmazás beállításainak megjelenítése"
 t MSG_302 "Az alkalmazás névjegyének megjelenítése"
 t MSG_303 "Napló megjelenítése"
 t MSG_304 "Lemezkép készítése a kiválasztott eszközről"
-t MSG_305 "Ezzel a beállítással jelezheted, ha a Windows rendszert egy másik lemezre szeretnéd telepíteni, vagy közvetlenül erről a meghajtóról szeretnéd futtatni a Windows rendszert (Windows To Go).\n„Kiterjesztett Windows 11 telepítés” módban a Rufus úgy módosítja az adathordozót, hogy a Windows 11 olyan platformokon is telepíthető legyen, amelyek nem felelnek meg a TPM 2.0 vagy a Secure Boot követelményeinek."
+t MSG_305 "Ezzel a beállítással jelezheted, ha a Windows rendszert egy másik lemezre szeretnéd telepíteni, vagy közvetlenül erről a meghajtóról szeretnéd futtatni a Windows rendszert (Windows To Go)."
 t MSG_306 "Meghajtó gyors-nullázása: %s"
 t MSG_307 "ez eltarthat egy kis ideig"
 t MSG_308 "VHD észlelés"
@@ -5791,10 +5788,7 @@ t MSG_318 "Alapértelmezett szál prioritás: %d"
 t MSG_319 "Boot Marker figyelmen kívül hagyása"
 t MSG_320 "Partíció elrendezés frissítése (%s)..."
 t MSG_321 "A kiválasztott képfájl egy ISOHybrid képfájl, de a készítői nem tették kompatibilissé az ISO (fájlmásolás) móddal.\nEmiatt a DD képfájl írási mód lesz kényszerítve."
-t MSG_322 "Alapértelmezett Windows 11 telepítés  (TPM 2.0 + Secure Boot)"
-t MSG_323 "Kiterjesztett Windows 11 telepítés (nincs TPM / nincs Secure Boot)"
-t MSG_324 "Windows 11 telepítési korlátozások eltávolítása: %s"
-t MSG_325 "Nem lehet megnyitni vagy olvasni ezt: '%s'"
+t MSG_322 "Nem lehet megnyitni vagy olvasni ezt: '%s'"
 
 #########################################################################
 l "id-ID" "Indonesian (Bahasa Indonesia)" 0x0421
@@ -9878,9 +9872,6 @@ t MSG_318 "Prioridade padrão da thread: %d"
 t MSG_319 "Ignorar marcador de inicialização"
 t MSG_320 "Atualizando o layout da partição (%s)..."
 t MSG_321 "A imagem que você selecionou é uma ISOHybrid, mas os criadores não a tornaram compatível com o modo de cópia ISO/Arquivo.\nComo resultado, o modo de gravação de imagem DD será aplicado."
-t MSG_322 "Instalação padrão do Windows 11 (TPM 2.0 + Secure Boot)"
-t MSG_323 "Instalação estendida do Windows 11 (sem TPM / sem Secure Boot)"
-t MSG_324 "Removendo as restrições de instalação do Windows 11: %s"
 
 #########################################################################
 l "pt-PT" "Portuguese Standard (Português)" 0x0816
@@ -10253,9 +10244,6 @@ t MSG_318 "Prioridade padrão do thread: %d"
 t MSG_319 "Ignorar marcador de arranque"
 t MSG_320 "A atualizar a estrutura da partição (%s)..."
 t MSG_321 "A imagem que selecionou é ISOHybrid mas os criadores não a tornaram compatível com o modo de cópia ISO/Ficheiro.\nComo resultado, será aplicado o modo de gravação da imagem DD."
-t MSG_322 "Instalação padrão do Windows 11 (TPM 2.0 + Secure Boot)"
-t MSG_323 "Instalação alterada do Windows 11 (sem TPM / sem Secure Boot)"
-t MSG_324 "A remover as restrições de instalação do Windows 11: %s"
 
