Revert package manager (not compatible with winRM!!!)

.drone.yml

@@ -1,7 +1,7 @@
 kind: pipeline
 type: kubernetes
 name: 'Packer Build'
-    
+
 volumes:
 - name: output
   claim:
@@ -13,60 +13,66 @@ volumes:
 steps:
 - name: Debugging information
   image: bv11-cr01.bessems.eu/library/packer-extended
+  pull: always
   commands:
   - yamllint --version
   - packer --version
-  - ansible --version
+  - qemu-img --version
   - ovftool --version
-- name: Ubuntu Server 22.04
+  - pwsh --version
+- name: Windows Server 2019
   image: bv11-cr01.bessems.eu/library/packer-extended
   pull: always
   commands:
+  - sed -i -e "s/<<img-productkey>>/$${PRODUCTKEY}/" packer/preseed/Server2019/Autounattend.xml
   - |
-    sed -i -e "s/<<img-password>>/$${SSH_PASSWORD}/g" \
-      packer/preseed/UbuntuServer22.04/user-data
+    sed -i -e "s/<<img-password>>/$${WINRM_PASSWORD}/g" \
+      packer/preseed/Server2019/Autounattend.xml \
+      packer/preseed/Server2019/Sysprep_Unattend.xml
   - |
-    yamllint -d "{extends: relaxed, rules: {line-length: disable}}" \
-      ansible \
-      packer/preseed/UbuntuServer22.04/user-data \
-      scripts
+    yamllint -d "{extends: relaxed, rules: {line-length: disable}}" scripts
   - |
     packer init -upgrade \
       ./packer
   - |
     packer validate \
       -var vm_name=$DRONE_BUILD_NUMBER-${DRONE_COMMIT_SHA:0:10} \
-      -var vm_guestos=ubuntuserver22.04 \
+      -var vm_guestos=server2019 \
       -var repo_username=$${REPO_USERNAME} \
       -var repo_password=$${REPO_PASSWORD} \
       -var vsphere_password=$${VSPHERE_PASSWORD} \
-      -var ssh_password=$${SSH_PASSWORD} \
+      -var winrm_password=$${WINRM_PASSWORD} \
       ./packer
   - |
     packer build \
       -on-error=cleanup -timestamp-ui \
       -var vm_name=$DRONE_BUILD_NUMBER-${DRONE_COMMIT_SHA:0:10} \
-      -var vm_guestos=ubuntuserver22.04 \
+      -var vm_guestos=server2019 \
       -var repo_username=$${REPO_USERNAME} \
       -var repo_password=$${REPO_PASSWORD} \
       -var vsphere_password=$${VSPHERE_PASSWORD} \
-      -var ssh_password=$${SSH_PASSWORD} \
+      -var winrm_password=$${WINRM_PASSWORD} \
       ./packer
   environment:
     VSPHERE_PASSWORD:
       from_secret: vsphere_password
-    SSH_PASSWORD:
-      from_secret: ssh_password
+    WINRM_PASSWORD:
+      from_secret: winrm_password
     REPO_USERNAME:
       from_secret: repo_username
     REPO_PASSWORD:
       from_secret: repo_password
+    PRODUCTKEY:
+      from_secret: prodkey_server2019
     # PACKER_LOG: 1
   volumes:
   - name: output
     path: /output
+  - name: scratch
+    path: /scratch
 - name: Remove temporary resources
   image: bv11-cr01.bessems.eu/library/packer-extended
+  pull: always
   commands:
   - |
     pwsh -file scripts/Remove-Resources.ps1 \
@@ -84,3 +90,13 @@ steps:
     status:
     - success
     - failure
+- name: Trigger downstream builds
+  image: plugins/downstream
+  settings:
+    server: https://ci.spamasaurus.com
+    token:
+      from_secret: drone_token
+    fork: true
+    repositories:
+      - djpbessems/Packer.Images@ADCS
+      - djpbessems/Packer.Images@ADDS

README.md

@@ -1 +1,85 @@
-# Packer.Images [![Build Status](https://ci.spamasaurus.com/api/badges/djpbessems/Packer.Images/status.svg?ref=refs/heads/UbuntuServer22.04)](https://ci.spamasaurus.com/djpbessems/Packer.Images)
+# Packer.Images [![Build Status](https://ci.spamasaurus.com/api/badges/djpbessems/Packer.Images/status.svg?ref=refs/heads/Server2019)](https://ci.spamasaurus.com/djpbessems/Packer.Images)
+
+This OVA appliance allows deploying a Windows Server fully automated; either as a domain member or stand-alone server.  
+
+The included `.ovf` file has the following XML contents (simplified for clarity) to facilitate the different `DeploymentOption`s:  
+```xml
+<Envelope [...]>
+  [...]
+  <DeploymentOptionSection>
+    <Info>Deployment Type</Info>
+    <Configuration ovf:id="domainmember">
+      <Label>Domain member</Label>
+      <Description>Windows Server joined to an Active Directory domain</Description>
+    </Configuration>
+    <Configuration ovf:id="standalone">
+      <Label>Stand-alone</Label>
+      <Description>Stand-alone Windows Server</Description>
+    </Configuration>
+  </DeploymentOptionSection>
+  <VirtualSystem ovf:id="[...]">
+    [...]
+    <ProductSection>
+      [...]
+      <Category>1) Operating System</Category>
+      <Property ovf:configuration="domainmember standalone" ovf:key="guestinfo.hostname" [...]>
+        <Label>Hostname*</Label>
+      </Property>
+      <Property ovf:configuration="standalone" ovf:key="guestinfo.administratorpw" [...]>
+        <Label>Local administrator password*</Label>
+      </Property>
+      [...]
+      <Category>3) Active Directory membership</Category>
+      <Property ovf:configuration="domainmember" ovf:key="addsconfig.domainname" [...]>
+        <Label>Domain name*</Label>
+      </Property>
+      <Property ovf:configuration="domainmember" ovf:key="addsconfig.username" [...]>
+        <Label>Domain account username*</Label>
+      </Property>
+      <Property ovf:configuration="domainmember" ovf:key="addsconfig.password" [...]>
+        <Label>Domain account password*</Label>
+      </Property>
+    </ProductSection>
+  </VirtualSystem>
+</Envelope>
+```
+
+When **provisioning** the appliance through the vCenter 'Deploy OVF template...' wizard, or through vApp-compatible *Infrastructure as code* tooling (e.g. HashiCorp Terraform), it is possible to provide all relevant configuration through vApp properties.  
+
+<table>
+<tr>
+<td><em>vSphere 'Deploy OVF template...' wizard</em></td> <td> <a href="https://registry.terraform.io/providers/hashicorp/vsphere/latest/docs/resources/virtual_machine#deploying-vm-from-an-ovfova-template">HashiCorp Terraform vSphere provider</a> </td>
+</tr>
+<tr>
+<td><img src=".assets/vAppConfigurations-Server2019-example.png" alt="vApp properties" width="400" /><br/><img src=".assets/vAppProperties-Server2019-example.png" alt="vApp properties" width="400" /></td>
+<td>
+
+```hcl
+  vapp {
+    properties = {
+      # "deployment.type"           = "domainmember"
+
+      "guestinfo.hostname"        = "SRV01"
+      # "guestinfo.administratorpw" = var.vm_adminpassword
+      # "guestinfo.ntpserver"       = "0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org"
+      "guestinfo.ipaddress"       = "10.0.0.42"
+      "guestinfo.prefixlength"    = "24"
+      "guestinfo.dnsserver"       = "10.0.0.21"
+      "guestinfo.gateway"         = "10.0.0.1"
+
+      "addsconfig.domainname"     = "contoso.com"
+      "addsconfig.username"       = "CONTOSO\\domainjoin"
+      "addsconfig.password"       = var.adds_password
+    }
+  }
+```
+
+</td>
+</tr>
+</table>
+
+On first boot, the appliance will start **configuring** itself without any further user-input, by performing the following steps:  
+- Change hostname
+- Configure network
+- Join Active Directory domain **-OR-** Set password for local administrator
+- Iterate through any payload scripts

ansible/ansible.cfg

@@ -1,3 +0,0 @@
-[defaults]
-deprecation_warnings = False
-remote_tmp           = /tmp/.ansible-${USER}/tmp

ansible/playbook.yml

@@ -1,7 +0,0 @@
----
-- hosts: all
-  gather_facts: false
-  become: true
-  roles:
-    - os
-    - firstboot

ansible/roles/firstboot/files/ansible_payload/playbook.yml

@@ -1,10 +0,0 @@
----
-- hosts: 127.0.0.1
-  connection: local
-  gather_facts: false
-  # become: true
-  roles:
-    - vapp
-    - network
-    - users
-    - cleanup

ansible/roles/firstboot/files/ansible_payload/roles/cleanup/tasks/main.yml

@@ -1,20 +0,0 @@
-- name: Disable crontab job
-  ansible.builtin.cron:
-    name: firstboot
-    state: absent
-- name: Restore extra tty
-  ansible.builtin.lineinfile:
-    path: /etc/systemd/logind.conf
-    regexp: "{{ item.regexp }}"
-    line: "{{ item.line }}"
-  loop:
-  - { regexp: '^NAutoVTs=', line: '#NAutoVTs=6'}
-  - { regexp: '^ReserveVT=', line: '#ReserveVT=6'}
-- name: Unmask getty@tty1 service
-  ansible.builtin.systemd:
-    name: getty@tty1
-    enabled: yes
-    masked: no
-- name: Reboot host
-  ansible.builtin.shell:
-    cmd: /usr/sbin/reboot now

