Bypass OOBE (Powershell edition)

README

This guide explains how to run the PowerShell version of the OOBE bypass script during Windows 11 setup. It includes three methods:
	1.	Using Explorer (double-click the script)
	2.	Using CMD → PowerShell from USB
	3.	Using CMD → PowerShell running the script directly from an online link

PowerShell is available inside OOBE, but must be started manually from CMD.

⸻

What the script does:
	•	Bypasses the OOBE network requirement
	•	Creates a predefined local admin user
	•	Removes or disables defaultuser0
	•	Marks OOBE as completed
	•	Disables OOBE scheduled tasks
	•	Deletes OOBE executables
	•	Reboots automatically

Requirements:
	•	USB drive (for methods 1 and 2)
	•	bypass_oobe.ps1 placed on the USB drive (methods 1 and 2)
	•	For method 3, the script hosted online (GitHub Gist or any URL)

⸻

METHOD 1: Explorer method (double-click)
	1.	Copy bypass_oobe.ps1 to a USB drive.
	2.	At the OOBE screen, press Shift+F10.
	3.	Type: explorer
	4.	In Explorer, open “This PC”.
	5.	Open the USB drive.
	6.	Double-click bypass_oobe.ps1.
	7.	Approve any execution warnings.
	8.	The script will run and reboot automatically.

⸻

METHOD 2: CMD → PowerShell from USB
	1.	Copy bypass_oobe.ps1 to a USB drive.
	2.	At the OOBE screen, press Shift+F10.
	3.	Type: diskpart
	4.	Type: list volume
	5.	Note the USB drive letter (example: D).
	6.	Type: exit
	7.	Switch to USB drive. Example: D:
	8.	Type: powershell
	9.	Type: Set-ExecutionPolicy Bypass -Scope Process -Force
	10.	Run script: .\bypass_oobe.ps1
	11.	The script runs and reboots automatically.

⸻

METHOD 3: CMD → PowerShell online (irm | iex)

This method requires no USB drive.
	1.	At the OOBE screen, press Shift+F10.
	2.	Type: powershell
	3.	Enable TLS 1.2: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
	4.	Run online script using your raw URL: 
	irm https://gist.githubusercontent.com/boutzamat/41ce29a33b2dc14a91e6d2dccfc2fa72/raw/003025f9a940af14781b8ba296769556c3dd042c/bypass_oobe.ps1 | iex 
	or: 
	iwr https://gist.githubusercontent.com/boutzamat/41ce29a33b2dc14a91e6d2dccfc2fa72/raw/003025f9a940af14781b8ba296769556c3dd042c/bypass_oobe.ps1 | iex

The script will download into memory and execute immediately.

⸻

After reboot:
	•	OOBE will not return
	•	defaultuser0 will be removed or disabled
	•	Windows will log into the newly created local administrator account
	•	No Microsoft account is required

bypass_oobe.ps1

# --- CONFIG ---
$NewUser = "LocalUser"
$NewPass = "FuckMicrosoft"

Write-Host "Creating user $NewUser..."
net user $NewUser $NewPass /add
net localgroup administrators $NewUser /add

# --- Disable OOBE Flags ---
$regPaths = @{
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" = @{
        SkipMachineOOBE = 1
        SkipUserOOBE    = 1
    }
    "HKLM:\SYSTEM\Setup" = @{
        OOBEInProgress        = 0
        SetupPhase            = 0
        SetupType             = 0
        SystemSetupInProgress = 0
        CmdLine               = ""
    }
}

foreach ($path in $regPaths.Keys) {
    foreach ($name in $regPaths[$path].Keys) {
        Set-ItemProperty -Path $path -Name $name -Value $regPaths[$path][$name] -Force
    }
}

# --- Disable autologin ---
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultUserName -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultPassword -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name AutoAdminLogon -ErrorAction SilentlyContinue

# --- Force normal Explorer shell ---
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name Shell -Value "explorer.exe"
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name Userinit -Value "C:\Windows\System32\userinit.exe,"

# --- Disable setup tasks ---
$tasks = @(
    "\Microsoft\Windows\Setup\SetupCleanupTask",
    "\Microsoft\Windows\OOBE\FirstLogonAnimation",
    "\Microsoft\Windows\Setup\gwx",
    "\Microsoft\Windows\OOBE\HardwareOOBE",
    "\Microsoft\Windows\Setup\StateRepository-Setup",
    "\Microsoft\Windows\Setup\SetupFinalize"
)

foreach ($task in $tasks) {
    schtasks /Change /TN $task /Disable | Out-Null
}

# --- Remove defaultuser0 account and profile ---
net user defaultuser0 /delete
Remove-Item "C:\Users\defaultuser0" -Recurse -Force -ErrorAction SilentlyContinue

# --- Remove lingering defaultuser0 SID ---
$ProfileList = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"
Get-ChildItem $ProfileList | ForEach-Object {
    $ProfilePath = (Get-ItemProperty $_.PSPath).ProfileImagePath
    if ($ProfilePath -like "*defaultuser0*") {
        Remove-Item $_.PSPath -Recurse -Force
    }
}

# --- Nuclear delete of OOBE executables ---
Takeown /F C:\Windows\System32\oobe /R /D Y | Out-Null
Icacls C:\Windows\System32\oobe /grant administrators:F /T | Out-Null
Remove-Item "C:\Windows\System32\oobe\*.exe" -Force -ErrorAction SilentlyContinue
Remove-Item "C:\Windows\System32\oobe\*.dll" -Force -ErrorAction SilentlyContinue

# --- Final echo ---
Write-Host "======================================================="
Write-Host "  OOBE eliminated. System ready for login."
Write-Host "  Local user created:"
Write-Host "      Username: LocalUser"
Write-Host "      Password: FuckMicrosoft"
Write-Host "======================================================="

Write-Host "Rebooting in 10 seconds..."
shutdown /r /f /t 10