 #########################################################################
 l "ro-RO" "Romanian (Română)" 0x0418, 0x0818
@@ -10613,7 +10601,7 @@ t MSG_301 "Afișați setările aplicației"
 t MSG_302 "Afișați informații despre această aplicație"
 t MSG_303 "Afișați jurnalul"
 t MSG_304 "Generați o imagine de disc după dispozitivul selectat"
-t MSG_305 "Utilizați această opțiune pentru a indica dacă planificați să instalați Windows pe un alt disc, sau dacă doriți să rulați Windows direct de pe această unitate (Windows To Go).\nÎn modul 'Instalare Windows 11 extinsă', Rufus va aplica un patch astfel încât Windows 11 să poată fi instalat pe platforme care nu îndeplinesc cerințele TPM 2.0 sau Secure Boot."
+t MSG_305 "Utilizați această opțiune pentru a indica dacă planificați să instalați Windows pe un alt disc, sau dacă doriți să rulați Windows direct de pe această unitate (Windows To Go)."
 t MSG_306 "Se scriu rapid zerouri pe unitate: %s"
 t MSG_307 "poate dura mai mult timp"
 t MSG_308 "Detectare VHD"
@@ -10630,9 +10618,6 @@ t MSG_318 "Prioritate implicită pentru firul de execuție: %d"
 t MSG_319 "Ignorare Boot Marker"
 t MSG_320 "Se reîmprospătează așezarea partițiilor (%s)..."
 t MSG_321 "Imaginea selectată este de tip ISOHybrid, însă creatorii acesteia nu au făcut-o să fie compatibilă cu modul ISO/Copiere fișiere.\nDrept urmare, modul imagine DD va fi aplicat."
-t MSG_322 "Instalare Windows 11 standard (TPM 2.0 + Secure Boot)"
-t MSG_323 "Instalare Windows 11 extinsă (fără TPM / fără Secure Boot)"
-t MSG_324 "Se elimină restricțiile pentru instalarea Windows 11: %s"
 
 #########################################################################
 l "ru-RU" "Russian (Русский)" 0x0419, 0x0819

diff --git a/src/format.c b/src/format.c
@@ -71,9 +71,10 @@ extern const int nb_steps[FS_MAX];
 extern uint32_t dur_mins, dur_secs;
 extern uint32_t wim_nb_files, wim_proc_files, wim_extra_files;
 static int actual_fs_type, wintogo_index = -1, wininst_index = 0;
-extern BOOL force_large_fat32, enable_ntfs_compression, lock_drive, zero_drive, fast_zeroing, enable_file_indexing, write_as_image;
-extern BOOL use_vds, write_as_esp, is_vds_available;
+extern BOOL force_large_fat32, enable_ntfs_compression, lock_drive, zero_drive, fast_zeroing, enable_file_indexing;
+extern BOOL write_as_image, use_vds, write_as_esp, is_vds_available, enable_inplace;
 extern const grub_patch_t grub_patch[2];
+extern char* unattend_xml_path;
 uint8_t *grub2_buf = NULL, *sec_buf = NULL;
 long grub2_len;
 
@@ -1468,80 +1469,69 @@ static BOOL SetupWinToGo(DWORD DriveIndex, const char* drive_name, BOOL use_esp)
 }
 