ansible/roles/firstboot/files/ansible_payload/roles/network/tasks/main.yml

@@ -1,10 +0,0 @@
-- name: Set hostname
-  ansible.builtin.hostname:
-    name: "{{ ovfproperties['guestinfo.hostname'] }}"
-- name: Create netplan configuration file
-  ansible.builtin.template:
-    src: netplan.j2
-    dest: /etc/netplan/00-installer-config.yaml
-- name: Apply netplan configuration
-  ansible.builtin.shell:
-    cmd: /usr/sbin/netplan apply

ansible/roles/firstboot/files/ansible_payload/roles/network/templates/netplan.j2

@@ -1,10 +0,0 @@
-network:
-  version: 2
-  ethernets:
-    ens192:
-      addresses:
-      - {{ ovfproperties['guestinfo.ipaddress'] }}/{{ ovfproperties['guestinfo.prefixlength'] }}
-      gateway4: {{ ovfproperties['guestinfo.gateway'] }}
-      nameservers:
-        addresses:
-        - {{ ovfproperties['guestinfo.dnsserver'] }}

ansible/roles/firstboot/files/ansible_payload/roles/users/tasks/main.yml

@@ -1,25 +0,0 @@
-- name: Set root password
-  ansible.builtin.user:
-    name: root
-    password: "{{ ovfproperties['guestinfo.rootpw'] | password_hash('sha512', 65534 | random(seed=ovfproperties['guestinfo.hostname']) | string) }}"
-    generate_ssh_key: yes
-    ssh_key_bits: 2048
-    ssh_key_file: .ssh/id_rsa
-- name: Save root SSH publickey
-  ansible.builtin.lineinfile:
-    path: /root/.ssh/authorized_keys
-    line: "{{ ovfproperties['guestinfo.rootsshkey'] }}"
-- name: Disable SSH password authentication
-  ansible.builtin.lineinfile:
-    path: /etc/ssh/sshd_config
-    regex: "{{ item.regex }}"
-    line: "{{ item.line }}"
-    state: "{{ item.state }}"
-  loop:
-  - { regex: '^#PasswordAuthentication', line: 'PasswordAuthentication no', state: present}
-  - { regex: '^PasswordAuthentication yes', line: 'PasswordAuthentication yes', state: absent}
-- name: Delete 'ubuntu' user
-  ansible.builtin.user:
-    name: ubuntu
-    state: absent
-    remove: yes

ansible/roles/firstboot/files/ansible_payload/roles/vapp/tasks/main.yml

@@ -1,21 +0,0 @@
-- name: Store current ovfEnvironment
-  ansible.builtin.shell:
-    cmd: /usr/bin/vmtoolsd --cmd "info-get guestinfo.ovfEnv"
-  register: ovfenv
-- name: Parse XML for vApp properties
-  community.general.xml:
-    xmlstring: "{{ ovfenv.stdout }}"
-    namespaces:
-      ns: http://schemas.dmtf.org/ovf/environment/1
-    xpath: /ns:Environment/ns:PropertySection/ns:Property
-    content: attribute
-  register: ovfenv
-- name: Assign vApp properties to dictionary
-  ansible.builtin.set_fact:
-    ovfproperties: >-
-      {{ ovfproperties | default({}) |
-      combine({((item.values() | list)[0].values() | list)[0]:
-      ((item.values() | list)[0].values() | list)[1]})
-      }}
-  loop: "{{ ovfenv.matches }}"
-  no_log: true

ansible/roles/firstboot/tasks/main.yml

@@ -1,26 +0,0 @@
-- name: Create destination folder
-  ansible.builtin.file:
-    path: /opt/firstboot
-    state: directory
-- name: Create firstboot script file
-  ansible.builtin.template:
-    src: firstboot.j2
-    dest: /opt/firstboot/firstboot.sh
-    owner: root
-    group: root
-    mode: o+x
-- name: Create @reboot crontab job
-  ansible.builtin.cron:
-    name: firstboot
-    special_time: reboot
-    job: "/opt/firstboot/firstboot.sh"
-- name: Copy payload folder
-  ansible.builtin.copy:
-    src: ansible_payload/
-    dest: /opt/firstboot/ansible/
-    owner: root
-    group: root
-    mode: '0644'
-- name: Install ansible-galaxy collection
-  ansible.builtin.shell:
-    cmd: ansible-galaxy collection install community.general

ansible/roles/firstboot/templates/firstboot.j2

@@ -1,4 +0,0 @@
-#!/bin/bash
-
-# Apply firstboot configuration w/ ansible
-/usr/local/bin/ansible-playbook /opt/firstboot/ansible/playbook.yml | tee -a /var/log/firstboot.log > /dev/tty1

ansible/roles/os/tasks/ansible.yml

@@ -1,6 +0,0 @@
-- name: Install ansible (w/ dependencies)
-  ansible.builtin.pip:
-    name: "{{ item }}"
-    executable: pip3
-    state: latest
-  loop: "{{ pip_packages }}"

ansible/roles/os/tasks/cloud-init.yml

@@ -1,12 +0,0 @@
-- name: Delete cloud-init package
-  ansible.builtin.apt:
-    name: cloud-init
-    state: absent
-    purge: yes
-- name: Delete cloud-init files
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: absent
-  loop:
-    - /etc/cloud
-    - /var/lib/cloud

ansible/roles/os/tasks/logging.yml

@@ -1,5 +0,0 @@
-- name: Enable crontab logging
-  ansible.builtin.lineinfile:
-    path: /etc/rsyslog.d/50-default.conf
-    regexp: '^#cron\.\*.*'
-    line: "cron.*\t\t\t\t./var/log/cron.log"

ansible/roles/os/tasks/main.yml

@@ -1,20 +0,0 @@
-- name: Disable tty logins
-  import_tasks: tty.yml
-
-- name: Remove snapd
-  import_tasks: snapd.yml
-
-- name: Remove cloud-init
-  import_tasks: cloud-init.yml
-
-- name: Configure default logging
-  import_tasks: logging.yml
-
-- name: Configure services
-  import_tasks: services.yml
-
-- name: Install packages
-  import_tasks: packages.yml
-
-- name: Install ansible
-  import_tasks: ansible.yml

ansible/roles/os/tasks/packages.yml

@@ -1,28 +0,0 @@
-- name: Configure 'needrestart' package
-  ansible.builtin.lineinfile:
-    path: /etc/needrestart/needrestart.conf
-    regexp: "{{ item.regexp }}"
-    line: "{{ item.line }}"
-  loop:
-    - regexp: "^#\\$nrconf\\{restart\\} = 'i';"
-      line: "$nrconf{restart} = 'a';"
-    - regexp: "^#\\$nrconf\\{kernelhints\\} = -1;"
-      line: "$nrconf{kernelhints} = -1;"
-
-- name: Install additional packages
-  ansible.builtin.apt:
-    name: "{{ item }}"
-    state: latest
-    update_cache: yes
-  loop: "{{ packages }}"
-
-- name: Upgrade all packages
-  ansible.builtin.apt:
-    name: "*"
-    state: latest
-    update_cache: yes
-
-- name: Cleanup
-  ansible.builtin.apt:
-    autoremove: yes
-    purge: yes

ansible/roles/os/tasks/services.yml

@@ -1,5 +0,0 @@
-- name: Disable & mask networkd-wait-online
-  ansible.builtin.systemd:
-    name: systemd-networkd-wait-online
-    enabled: no
-    masked: yes

ansible/roles/os/tasks/snapd.yml

@@ -1,16 +0,0 @@
-- name: Delete snapd package
-  ansible.builtin.apt:
-    name: snapd
-    state: absent
-    purge: yes
-- name: Delete leftover files
-  ansible.builtin.file:
-    path: /root/snap
-    state: absent
-- name: Hold snapd package
-  ansible.builtin.dpkg_selections:
-    name: snapd
-    selection: hold
-- name: Reload systemd unit configurations
-  ansible.builtin.systemd:
-    daemon_reload: yes

ansible/roles/os/tasks/tty.yml

@@ -1,13 +0,0 @@
-- name: Disable extra tty
-  ansible.builtin.lineinfile:
-    path: /etc/systemd/logind.conf
-    regexp: "{{ item.regexp }}"
-    line: "{{ item.line }}"
-  loop:
-  - { regexp: '^#NAutoVTs=', line: 'NAutoVTs=1'}
-  - { regexp: '^#ReserveVT=', line: 'ReserveVT=11'}
-- name: Mask getty@tty1 service
-  ansible.builtin.systemd:
-    name: getty@tty1
-    enabled: no
-    masked: yes

ansible/roles/os/vars/main.yml

@@ -1,11 +0,0 @@
-packages:
-  - jq
-  # (python3-*) Dependency for installation of Ansible
-  - python3-pip
-  - python3-setuptools
-  - python3-wheel
-
-pip_packages:
-  - pip
-  - ansible-core
-  - lxml

packer/iso.auto.pkrvars.hcl

@@ -1,4 +1,5 @@
-iso_url      = "sn.itch.fyi/Repository/iso/Canonical/Ubuntu%20Server%2022.04/ubuntu-22.04-live-server-amd64.iso"
-iso_checksum = "sha256:84AEAF7823C8C61BAA0AE862D0A06B03409394800000B3235854A6B38EB4856F"
-// iso_url      = "sn.itch.fyi/Repository/iso/Canonical/Ubuntu%20Server%2020.04/ubuntu-20.04.2-live-server-amd64.iso"
-// iso_checksum = "sha256:D1F2BF834BBE9BB43FAF16F9BE992A6F3935E65BE0EDECE1DEE2AA6EB1767423"
+iso_url                 = "sn.itch.fyi/Repository/iso/Microsoft/Windows%20Server%202019/LTSC/en_windows_server_2019_x64_dvd_4cb967d8.iso"
+iso_checksum            = "sha256:4c5dd63efee50117986a2e38d4b3a3fbaf3c1c15e2e7ea1d23ef9d8af148dd2d"
+iso_paths               = [
+  "ISO-files/VMware-tools-windows-11.2.1-17243207/VMware-tools-windows-11.2.1-17243207.iso"
+]

packer/preseed/Server2019/Autounattend.xml

@@ -0,0 +1,159 @@
+<?xml version="1.0" encoding="utf-8"?>
+<unattend xmlns="urn:schemas-microsoft-com:unattend">
+    <servicing/>
+    <settings pass="windowsPE">
+        <component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+            <DiskConfiguration>
+                <Disk wcm:action="add">
+                    <CreatePartitions>
+                        <CreatePartition wcm:action="add">
+                            <Order>1</Order>
+                            <Type>Primary</Type>
+                            <Extend>true</Extend>
+                        </CreatePartition>
+                    </CreatePartitions>
+                    <ModifyPartitions>
+                        <ModifyPartition wcm:action="add">
+                            <Extend>false</Extend>
+                            <Format>NTFS</Format>
+                            <Letter>C</Letter>
+                            <Order>1</Order>
+                            <PartitionID>1</PartitionID>
+                            <Label>Windows Server 2019</Label>
+                        </ModifyPartition>
+                    </ModifyPartitions>
+                    <DiskID>0</DiskID>
+                    <WillWipeDisk>true</WillWipeDisk>
+                </Disk>
+                <WillShowUI>OnError</WillShowUI>
+            </DiskConfiguration>
+            <UserData>
+                <AcceptEula>true</AcceptEula>
+                <!-- <FullName>Spamasaurus Rex</FullName>
+                <Organization>Spamasaurus Rex</Organization> -->
+                <ProductKey>
+                    <Key><<img-productkey>></Key>
+                    <WillShowUI>Never</WillShowUI>
+                </ProductKey>
+            </UserData>
+            <ImageInstall>
+                <OSImage>
+                    <InstallTo>
+                        <DiskID>0</DiskID>
+                        <PartitionID>1</PartitionID>
+                    </InstallTo>
+                    <WillShowUI>OnError</WillShowUI>
+                    <InstallToAvailablePartition>false</InstallToAvailablePartition>
+                    <InstallFrom>
+                        <MetaData wcm:action="add">
+                            <Key>/IMAGE/INDEX</Key>
+                            <Value>4</Value>
+                        </MetaData>
+                    </InstallFrom>
+                </OSImage>
+            </ImageInstall>
+        </component>
+        <component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+            <SetupUILanguage>
+                <UILanguage>en-US</UILanguage>
+            </SetupUILanguage>
+            <InputLocale>en-US</InputLocale>
+            <SystemLocale>en-US</SystemLocale>
+            <UILanguage>en-US</UILanguage>
+            <UILanguageFallback>en-US</UILanguageFallback>
+            <UserLocale>en-US</UserLocale>
+        </component>
+    </settings>
+    <settings pass="offlineServicing">
+        <component name="Microsoft-Windows-LUA-Settings" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+            <EnableLUA>false</EnableLUA>
+        </component>
+    </settings>
+    <settings pass="oobeSystem">
+        <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+            <InputLocale>en-US</InputLocale>
+            <SystemLocale>en-US</SystemLocale>
+            <UILanguage>en-US</UILanguage>
+            <UserLocale>en-US</UserLocale>
+        </component>
+        <component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+            <UserAccounts>
+                <AdministratorPassword>
+                    <Value><<img-password>></Value>
+                    <PlainText>true</PlainText>
+                </AdministratorPassword>
+            </UserAccounts>
+            <OOBE>
+                <HideEULAPage>true</HideEULAPage>
+                <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
+                <NetworkLocation>Home</NetworkLocation>
+                <ProtectYourPC>1</ProtectYourPC>
+            </OOBE>
+            <AutoLogon>
+                <Password>
+                    <Value><<img-password>></Value>
+                    <PlainText>true</PlainText>
+                </Password>
+                <Username>administrator</Username>
+                <Enabled>true</Enabled>
+            </AutoLogon>
+            <FirstLogonCommands>
+                <SynchronousCommand wcm:action="add">
+                    <CommandLine>cmd.exe /c powershell -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force"</CommandLine>
+                    <Description>Set execution policy 64bit</Description>
+                    <Order>1</Order>
+                    <RequiresUserInput>true</RequiresUserInput>
+                </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <CommandLine>C:\Windows\SysWOW64\cmd.exe /c powershell -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force"</CommandLine>
+                    <Description>Set execution policy 32bit</Description>
+                    <Order>2</Order>
+                    <RequiresUserInput>true</RequiresUserInput>
+                </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <CommandLine>cmd.exe /c reg add "HKLM\System\CurrentControlSet\Control\Network\NewNetworkWindowOff"</CommandLine>
+                    <Description>Disable new network prompt</Description>
+                    <Order>3</Order>
+                    <RequiresUserInput>true</RequiresUserInput>
+                </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <CommandLine>cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File a:\Set-NetworkProfile.ps1</CommandLine>
+                    <Description>Set network profile to private</Description>
+                    <Order>4</Order>
+                    <RequiresUserInput>true</RequiresUserInput>
+                </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <CommandLine>cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File a:\Disable-WinRM.ps1</CommandLine>
+                    <Description>Disable WinRM</Description>
+                    <Order>5</Order>
+                    <RequiresUserInput>true</RequiresUserInput>
+                </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <CommandLine>cmd.exe /c a:\Install-VMwareTools.cmd</CommandLine>
+                    <Order>13</Order>
+                    <Description>Install VMware Tools</Description>
+                </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <CommandLine>cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File a:\Enable-WinRM.ps1</CommandLine>
+                    <Description>Enable WinRM</Description>
+                    <Order>99</Order>
+                </SynchronousCommand>
+            </FirstLogonCommands>
+            <ShowWindowsLive>false</ShowWindowsLive>
+        </component>
+    </settings>
+    <settings pass="specialize">
+        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+            <OEMInformation>
+                <HelpCustomized>false</HelpCustomized>
+            </OEMInformation>
+            <!-- Rename computer here. -->
+            <ComputerName>packer-template</ComputerName>
+            <TimeZone>W. Europe Standard Time</TimeZone>
+            <RegisteredOwner/>
+        </component>
+        <component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-Security-SPP-UX" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+            <SkipAutoActivation>true</SkipAutoActivation>
+        </component>
+    </settings>
+</unattend>

packer/preseed/Server2019/Sysprep_Unattend.xml

@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="utf-8"?>
+<unattend xmlns="urn:schemas-microsoft-com:unattend">
+    <settings pass="generalize">
+        <component name="Microsoft-Windows-Security-SPP" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+            <SkipRearm>1</SkipRearm>
+        </component>
+        <component name="Microsoft-Windows-PnpSysprep" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+            <PersistAllDeviceInstalls>true</PersistAllDeviceInstalls>
+            <DoNotCleanUpNonPresentDevices>true</DoNotCleanUpNonPresentDevices>
+        </component>
+    </settings>
+    <settings pass="oobeSystem">
+        <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+            <InputLocale>en-US</InputLocale>
+            <SystemLocale>en-US</SystemLocale>
+            <UILanguage>en-US</UILanguage>
+            <UserLocale>en-US</UserLocale>
+        </component>
+        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+            <OOBE>
+                <HideEULAPage>true</HideEULAPage>
+                <HideLocalAccountScreen>true</HideLocalAccountScreen>
+                <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
+                <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
+                <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
+                <NetworkLocation>Work</NetworkLocation>
+                <ProtectYourPC>1</ProtectYourPC>
+                <SkipMachineOOBE>true</SkipMachineOOBE>
+                <SkipUserOOBE>true</SkipUserOOBE>
+            </OOBE>
+            <TimeZone>UTC</TimeZone>
+            <UserAccounts>
+                <AdministratorPassword>
+                    <Value><<img-password>></Value>
+                    <PlainText>true</PlainText>
+                </AdministratorPassword>
+            </UserAccounts>
+        </component>
+    </settings>
+    <settings pass="specialize">
+    </settings>
+</unattend>