 /*
- * Edit sources/boot.wim registry to remove Windows 11 install restrictions
+ * Add unattend.xml to 'sources\boot.wim' (install) or 'Windows\Panther\' (Windows To Go)
  */
-BOOL RemoveWindows11Restrictions(char drive_letter)
+BOOL ApplyWindowsCustomization(char drive_letter, BOOL windows_to_go)
 {
-	BOOL r = FALSE, is_hive_mounted = FALSE;
-	int i;
+	BOOL r = FALSE;
 	const int wim_index = 2;
-	const char* offline_hive_name = "RUFUS_OFFLINE_HIVE";
-	const char* key_name[] = { "BypassTPMCheck", "BypassSecureBootCheck" };
-	char boot_wim_path[] = "#:\\sources\\boot.wim", key_path[64];
-	char* mount_path = NULL;
-	char path[MAX_PATH];
-	HKEY hKey = NULL, hSubKey = NULL;
-	LSTATUS status;
-	DWORD dwDisp, dwVal = 1;
-
-	boot_wim_path[0] = drive_letter;
-
-	UpdateProgressWithInfoForce(OP_PATCH, MSG_324, 0, PATCH_PROGRESS_TOTAL);
-	uprintf("Mounting '%s'...", boot_wim_path);
-
-	mount_path = WimMountImage(boot_wim_path, wim_index);
-	if (mount_path == NULL)
-		goto out;
-
-	static_sprintf(path, "%s\\Windows\\System32\\config\\SYSTEM", mount_path);
-	if (!MountRegistryHive(HKEY_LOCAL_MACHINE, offline_hive_name, path))
-		goto out;
-	UpdateProgressWithInfoForce(OP_PATCH, MSG_324, 102, PATCH_PROGRESS_TOTAL);
-	is_hive_mounted = TRUE;
-
-	static_sprintf(key_path, "%s\\Setup", offline_hive_name);
-	status = RegOpenKeyExA(HKEY_LOCAL_MACHINE, key_path, 0, KEY_READ | KEY_CREATE_SUB_KEY, &hKey);
-	if (status != ERROR_SUCCESS) {
-		SetLastError(status);
-		uprintf("Could not open 'HKLM\\SYSTEM\\Setup' registry key: %s", WindowsErrorString());
-		goto out;
-	}
+	char boot_wim_path[] = "?:\\sources\\boot.wim";
+	char appraiserres_dll_src[] = "?:\\sources\\appraiserres.dll";
+	char appraiserres_dll_dst[] = "?:\\sources\\appraiserres.bak";
+	char *mount_path = NULL, path[MAX_PATH];
+
+	assert(unattend_xml_path != NULL);
+	uprintf("Applying Windows customization:");
+	if (windows_to_go) {
+		static_sprintf(path, "%c:\\Windows\\Panther", drive_letter);
+		if (!CreateDirectoryA(path, NULL) && GetLastError() != ERROR_ALREADY_EXISTS) {
+			uprintf("Could not create '%s' : %s", path, WindowsErrorString());
+			goto out;
+		}
+		static_sprintf(path, "%c:\\Windows\\Panther\\unattend.xml", drive_letter);
+		if (!CopyFileA(unattend_xml_path, path, TRUE)) {
+			uprintf("Could not create '%s' : %s", path, WindowsErrorString());
+			goto out;
+		}
+		uprintf("Added '%s'", path);
+	} else {
+		boot_wim_path[0] = drive_letter;
+		if (enable_inplace) {
+			// Create a backup of sources\appraiserres.dll and then create an empty file to
+			// allow in-place upgrades without TPM/SB. Note that we need to create an empty,
+			// appraiserres.dll otherwise setup.exe extracts its own.
+			appraiserres_dll_src[0] = drive_letter;
+			appraiserres_dll_dst[0] = drive_letter;
+			if (!MoveFileExU(appraiserres_dll_src, appraiserres_dll_dst, MOVEFILE_REPLACE_EXISTING))
+				uprintf("Could not rename '%s': %s", appraiserres_dll_src, WindowsErrorString());
+			else
+				CloseHandle(CreateFileU(appraiserres_dll_src, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ,
+					NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL));
+			uprintf("Renamed '%s' → '%s'", appraiserres_dll_src, appraiserres_dll_dst);
+		}
 
-	status = RegCreateKeyExA(hKey, "LabConfig", 0, NULL, 0,
-		KEY_SET_VALUE | KEY_QUERY_VALUE | KEY_CREATE_SUB_KEY, NULL, &hSubKey, &dwDisp);
-	if (status != ERROR_SUCCESS) {
-		SetLastError(status);
-		uprintf("Could not create 'HKLM\\SYSTEM\\Setup\\LabConfig' registry key: %s", WindowsErrorString());
-		goto out;
-	}
+		UpdateProgressWithInfoForce(OP_PATCH, MSG_325, 0, PATCH_PROGRESS_TOTAL);
+		uprintf("Mounting '%s'...", boot_wim_path);
+		mount_path = WimMountImage(boot_wim_path, wim_index);
+		if (mount_path == NULL)
+			goto out;
 
-	for (i = 0; i < ARRAYSIZE(key_name); i++) {
-		status = RegSetValueExA(hSubKey, key_name[i], 0, REG_DWORD, (LPBYTE)&dwVal, sizeof(DWORD));
-		if (status != ERROR_SUCCESS) {
-			SetLastError(status);
-			uprintf("Could not set 'HKLM\\SYSTEM\\Setup\\LabConfig\\%s' registry key: %s",
-				key_name[i], WindowsErrorString());
+		static_sprintf(path, "%s\\Autounattend.xml", mount_path);
+		if (!CopyFileU(unattend_xml_path, path, TRUE)) {
+			uprintf("Could not create boot.wim 'Autounattend.xml': %s", WindowsErrorString());
 			goto out;
 		}
-		uprintf("Created 'HKLM\\SYSTEM\\Setup\\LabConfig\\%s' registry key", key_name[i]);
+		uprintf("Added 'Autounattend.xml' to '%s'", boot_wim_path);
+		UpdateProgressWithInfoForce(OP_PATCH, MSG_325, 103, PATCH_PROGRESS_TOTAL);
 	}
-	UpdateProgressWithInfoForce(OP_PATCH, MSG_324, 103, PATCH_PROGRESS_TOTAL);
 	r = TRUE;
 