packer/preseed/Server2019/pvscsi/Autounattend.xml

@@ -0,0 +1,168 @@
+<?xml version="1.0" encoding="utf-8"?>
+<unattend xmlns="urn:schemas-microsoft-com:unattend">
+    <servicing/>
+    <settings pass="auditSystem">
+        <component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-PnpCustomizationsWinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+            <DriverPaths>
+                <PathAndCredentials wcm:action="add" wcm:keyValue="1">
+                    <Path>E:\Program Files\VMware\VMware Tools\Drivers\pvscsi\Win8\amd64</Path>
+                </PathAndCredentials>
+            </DriverPaths>
+        </component>
+    </settings>
+    <settings pass="windowsPE">
+        <component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+            <DiskConfiguration>
+                <Disk wcm:action="add">
+                    <CreatePartitions>
+                        <CreatePartition wcm:action="add">
+                            <Order>1</Order>
+                            <Type>Primary</Type>
+                            <Extend>true</Extend>
+                        </CreatePartition>
+                    </CreatePartitions>
+                    <ModifyPartitions>
+                        <ModifyPartition wcm:action="add">
+                            <Extend>false</Extend>
+                            <Format>NTFS</Format>
+                            <Letter>C</Letter>
+                            <Order>1</Order>
+                            <PartitionID>1</PartitionID>
+                            <Label>Windows Server 2019</Label>
+                        </ModifyPartition>
+                    </ModifyPartitions>
+                    <DiskID>0</DiskID>
+                    <WillWipeDisk>true</WillWipeDisk>
+                </Disk>
+                <WillShowUI>OnError</WillShowUI>
+            </DiskConfiguration>
+            <UserData>
+                <AcceptEula>true</AcceptEula>
+                <!-- <FullName>Spamasaurus Rex</FullName>
+                <Organization>Spamasaurus Rex</Organization> -->
+                <ProductKey>
+                    <Key><<img-productkey>></Key>
+                    <WillShowUI>Never</WillShowUI>
+                </ProductKey>
+            </UserData>
+            <ImageInstall>
+                <OSImage>
+                    <InstallTo>
+                        <DiskID>0</DiskID>
+                        <PartitionID>1</PartitionID>
+                    </InstallTo>
+                    <WillShowUI>OnError</WillShowUI>
+                    <InstallToAvailablePartition>false</InstallToAvailablePartition>
+                    <InstallFrom>
+                        <MetaData wcm:action="add">
+                            <Key>/IMAGE/INDEX</Key>
+                            <Value>4</Value>
+                        </MetaData>
+                    </InstallFrom>
+                </OSImage>
+            </ImageInstall>
+        </component>
+        <component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+            <SetupUILanguage>
+                <UILanguage>en-US</UILanguage>
+            </SetupUILanguage>
+            <InputLocale>en-US</InputLocale>
+            <SystemLocale>en-US</SystemLocale>
+            <UILanguage>en-US</UILanguage>
+            <UILanguageFallback>en-US</UILanguageFallback>
+            <UserLocale>en-US</UserLocale>
+        </component>
+    </settings>
+    <settings pass="offlineServicing">
+        <component name="Microsoft-Windows-LUA-Settings" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+            <EnableLUA>false</EnableLUA>
+        </component>
+    </settings>
+    <settings pass="oobeSystem">
+        <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+            <InputLocale>en-US</InputLocale>
+            <SystemLocale>en-US</SystemLocale>
+            <UILanguage>en-US</UILanguage>
+            <UserLocale>en-US</UserLocale>
+        </component>
+        <component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+            <UserAccounts>
+                <AdministratorPassword>
+                    <Value><<img-password>></Value>
+                    <PlainText>true</PlainText>
+                </AdministratorPassword>
+            </UserAccounts>
+            <OOBE>
+                <HideEULAPage>true</HideEULAPage>
+                <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
+                <NetworkLocation>Home</NetworkLocation>
+                <ProtectYourPC>1</ProtectYourPC>
+            </OOBE>
+            <AutoLogon>
+                <Password>
+                    <Value><<img-password>></Value>
+                    <PlainText>true</PlainText>
+                </Password>
+                <Username>administrator</Username>
+                <Enabled>true</Enabled>
+            </AutoLogon>
+            <FirstLogonCommands>
+                <SynchronousCommand wcm:action="add">
+                    <CommandLine>cmd.exe /c powershell -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force"</CommandLine>
+                    <Description>Set execution policy 64bit</Description>
+                    <Order>1</Order>
+                    <RequiresUserInput>true</RequiresUserInput>
+                </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <CommandLine>C:\Windows\SysWOW64\cmd.exe /c powershell -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force"</CommandLine>
+                    <Description>Set execution policy 32bit</Description>
+                    <Order>2</Order>
+                    <RequiresUserInput>true</RequiresUserInput>
+                </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <CommandLine>cmd.exe /c reg add "HKLM\System\CurrentControlSet\Control\Network\NewNetworkWindowOff"</CommandLine>
+                    <Description>Disable new network prompt</Description>
+                    <Order>3</Order>
+                    <RequiresUserInput>true</RequiresUserInput>
+                </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <CommandLine>cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File a:\Set-NetworkProfile.ps1</CommandLine>
+                    <Description>Set network profile to private</Description>
+                    <Order>4</Order>
+                    <RequiresUserInput>true</RequiresUserInput>
+                </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <CommandLine>cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File a:\Disable-WinRM.ps1</CommandLine>
+                    <Description>Disable WinRM</Description>
+                    <Order>5</Order>
+                    <RequiresUserInput>true</RequiresUserInput>
+                </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <CommandLine>cmd.exe /c a:\Install-VMwareTools.cmd</CommandLine>
+                    <Order>13</Order>
+                    <Description>Install VMware Tools</Description>
+                </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <CommandLine>cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File a:\Enable-WinRM.ps1</CommandLine>
+                    <Description>Enable WinRM</Description>
+                    <Order>99</Order>
+                </SynchronousCommand>
+            </FirstLogonCommands>
+            <ShowWindowsLive>false</ShowWindowsLive>
+        </component>
+    </settings>
+    <settings pass="specialize">
+        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+            <OEMInformation>
+                <HelpCustomized>false</HelpCustomized>
+            </OEMInformation>
+            <!-- Rename computer here. -->
+            <ComputerName>packer-template</ComputerName>
+            <TimeZone>W. Europe Standard Time</TimeZone>
+            <RegisteredOwner/>
+        </component>
+        <component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-Security-SPP-UX" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+            <SkipAutoActivation>true</SkipAutoActivation>
+        </component>
+    </settings>
+</unattend>

packer/preseed/UbuntuServer22.04/user-data

@@ -1,29 +0,0 @@
-#cloud-config
-autoinstall:
-  version: 1
-  locale: en_US
-  keyboard:
-    layout: en
-    variant: us
-  network:
-    network:
-      version: 2
-      ethernets:
-        ens192:
-          dhcp4: true
-          dhcp-identifier: mac
-  storage:
-    layout:
-      name: direct
-  identity:
-    hostname: packer-template
-    username: ubuntu
-    # password: $6$ZThRyfmSMh9499ar$KSZus58U/l58Efci0tiJEqDKFCpoy.rv25JjGRv5.iL33AQLTY2aljumkGiDAiX6LsjzVsGTgH85Tx4S.aTfx0
-    password: $6$rounds=4096$ZKfzRoaQOtc$M.fhOsI0gbLnJcCONXz/YkPfSoefP4i2/PQgzi2xHEi2x9CUhush.3VmYKL0XVr5JhoYvnLfFwqwR/1YYEqZy/
-  ssh:
-    install-server: yes
-    allow-pw: true
-  user-data:
-    disable_root: false
-  late-commands:
-    - echo 'ubuntu ALL=(ALL) NOPASSWD:ALL' > /target/etc/sudoers.d/ubuntu

packer/ubuntuserver22.04.pkr.hcl

@@ -1,100 +0,0 @@
-packer {
-  required_plugins {
-  }
-}
-
-source "vsphere-iso" "ubuntuserver" {
-  vcenter_server          = var.vcenter_server
-  username                = var.vsphere_username
-  password                = var.vsphere_password
-  insecure_connection     = "true"
-
-  vm_name                 = "${var.vm_guestos}-${var.vm_name}"
-  datacenter              = var.vsphere_datacenter
-  cluster                 = var.vsphere_cluster
-  host                    = var.vsphere_host
-  folder                  = var.vsphere_folder
-  datastore               = var.vsphere_datastore
-
-  guest_os_type           = "ubuntu64Guest"
-
-  boot_order              = "disk,cdrom"
-  boot_command            = [
-    "e<down><down><down><end>",
-    " autoinstall ds=nocloud;",
-    "<F10>"
-  ]
-  boot_wait               = "2s"
-
-  communicator            = "ssh"
-  ssh_username            = "ubuntu"
-  ssh_password            = var.ssh_password
-  ssh_timeout             = "20m"
-  ssh_handshake_attempts  = "100"
-  ssh_pty                 = true
-
-  CPUs                    = 2
-  RAM                     = 4096
-
-  network_adapters {
-    network               = var.vsphere_network
-    network_card          = "vmxnet3"
-  }
-  storage {
-    disk_size             = 20480
-    disk_thin_provisioned = true
-  }
-  disk_controller_type    = ["pvscsi"]
-  usb_controller          = ["xhci"]
-
-  cd_files                = [
-    "packer/preseed/UbuntuServer22.04/user-data",
-    "packer/preseed/UbuntuServer22.04/meta-data"
-  ]
-  cd_label                = "cidata"
-  iso_url                 = local.iso_authenticatedurl
-  iso_checksum            = var.iso_checksum
-
-  shutdown_command        = "echo '${var.ssh_password}' | sudo -S shutdown -P now"
-  shutdown_timeout        = "5m"
-
-  export {
-    images                = false
-    output_directory      = "/scratch/ubuntuserver"
-  }
-  remove_cdrom            = true
-}
-
-build {
-  sources = [
-    "source.vsphere-iso.ubuntuserver"
-  ]
-
-  provisioner "ansible" {
-    only             = ["vsphere-iso.ubuntuserver"]
-
-    playbook_file    = "ansible/playbook.yml"
-    user             = "ubuntu"
-    ansible_env_vars = [
-      "ANSIBLE_CONFIG=ansible/ansible.cfg"
-    ]
-    use_proxy        = "false"
-    extra_arguments  = [
-      "--extra-vars", "ansible_ssh_pass=${var.ssh_password}"
-    ]
-  }
-
-  post-processor "shell-local" {
-    only   = ["vsphere-iso.ubuntuserver"]
-    inline = [
-      "pwsh -command \"& scripts/Update-OvfConfiguration.ps1 \\",
-      " -OVFFile '/scratch/ubuntuserver/${var.vm_guestos}-${var.vm_name}.ovf' \\",
-      " -Parameter @{'appliance.name'='${var.vm_guestos}';'appliance.version'='${var.vm_name}'}\"",
-      "pwsh -file scripts/Update-Manifest.ps1 \\",
-      " -ManifestFileName '/scratch/ubuntuserver/${var.vm_guestos}-${var.vm_name}.mf'",
-      "ovftool --acceptAllEulas --allowExtraConfig --overwrite \\",
-      " '/scratch/ubuntuserver/${var.vm_guestos}-${var.vm_name}.ovf' \\",
-      " /output/Ubuntu-Server-22.04.ova"
-    ]
-  }
-}

packer/variables.pkr.hcl

@@ -1,12 +1,10 @@
 variable "vcenter_server" {}
 variable "vsphere_username" {}
-variable "vsphere_password" {
-    sensitive = true
-}
+variable "vsphere_password" {}
 
 variable "vsphere_host" {}
+variable "vsphere_hostip" {}
 variable "vsphere_datacenter" {}
-variable "vsphere_cluster" {}
 
 variable "vsphere_templatefolder" {}
 variable "vsphere_folder" {}
@@ -15,17 +13,15 @@ variable "vsphere_network" {}
 
 variable "vm_name" {}
 variable "vm_guestos" {}
-variable "ssh_password" {
-    sensitive = true
-}
+variable "winrm_password" {}
 
 variable "iso_url" {}
 variable "iso_checksum" {}
+variable "iso_paths" {}
 variable "repo_username" {}
-variable "repo_password" {
-    sensitive = true
-}
+variable "repo_password" {}
+
 local "iso_authenticatedurl" {
     expression = "https://${var.repo_username}:${var.repo_password}@${var.iso_url}"
     sensitive  = true
-}
+}

packer/vsphere.auto.pkrvars.hcl

@@ -1,9 +1,9 @@
 vcenter_server         = "bv11-vc.bessems.lan"
 vsphere_username       = "administrator@vsphere.local"
 vsphere_datacenter     = "DeSchakel"
-vsphere_cluster        = "Cluster.Legacy"
 vsphere_host           = "bv11-esx.bessems.lan"
-vsphere_datastore      = "ESX00.SSD01"
+vsphere_hostip         = "192.168.11.200"
+vsphere_datastore      = "Datastore01.SSD"
 vsphere_folder         = "/Packer"
 vsphere_templatefolder = "/Templates"
-vsphere_network        = "LAN"
+vsphere_network        = "LAN"

packer/windowsserver2019.pkr.hcl

@@ -0,0 +1,313 @@
+packer {
+  required_plugins {
+    windows-update = {
+      version = ">= 0.12.0"
+      source  = "github.com/rgl/windows-update"
+    }
+  }
+}
+
+source "vsphere-iso" "srv2019-template" {
+  vcenter_server          = var.vcenter_server
+  username                = var.vsphere_username
+  password                = var.vsphere_password
+  insecure_connection     = "true"
+
+  vm_name                 = "${var.vm_guestos}-${var.vm_name}-template"
+  datacenter              = var.vsphere_datacenter
+  host                    = var.vsphere_host
+  folder                  = var.vsphere_folder
+  datastore               = var.vsphere_datastore
+
+  guest_os_type           = "windows9Server64Guest"
+
+  boot_order              = "disk,cdrom"
+  boot_command            = [""]
+  boot_wait               = "5m"
+
+  communicator            = "winrm"
+  winrm_username          = "administrator"
+  winrm_password          = var.winrm_password
+  winrm_timeout           = "10m"
+
+  RAM                     = 4096
+  CPUs                    = 2
+
+  network_adapters {
+    network               = var.vsphere_network
+    network_card          = "vmxnet3"
+  }
+  storage {
+    disk_size             = 20480
+    disk_thin_provisioned = true
+  }
+  disk_controller_type    = ["lsilogic-sas"]
+  usb_controller          = ["xhci"]
+
+  floppy_files            = [
+    "packer/preseed/Server2019/Autounattend.xml",
+    "packer/preseed/Server2019/Sysprep_Unattend.xml",
+    "scripts/Set-NetworkProfile.ps1",
+    "scripts/Disable-WinRM.ps1",
+    "scripts/Enable-WinRM.ps1",
+    "scripts/Install-VMwareTools.cmd"
+  ]
+  iso_url                 = local.iso_authenticatedurl
+  iso_checksum            = var.iso_checksum
+  iso_paths               = var.iso_paths
+
+  shutdown_command        = "C:\\Windows\\System32\\Sysprep\\sysprep.exe /generalize /oobe /unattend:A:\\Sysprep_Unattend.xml"
+  shutdown_timeout        = "1h"
+
+  export {
+    images                = false
+    output_directory      = "/scratch/srv2019-template"
+  }
+  remove_cdrom            = true
+}
+
+source "vsphere-iso" "srv2019-virtual" {
+  vcenter_server          = var.vcenter_server
+  username                = var.vsphere_username
+  password                = var.vsphere_password
+  insecure_connection     = "true"
+
+  vm_name                 = "${var.vm_guestos}-${var.vm_name}-virtual"
+  datacenter              = var.vsphere_datacenter
+  host                    = var.vsphere_host
+  folder                  = var.vsphere_folder
+  datastore               = var.vsphere_datastore
+
+  guest_os_type           = "windows9Server64Guest"
+
+  boot_order              = "disk,cdrom"
+  boot_command            = [""]
+  boot_wait               = "5m"
+
+  communicator            = "winrm"
+  winrm_password          = var.winrm_password
+  winrm_timeout           = "10m"
+  winrm_username          = "administrator"
+
+  RAM                     = 4096
+  CPUs                    = 2
+
+  network_adapters {
+    network               = var.vsphere_network
+    network_card          = "vmxnet3"
+  }
+  storage {
+    disk_size             = 20480
+    disk_thin_provisioned = true
+  }
+  disk_controller_type    = ["lsilogic-sas"]
+  usb_controller          = ["xhci"]
+
+  floppy_files            = [
+    "packer/preseed/Server2019/Autounattend.xml",
+    "packer/preseed/Server2019/Sysprep_Unattend.xml",
+    "scripts/Set-NetworkProfile.ps1",
+    "scripts/Disable-WinRM.ps1",
+    "scripts/Enable-WinRM.ps1",
+    "scripts/Install-VMwareTools.cmd"
+  ]
+  iso_url                 = local.iso_authenticatedurl
+  iso_checksum            = var.iso_checksum
+  iso_paths               = var.iso_paths
+
+  shutdown_command        = "C:\\Windows\\System32\\Sysprep\\sysprep.exe /generalize /oobe /unattend:A:\\Sysprep_Unattend.xml"
+  shutdown_timeout        = "1h"
+
+  export {
+    images                = false
+    output_directory      = "/scratch/srv2019-virtual"
+  }
+  remove_cdrom            = true
+}
+
+source "vsphere-iso" "srv2019-baremetal" {
+  vcenter_server          = var.vcenter_server
+  username                = var.vsphere_username
+  password                = var.vsphere_password
+  insecure_connection     = "true"
+
+  vm_name                 = "${var.vm_guestos}-${var.vm_name}-baremetal"
+  datacenter              = var.vsphere_datacenter
+  host                    = var.vsphere_host
+  folder                  = var.vsphere_folder
+  datastore               = var.vsphere_datastore
+
+  guest_os_type           = "windows9Server64Guest"
+
+  boot_order              = "disk,cdrom"
+  boot_command            = [""]
+  boot_wait               = "5m"
+
+  communicator            = "winrm"
+  winrm_username          = "administrator"
+  winrm_password          = var.winrm_password
+  winrm_timeout           = "10m"
+
+  RAM                     = 4096
+  CPUs                    = 2
+
+  network_adapters {
+    network               = var.vsphere_network
+    network_card          = "vmxnet3"
+  }
+  storage {
+    disk_size             = 20480
+    disk_thin_provisioned = true
+  }
+  disk_controller_type    = ["pvscsi"]
+  usb_controller          = ["xhci"]
+
+  floppy_files            = [
+    "packer/preseed/Server2019/pvscsi/Autounattend.xml",
+    "packer/preseed/Server2019/Sysprep_Unattend.xml",
+    "scripts/Set-NetworkProfile.ps1",
+    "scripts/Disable-WinRM.ps1",
+    "scripts/Enable-WinRM.ps1",
+    "scripts/Install-VMwareTools.cmd"
+  ]
+  iso_url                 = local.iso_authenticatedurl
+  iso_checksum            = var.iso_checksum
+  iso_paths               = var.iso_paths
+
+  shutdown_command        = "C:\\Windows\\System32\\Sysprep\\sysprep.exe /generalize /oobe /unattend:A:\\Sysprep_Unattend.xml"
+  shutdown_timeout        = "1h"
+
+  export {
+    images                = false
+    output_directory      = "/scratch/srv2019-baremetal"
+  }
+  remove_cdrom            = true
+}
+
+build {
+  // sources = [
+  //   "source.vsphere-iso.srv2019-template",
+  //   "source.vsphere-iso.srv2019-virtual",
+  //   "source.vsphere-iso.srv2019-baremetal"
+  // ]
+  sources = [
+    "source.vsphere-iso.srv2019-template",
+    "source.vsphere-iso.srv2019-virtual"
+  ]
+
+  provisioner "windows-update" {
+  }
+
+  // provisioner "powershell" {
+  //   scripts = [
+  //     "scripts/Install-Prerequisites.ps1",
+  //     "scripts/Install-WinGet.ps1"
+  //   ]
+  // }
+  // provisioner "powershell" {
+  //   inline = [
+  //     "winget install mozilla.firefox",
+  //     "winget install 7zip.7zip",
+  //     "winget install microsoft.dotnetframework"
+  //   ]
+  //   // valid_exit_codes = [0, 3010]
+  // }
+  provisioner "powershell" {
+    inline = [
+      "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12",
+      "Invoke-Expression ((New-Object Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))"
+    ]
+  }
+  provisioner "powershell" {
+    inline           = [
+      "choco config set --name=limit-output --value=LimitOutput",
+      "choco install -y dotnetfx",
+      "choco install -y 7zip.install",
+      "choco install -y sysinternals",
+      "choco install -y firefox"
+    ]
+    valid_exit_codes = [0, 3010]
+  }
+
+  provisioner "windows-update" {
+  }
+
+  provisioner "powershell" {
+    only   = ["vsphere-iso.srv2019-virtual"]
+    inline = [
+      "New-Item -Path 'C:\\Payload\\Scripts' -ItemType 'Directory' -Force:$True -Confirm:$False"
+    ]
+  }
+
+  provisioner "file" {
+    only        = ["vsphere-iso.srv2019-virtual"]
+    destination = "C:\\Payload\\"
+    source      = "scripts/payload/"
+  }
+
+  provisioner "powershell" {
+    only    = ["vsphere-iso.srv2019-virtual"]
+    scripts = [
+      "scripts/Register-ScheduledTask.ps1"
+    ]
+  }
+
+  post-processors {
+    post-processor "vsphere" {
+      only                = ["vsphere-iso.srv2019-template"]
+
+      host                = var.vcenter_server
+      username            = var.vsphere_username
+      password            = var.vsphere_password
+      insecure            = true
+
+      vm_name             = "Windows-Server-2019-LTSC"
+      datacenter          = var.vsphere_datacenter
+      cluster             = var.vsphere_host
+      vm_folder           = var.vsphere_templatefolder
+      vm_network          = var.vsphere_network
+      datastore           = var.vsphere_datastore
+      disk_mode           = "thin"
+
+      keep_input_artifact = true
+      overwrite           = true
+    }
+    post-processor "vsphere-template" {
+      only          = ["vsphere-iso.srv2019-template"]
+
+      host          = var.vcenter_server
+      username      = var.vsphere_username
+      password      = var.vsphere_password
+      insecure      = true
+
+      datacenter    = var.vsphere_datacenter
+      folder        = var.vsphere_templatefolder
+
+      reregister_vm = false
+    }
+  }
+  post-processor "shell-local" {
+    only   = ["vsphere-iso.srv2019-virtual"]
+    inline = [
+      "pwsh -command \"& scripts/Update-OvfConfiguration.ps1 \\",
+      " -OVFFile '/scratch/srv2019-virtual/${var.vm_guestos}-${var.vm_name}-virtual.ovf' \\",
+      " -Parameter @{'appliance.name'='${var.vm_guestos}';'appliance.version'='${var.vm_name}'}\"",
+      "pwsh -file scripts/Update-Manifest.ps1 \\",
+      " -ManifestFileName '/scratch/srv2019-virtual/${var.vm_guestos}-${var.vm_name}-virtual.mf'",
+      "ovftool --acceptAllEulas --allowExtraConfig --overwrite \\",
+      " '/scratch/srv2019-virtual/${var.vm_guestos}-${var.vm_name}-virtual.ovf' \\",
+      " /output/Windows-Server-2019-LTSC.ova"
+    ]
+  }
+  post-processor "shell-local" {
+    only   = ["vsphere-iso.srv2019-baremetal"]
+    inline = [
+      "qemu-img convert -f vmdk -O raw \\",
+      "  /scratch/srv2019-baremetal/${var.vm_guestos}-${var.vm_name}-baremetal-disk-0.vmdk \\",
+      "  /tmp/${var.vm_guestos}-${var.vm_name}.raw",
+      "gzip -c \\",
+      "  /tmp/${var.vm_guestos}-${var.vm_name}.raw \\",
+      "  > /output/Windows-Server-2019-LTSC.raw.gz"
+    ]
+  }
+}