 out:
-	if (hSubKey != NULL)
-		RegCloseKey(hSubKey);
-	if (hKey != NULL)
-		RegCloseKey(hKey);
-	if (is_hive_mounted) {
-		UnmountRegistryHive(HKEY_LOCAL_MACHINE, offline_hive_name);
-		UpdateProgressWithInfoForce(OP_PATCH, MSG_324, 104, PATCH_PROGRESS_TOTAL);
-	}
 	if (mount_path) {
 		uprintf("Unmounting '%s'...", boot_wim_path, wim_index);
 		WimUnmountImage(boot_wim_path, wim_index);
+		UpdateProgressWithInfo(OP_PATCH, MSG_325, PATCH_PROGRESS_TOTAL, PATCH_PROGRESS_TOTAL);
 	}
-	UpdateProgressWithInfo(OP_PATCH, MSG_324, PATCH_PROGRESS_TOTAL, PATCH_PROGRESS_TOTAL);
 	free(mount_path);
 	return r;
 }
@@ -1900,8 +1890,6 @@ DWORD WINAPI FormatThread(void* param)
 	char drive_letters[27], fs_name[32], label[64];
 	char logfile[MAX_PATH], *userdir;
 	char efi_dst[] = "?:\\efi\\boot\\bootx64.efi";
-	char appraiserres_dll_src[] = "?:\\sources\\appraiserres.dll";
-	char appraiserres_dll_dst[] = "?:\\sources\\appraiserres.bak";
 	char kolibri_dst[] = "?:\\MTLD_F32";
 	char grub4dos_dst[] = "?:\\grldr";
 
@@ -2336,6 +2324,10 @@ DWORD WINAPI FormatThread(void* param)
 						FormatStatus = ERROR_SEVERITY_ERROR | FAC(FACILITY_STORAGE) | APPERR(ERROR_ISO_EXTRACT);
 					goto out;
 				}
+				if (unattend_xml_path != NULL) {
+					if (!ApplyWindowsCustomization(drive_name[0], TRUE))
+						FormatStatus = ERROR_SEVERITY_ERROR | FAC(FACILITY_STORAGE) | APPERR(ERROR_CANT_PATCH);
+				}
 			} else {
 				assert(!img_report.is_windows_img);
 				if (!ExtractISO(image_path, drive_name, FALSE)) {
@@ -2374,20 +2366,8 @@ DWORD WINAPI FormatThread(void* param)
 					if (!SetupWinPE(drive_name[0]))
 						FormatStatus = ERROR_SEVERITY_ERROR|FAC(FACILITY_STORAGE)|APPERR(ERROR_CANT_PATCH);
 				}
-				if (ComboBox_GetCurItemData(hImageOption) == IMOP_WIN_EXTENDED) {
-					// Create a backup of sources\appraiserres.dll and then create an empty file to
-					// allow in-place upgrades without TPM/SB. Note that we need to create an empty,
-					// appraiserres.dll otherwise setup.exe extracts its own.
-					appraiserres_dll_src[0] = drive_name[0];
-					appraiserres_dll_dst[0] = drive_name[0];
-					uprintf("Renaming: '%s' → '%s'", appraiserres_dll_src, appraiserres_dll_dst);
-					if (!MoveFileExU(appraiserres_dll_src, appraiserres_dll_dst, MOVEFILE_REPLACE_EXISTING))
-						uprintf("  Rename failed: %s", WindowsErrorString());
-					else
-						CloseHandle(CreateFileU(appraiserres_dll_src, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ,
-							NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL));
-					// Now patch for boot-time TPM/SB checks.
-					if (!RemoveWindows11Restrictions(drive_name[0]))
+				if (unattend_xml_path != NULL) {
+					if (!ApplyWindowsCustomization(drive_name[0], FALSE))
 						FormatStatus = ERROR_SEVERITY_ERROR | FAC(FACILITY_STORAGE) | APPERR(ERROR_CANT_PATCH);
 				}
 			}