scripts/Disable-WinRM.ps1

@@ -0,0 +1,8 @@
+netsh advfirewall firewall set rule name="Windows Remote Management (HTTP-In)" new enable=yes action=block
+netsh advfirewall firewall set rule group="Windows Remote Management" new enable=yes
+$winrmService = Get-Service -Name WinRM
+if ($winrmService.Status -eq "Running"){
+    Disable-PSRemoting -Force
+}
+Stop-Service winrm
+Set-Service -Name winrm -StartupType Disabled

scripts/Enable-WinRM.ps1

@@ -0,0 +1,18 @@
+$NetworkListManager = [Activator]::CreateInstance([Type]::GetTypeFromCLSID([Guid]"{DCB00C01-570F-4A9B-8D69-199FDBA5723B}"))
+$Connections = $NetworkListManager.GetNetworkConnections()
+$Connections | ForEach-Object { $_.GetNetwork().SetCategory(1) }
+
+Enable-PSRemoting -Force
+winrm quickconfig -q
+winrm quickconfig -transport:http
+winrm set winrm/config '@{MaxTimeoutms="1800000"}'
+winrm set winrm/config/winrs '@{MaxMemoryPerShellMB="800"}'
+winrm set winrm/config/service '@{AllowUnencrypted="true"}'
+winrm set winrm/config/service/auth '@{Basic="true"}'
+winrm set winrm/config/client/auth '@{Basic="true"}'
+winrm set winrm/config/listener?Address=*+Transport=HTTP '@{Port="5985"}'
+netsh advfirewall firewall set rule group="Windows Remote Administration" new enable=yes
+netsh advfirewall firewall set rule name="Windows Remote Management (HTTP-In)" new enable=yes action=allow
+netsh advfirewall firewall set rule name="Windows Remote Management (HTTP-In)" profile=public new remoteip=any
+Set-Service winrm -startuptype "auto"
+Restart-Service winrm

scripts/Install-Prerequisites.ps1

@@ -0,0 +1,40 @@
+[CmdletBinding()]
+Param(
+    # No parameters
+)
+
+$RequiredPSModules = @(
+    'ntobjectmanager'   # Provides cmdlet 'Set-ExecutionAlias'
+)
+
+$InstallPackageProviderSplat = @{
+    Name               = 'NuGet'
+    MinimumVersion     = '2.8.5.201'
+    Force              = $True
+    Confirm            = $False
+}
+Install-PackageProvider @InstallPackageProviderSplat
+$SetPSRepositorySplat = @{
+    Name               = 'PSGallery'
+    InstallationPolicy = 'Trusted'
+}
+Set-PSRepository @SetPSRepositorySplat
+$InstallModuleSplat = @{
+    Name               = $RequiredPSModules
+    Force              = $True
+    Confirm            = $False
+}
+Install-Module @InstallModuleSplat
+$SetPSRepositorySplat = @{
+    Name               = 'PSGallery'
+    InstallationPolicy = 'Untrusted'
+}
+Set-PSRepository @SetPSRepositorySplat
+
+# Double check whether the required PowerShell modules are available
+ForEach ($Module in $RequiredPSModules) {
+    If ([boolean](Get-Module -Name $Module -ListAvailable) -ne $True) {
+        Write-Error -Message "Missing PowerShell module '$($Module)'"
+        Exit 1
+    }
+}

scripts/Install-VMwareTools.cmd

@@ -0,0 +1,2 @@
+@rem Silent mode, basic UI, no reboot
+e:\setup64 /s /v "/qb REBOOT=R"

scripts/Install-WinGet.ps1

@@ -0,0 +1,74 @@
+#Requires -Modules 'NtObjectManager'
+[CmdletBinding()]
+Param(
+    # None
+)
+
+# Download dependencies
+$AppxDependencies = @(
+    @{
+        ShortName     = 'vclibs'
+        QualifiedName = 'Microsoft.VCLibs.140.00_8wekyb3d8bbwe'
+    },
+    @{
+        ShortName     = 'vclibsuwp'
+        QualifiedName = 'Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe'
+    }
+)
+ForEach ($Dependency in $AppxDependencies) {
+    $InvokeWebRequestSplat = @{
+        Uri             = 'https://store.rg-adguard.net/api/GetFiles'
+        Method          = 'POST'
+        ContentType     = 'application/x-www-form-urlencoded'
+        Body            = "type=PackageFamilyName&url=$($Dependency.QualifiedName)&ring=RP&lang=en-US"
+        UseBasicParsing = $True
+    }
+    $InvokeWebRequestSplat = @{
+        Uri     = ((Invoke-WebRequest @InvokeWebRequestSplat).Links | Where-Object {$_.OuterHTML -match '.appx' -and $_.outerHTML -match 'x64'}).href
+        OutFile = "$env:temp/$($Dependency.ShortName).appx"
+    }
+    Invoke-WebRequest @InvokeWebRequestSplat
+}
+# Download latest release (along with license) from github
+$InvokeRestMethodSplat = @{
+    Uri    = "https://api.github.com/repos/microsoft/winget-cli/releases/latest"
+    Method = 'GET'
+}
+$LatestRelease = Invoke-RestMethod @InvokeRestMethodSplat
+$InvokeWebRequestSplat = @{
+    Uri     = ($LatestRelease.assets | Where-Object {$_.name -like '*.msixbundle'}).browser_download_url
+    OutFile = "$env:temp\winget.msixbundle"
+}
+Invoke-WebRequest @InvokeWebRequestSplat
+$InvokeWebRequestSplat = @{
+    Uri     = ($LatestRelease.assets | Where-Object {$_.name -like '*license*.xml'}).browser_download_url
+    OutFile = "$env:temp\wingetlicense.xml"
+}
+Invoke-WebRequest @InvokeWebRequestSplat
+
+# Install dependencies
+$AppxDependencies.ShortName | ForEach-Object {
+    $AddAppxPackageSplat = @{
+        Path = "$env:temp/$($_).appx"
+    }
+    Add-AppxPackage @AddAppxPackageSplat
+}
+# Install winget
+$AddAppxProvisionedPackageSplat = @{
+    Online = $True
+    PackagePath = "$env:temp\winget.msixbundle"
+    LicensePath = "$env:temp\wingetlicense.xml"
+}
+Add-AppxProvisionedPackage @AddAppxProvisionedPackageSplat
+
+# Create reparse point
+$SetExecutionAliasSplat = @{
+    Path        = "$([System.Environment]::SystemDirectory)\winget.exe"
+    PackageName = "Microsoft.DesktopAppInstaller_8wekyb3d8bbwe"
+    EntryPoint  = "Microsoft.DesktopAppInstaller_8wekyb3d8bbwe!winget"
+    Target      = "$((Get-AppxPackage Microsoft.DesktopAppInstaller).InstallLocation)\AppInstallerCLI.exe"
+    AppType     = 'Desktop'
+    Version     = 3
+}
+Set-ExecutionAlias @SetExecutionAliasSplat
+& explorer.exe "shell:appsFolder\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe!winget"

scripts/Register-ScheduledTask.ps1

@@ -0,0 +1,7 @@
+[CmdletBinding()]
+Param(
+    # No parameters
+)
+
+# Create scheduled task
+& schtasks.exe /Create /TN 'FirstBoot' /SC ONSTART /RU SYSTEM /TR "powershell.exe -file C:\Payload\Apply-FirstBootConfig.ps1"

scripts/Set-NetworkProfile.ps1

@@ -0,0 +1,23 @@
+# You cannot enable Windows PowerShell Remoting on network connections that are set to Public
+# Spin through all the network locations and if they are set to Public, set them to Private
+# using the INetwork interface:
+# http://msdn.microsoft.com/en-us/library/windows/desktop/aa370750(v=vs.85).aspx
+# For more info, see:
+# http://blogs.msdn.com/b/powershell/archive/2009/04/03/setting-network-location-to-private.aspx
+
+# Network location feature was only introduced in Windows Vista - no need to bother with this
+# if the operating system is older than Vista
+if([environment]::OSVersion.version.Major -lt 6) { return }
+
+# You cannot change the network location if you are joined to a domain, so abort
+if(1,3,4,5 -contains (Get-WmiObject win32_computersystem).DomainRole) { return }
+
+# Get network connections
+$networkListManager = [Activator]::CreateInstance([Type]::GetTypeFromCLSID([Guid]"{DCB00C01-570F-4A9B-8D69-199FDBA5723B}"))
+$connections = $networkListManager.GetNetworkConnections()
+
+$connections |foreach {
+	Write-Host $_.GetNetwork().GetName()"category was previously set to"$_.GetNetwork().GetCategory()
+	$_.GetNetwork().SetCategory(1)
+	Write-Host $_.GetNetwork().GetName()"changed to category"$_.GetNetwork().GetCategory()
+}

scripts/Update-OvfConfiguration.yml

@@ -1,26 +1,64 @@
 DeploymentConfigurations:
-- Id: small
-  Label: 'Ubuntu Server 20.04 [SMALL: 1 vCPU/2GB RAM]'
-  Description: Ubuntu Server 20.04.x
+- Id: domainmember-small
+  Label: 'Domain member [SMALL: 1 vCPU/2GB RAM]'
+  Description: Windows Server joined to an Active Directory domain.
   Size:
     CPU: 1
     Memory: 2048
-- Id: large
-  Label: 'Ubuntu Server 20.04 [LARGE: 4 vCPU/8GB RAM]'
-  Description: Ubuntu Server 20.04.x
+- Id: domainmember-medium
+  Label: 'Domain member [MEDIUM: 2 vCPU/4GB RAM]'
+  Description: Windows Server joined to an Active Directory domain.
+  Size:
+    CPU: 2
+    Memory: 4096
+- Id: domainmember-large
+  Label: 'Domain member [LARGE: 4 vCPU/8GB RAM]'
+  Description: Windows Server joined to an Active Directory domain.
   Size:
     CPU: 4
     Memory: 8192
-DynamicDisks: []
+- Id: standalone-small
+  Label: 'Stand-alone [SMALL: 1 vCPU/2GB RAM]'
+  Description: Stand-alone Windows Server.
+  Size:
+    CPU: 1
+    Memory: 2048
+- Id: standalone-medium
+  Label: 'Stand-alone [MEDIUM: 2 vCPU/4GB RAM]'
+  Description: Stand-alone Windows Server.
+  Size:
+    CPU: 2
+    Memory: 4096
+- Id: standalone-large
+  Label: 'Stand-alone [LARGE: 4 vCPU/8GB RAM]'
+  Description: Stand-alone Windows Server.
+  Size:
+    CPU: 4
+    Memory: 8192
+DynamicDisks:
+- Description: Data
+  UnitSize: GB
+  Constraints:
+    Minimum: 10
+    Maximum: 500
+- Description: Scratch
+  UnitSize: GB
+  Constraints:
+    Minimum: 5
+    Maximum: ''
 PropertyCategories:
-# - Name: 0) Deployment information
-#   ProductProperties:
-#   - Key: deployment.type
-#     Type: string
-#     Value:
-#     - small
-#     - large
-#     UserConfigurable: false
+- Name: 0) Deployment information
+  ProductProperties:
+  - Key: deployment.type
+    Type: string
+    Value:
+    - domainmember-small
+    - domainmember-medium
+    - domainmember-large
+    - standalone-small
+    - standalone-medium
+    - standalone-large
+    UserConfigurable: false
 - Name: 1) Operating System
   ProductProperties:
   - Key: guestinfo.hostname
@@ -30,26 +68,25 @@ PropertyCategories:
     DefaultValue: ''
     Configurations: '*'
     UserConfigurable: true
-  - Key: guestinfo.rootpw
+  - Key: guestinfo.administratorpw
     Type: password(7..)
-    Label: Local root password*
-    Description: ''
-    DefaultValue: ''
-    Configurations: '*'
-    UserConfigurable: true
-  - Key: guestinfo.rootsshkey
-    Type: password(1..)
-    Label: Local root SSH public key*
-    Description: This line should start with 'ssh-rsa AAAAB3N'
-    DefaultValue: ''
-    Configurations: '*'
+    Label: Local administrator password*
+    Description: Must meet password complexity rules
+    DefaultValue: password
+    Configurations:
+    - standalone-small
+    - standalone-medium
+    - standalone-large
     UserConfigurable: true
   - Key: guestinfo.ntpserver
     Type: string(1..)
     Label: Time server*
     Description: A comma-separated list of timeservers
     DefaultValue: 0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org
-    Configurations: '*'
+    Configurations:
+    - standalone-small
+    - standalone-medium
+    - standalone-large
     UserConfigurable: true
 - Name: 2) Networking
   ProductProperties:
@@ -81,6 +118,38 @@ PropertyCategories:
     DefaultValue: ''
     Configurations: '*'
     UserConfigurable: true
+- Name: 3) Active Directory membership
+  ProductProperties:
+  - Key: addsconfig.domainname
+    Type: string(1..)
+    Label: Domain name*
+    Description: Must be able to be resolved through provided DNS server
+    DefaultValue: example.org
+    Configurations:
+    - domainmember-small
+    - domainmember-medium
+    - domainmember-large
+    UserConfigurable: true
+  - Key: addsconfig.username
+    Type: string(1..)
+    Label: Domain account username*
+    Description: ''
+    DefaultValue: username
+    Configurations:
+    - domainmember-small
+    - domainmember-medium
+    - domainmember-large
+    UserConfigurable: true
+  - Key: addsconfig.password
+    Type: password(1..)
+    Label: Domain account password*
+    Description: ''
+    DefaultValue: password
+    Configurations:
+    - domainmember-small
+    - domainmember-medium
+    - domainmember-large
+    UserConfigurable: true
 AdvancedOptions:
 - Key: appliance.name
   Value: "{{ appliance.name }}"

scripts/payload/Apply-FirstBootConfig.ps1

@@ -0,0 +1,238 @@
+[CmdletBinding()]
+Param(
+    # No parameters
+)
+
+$SetLocationSplat = @{
+    Path = $PSScriptRoot
+}
+Set-Location @SetLocationSplat
+
+$NewEventLogSplat = @{
+    LogName     = 'Application'
+    Source      = 'FirstBoot'
+    ErrorAction = 'SilentlyContinue'
+}
+New-EventLog @NewEventLogSplat
+$WriteEventLogSplat = @{
+    LogName   = 'Application'
+    Source    = 'FirstBoot'
+    EntryType = 'Information'
+    EventID   = 1
+    Message   = "FirstBoot sequence initiated [working directory: '$PWD']"
+}
+Write-EventLog @WriteEventLogSplat
+
+$VMwareToolsExecutable = "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"
+
+[xml]$ovfEnv = & $VMwareToolsExecutable --cmd "info-get guestinfo.ovfEnv" | Out-String
+$ovfProperties = $ovfEnv.ChildNodes.NextSibling.PropertySection.Property
+
+$ovfPropertyValues = @{}
+foreach ($ovfProperty in $ovfProperties) {
+    $ovfPropertyValues[$ovfProperty.key] = $ovfProperty.Value
+}
+
+# Check for mandatory values
+Switch -regex ($ovfPropertyValues['deployment.type']) {
+    '^domainmember' {
+        $MandatoryProperties, $MissingProperties = @('guestinfo.hostname', 'guestinfo.ipaddress', 'guestinfo.prefixlength', 'guestinfo.gateway', 'addsconfig.domainname', 'addsconfig.username', 'addsconfig.password'), @()
+    }
+    '^standalone' {
+        $MandatoryProperties, $MissingProperties = @('guestinfo.hostname', 'guestinfo.ipaddress', 'guestinfo.prefixlength', 'guestinfo.gateway', 'guestinfo.administratorpw', 'guestinfo.ntpserver'), @()        
+    }
+    default {
+        # Mandatory values missing, cannot provision.
+        $WriteEventLogSplat = @{
+            LogName   = 'Application'
+            Source    = 'FirstBoot'
+            EntryType = 'Error'
+            EventID   = 66
+            Message   = "Unexpected or no value set for property 'deployment.type', cannot provision."
+        }
+        Write-EventLog @WriteEventLogSplat
+        & schtasks.exe /Change /TN 'FirstBoot' /DISABLE
+        Stop-Computer -Force
+        Exit
+    }
+}
+ForEach ($Property in $MandatoryProperties) {
+    If (!$ovfPropertyValues[$Property]) {
+        $MissingProperties += $Property
+    }
+}
+If ($MissingProperties.Length -gt 0) {
+        # Mandatory values missing, cannot provision.
+        $WriteEventLogSplat = @{
+            LogName   = 'Application'
+            Source    = 'FirstBoot'
+            EntryType = 'Error'
+            EventID   = 66
+            Message   = "Missing values for mandatory properties $(($MissingProperties | ForEach-Object {"'{0}'" -f $_}) -join ', '), cannot provision."
+        }
+        Write-EventLog @WriteEventLogSplat
+        & schtasks.exe /Change /TN 'FirstBoot' /DISABLE
+        Stop-Computer -Force
+        Exit
+}
+
+# Set hostname and description
+If ($Env:ComputerName -ne $ovfPropertyValues['guestinfo.hostname']) {
+    $RenameComputerSplat = @{
+        NewName     = $ovfPropertyValues['guestinfo.hostname']
+        Force       = $True
+        Confirm     = $False
+    }
+    Rename-Computer @RenameComputerSplat
+    $SetCimInstanceSplat = @{
+        InputObject = (Get-CimInstance -ClassName 'Win32_OperatingSystem')
+        Property    = @{
+            Description = $ovfPropertyValues['guestinfo.hostname']
+        }
+    }
+    Set-CimInstance  @SetCimInstanceSplat
+
+    # Restart the computer to apply changes
+    Restart-Computer -Force
+    Exit
+}
+
+# Configure network interface
+If ((Get-WmiObject -Class 'Win32_NetworkAdapterConfiguration').IPAddress -NotContains $ovfPropertyValues['guestinfo.ipaddress']) {
+    $NewNetIPAddressSplat = @{
+        InterfaceAlias = (Get-NetAdapter).Name
+        AddressFamily  = 'IPv4'
+        IPAddress      = $ovfPropertyValues['guestinfo.ipaddress']
+        PrefixLength   = $ovfPropertyValues['guestinfo.prefixlength']
+        DefaultGateway = $ovfPropertyValues['guestinfo.gateway']
+    }
+    $IPAddress = New-NetIPAddress @NewNetIPAddressSplat
+
+    # Wait for network connection to become available
+    $Timestamp, $TimeoutMinutes = (Get-Date), 5
+    Do {
+        If ($Timestamp.AddMinutes($TimeoutMinutes) -lt (Get-Date)) {
+            $WriteEventLogSplat = @{
+                LogName   = 'Application'
+                Source    = 'FirstBoot'
+                EntryType = 'Warning'
+                EventID   = 13
+                Message   = "Timeout after $($TimeoutMinutes) minutes waiting for network connection to become available."
+            }
+            Write-EventLog @WriteEventLogSplat
+            Break
+        }
+
+        Start-Sleep -Milliseconds 250
+
+        $GetNetIPAddressSplat = @{
+            IPAddress      = $ovfPropertyValues['guestinfo.ipaddress']
+            InterfaceIndex = $IPAddress.InterfaceIndex
+            AddressFamily  = 'IPv4'
+            ErrorAction    = 'SilentlyContinue'
+        }
+    } Until ((Get-NetIPAddress @GetNetIPAddressSplat).AddressState -eq 'Preferred')
+
+    $OldErrorActionPreference, $ErrorActionPreference = $ErrorActionPreference, 'SilentlyContinue'
+    $TestNetConnectionSplat = @{
+        ComputerName     = ([IPAddress]$ovfPropertyValues['guestinfo.dnsserver']).IPAddressToString
+        InformationLevel = 'Quiet'
+    }
+    $SetDnsClientServerAddressSplat = @{
+        InterfaceAlias  = (Get-NetAdapter).Name
+        ServerAddresses = If (
+            [boolean]($ovfPropertyValues['guestinfo.dnsserver'] -as [IPaddress]) -and (Test-NetConnection @TestNetConnectionSplat)) {
+                ($ovfPropertyValues['guestinfo.dnsserver'])
+            } else {
+                ('127.0.0.1')
+            }
+        Validate        = $False
+    }
+    Set-DnsClientServerAddress @SetDnsClientServerAddressSplat
+    $ErrorActionPreference, $OldErrorActionPreference = $OldErrorActionPreference, $NULL
+}
+
+Switch -regex ($ovfPropertyValues['deployment.type']) {
+    '^domainmember' {
+        # Join Active Directory domain as member
+        If (!(Get-WmiObject -Class Win32_ComputerSystem).PartOfDomain) {
+            $AddComputerSplat = @{
+                DomainName = $ovfPropertyValues['addsconfig.domainname']
+                Credential = New-Object System.Management.Automation.PSCredential(
+                    $ovfPropertyValues['addsconfig.username'],
+                    (ConvertTo-SecureString $ovfPropertyValues['addsconfig.password'] -AsPlainText -Force)
+                )
+                # OUPath     = $ovfPropertyValues['addsconfig.organizationalunit']
+                Restart    = $True
+                Force      = $True
+                Confirm    = $False
+            }
+            Add-Computer @AddComputerSplat
+
+            # Previous cmdlet performs a reboot on completion; so these are commented out
+            # Restart-Computer -Force
+            # Exit
+        }
+    }
+    '^standalone' {
+        # Change password of built-in Administrator
+        $BuiltinAdministrator = (Get-LocalUser | Where-Object {$_.SID -match '-500'})
+        $ConvertToSecureStringSplat = @{
+            String      = $ovfPropertyValues['guestinfo.administratorpw']
+            AsPlainText = $True
+            Force       = $True
+        }
+        $SetLocalUserSplat = @{
+            InputObject = $BuiltinAdministrator
+            Password              = ConvertTo-SecureString @ConvertToSecureStringSplat
+            PasswordNeverExpires  = $True
+            AccountNeverExpires   = $True
+            ### This setting is not allowed on the last administrator
+            # UserMayChangePassword = $False
+            Confirm               = $False
+        }
+        Set-LocalUser @SetLocalUserSplat
+    }
+}
+
+# Iterate through and invoke all payload scripts
+#! TODO: add registry values to determine which scripts have already been invoked (in case of intermediate reboots)
+$GetItemSplat = @{
+    Path = "$($PSScriptRoot)\Scripts\*.ps1"
+}
+ForEach ($Script in (Get-Item @GetItemSplat)) {
+    Try {
+        $WriteEventLogSplat = @{
+            LogName   = 'Application'
+            Source    = 'FirstBoot'
+            EntryType = 'Information'
+            EventID   = 4
+            Message   = "Running script: '$($Script.FullName)'"
+        }
+        Write-EventLog @WriteEventLogSplat
+        & $Script.FullName -Parameter $ovfPropertyValues
+    }
+    Catch {
+        $WriteEventLogSplat = @{
+            LogName   = 'Application'
+            Source    = 'FirstBoot'
+            EntryType = 'Error'
+            EventID   = 66
+            Message   = @"
+Error occurred while executing script '$($Script.Name)':
+$($_.Exception.Message)
+"@
+        }
+        Write-EventLog @WriteEventLogSplat
+    }
+}
+
+$WriteEventLogSplat = @{
+    LogName   = 'Application'
+    Source    = 'FirstBoot'
+    EntryType = 'Information'
+    EventID   = 42
+    Message   = 'FirstBoot sequence applied and finished'
+}
+Write-EventLog @WriteEventLogSplat
+& schtasks.exe /Change /TN 'FirstBoot' /DISABLE