Technitium DNS Weekly Report → ntfy / Email

Technitium DNS Weekly Report → ntfy / Email

#!/usr/bin/env python3
"""
Technitium DNS Server - Weekly Device Report
Fetches all visited & blocked sites for a target device IP
for the last 7 days and sends via ntfy and/or email.

Schedule with cron:  0 8 * * 1  python3 /path/to/dns_report.py
"""

import requests
import smtplib
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart
from collections import Counter
from datetime import datetime, timedelta
import sys
import time

# ===================== CONFIGURATION =====================

# Technitium DNS Server
DNS_SERVER      = "http://192.168.1.x:5380"   # <-- Your DNS server IP
USERNAME        = "admin"
PASSWORD        = "your_password"              # <-- Your password

# Target Device
TARGET_DEVICE_IP = "192.168.1.100"             # <-- Device IP to report
DEVICE_NAME      = "Test's PC"                # <-- Friendly name

# Pagination (increase MAX_PAGES if you have heavy traffic)
ENTRIES_PER_PAGE = 1000
MAX_PAGES        = 100

# ---- NTFY Configuration ----
NTFY_ENABLED = True
NTFY_URL     = "https://ntfy.sh/test-home"
NTFY_TITLE   = "DNS Report"
NTFY_PRIORITY = "default"                      # min, low, default, high, urgent
NTFY_TAGS     = "bar_chart,globe_with_meridians"

# ---- Email Configuration (optional) ----
EMAIL_ENABLED  = False
SMTP_SERVER    = "smtp.gmail.com"
SMTP_PORT      = 587
SMTP_USE_TLS   = True
SMTP_USER      = "your_email@gmail.com"
SMTP_PASSWORD  = "your_app_password"
EMAIL_FROM     = "your_email@gmail.com"
EMAIL_TO       = "recipient@gmail.com"
EMAIL_SUBJECT  = "Weekly DNS Report"

# ==========================================================


def get_token():
    """Authenticate with Technitium and return API token."""
    url = f"{DNS_SERVER}/api/user/login"
    params = {"user": USERNAME, "pass": PASSWORD}
    try:
        resp = requests.get(url, params=params, timeout=15)
        resp.raise_for_status()
        data = resp.json()
        if data.get("status") == "ok":
            print("✅ Authenticated with Technitium DNS")
            return data["token"]
        else:
            raise Exception(f"Login failed: {data.get('errorMessage', data)}")
    except requests.exceptions.ConnectionError:
        print(f"❌ Cannot connect to Technitium at {DNS_SERVER}")
        sys.exit(1)


def fetch_logs_for_week(token, client_ip):
    """Fetch all query logs for the target IP for the last 7 days."""
    now = datetime.now()
    week_ago = now - timedelta(days=7)

    # Technitium expects: yyyy-MM-dd HH:mm:ss  (or ISO 8601 in newer versions)
    start_str = week_ago.strftime("%Y-%m-%d %H:%M:%S")
    end_str   = now.strftime("%Y-%m-%d %H:%M:%S")

    print(f"📅 Fetching logs from {start_str} to {end_str}")
    print(f"🎯 Target device: {client_ip} ({DEVICE_NAME})\n")

    all_entries = []

    for page in range(1, MAX_PAGES + 1):
        url = f"{DNS_SERVER}/api/queryLogs/list"
        params = {
            "token":            token,
            "pageNumber":       page,
            "entriesPerPage":   ENTRIES_PER_PAGE,
            "clientIpAddress":  client_ip,
            "start":            start_str,
            "end":              end_str,
        }

        try:
            resp = requests.get(url, params=params, timeout=30)
            resp.raise_for_status()
            data = resp.json()
        except Exception as e:
            print(f"⚠️  Error fetching page {page}: {e}")
            break

        if data.get("status") != "ok":
            print(f"⚠️  API error: {data.get('errorMessage', data)}")
            break

        entries = data.get("response", {}).get("entries", [])
        if not entries:
            break

        all_entries.extend(entries)
        print(f"   Page {page}: {len(entries)} entries (total: {len(all_entries)})")

        # If we got fewer entries than requested, we've reached the end
        if len(entries) < ENTRIES_PER_PAGE:
            break

        time.sleep(0.1)  # Be gentle on the server

    print(f"\n📊 Total entries fetched: {len(all_entries)}")
    return all_entries


def parse_logs(entries):
    """Parse log entries into allowed/blocked domain lists."""
    allowed_domains = []
    blocked_domains = []
    all_domains     = []

    for entry in entries:
        # Extract domain name (field name varies by Technitium version)
        domain = (
            entry.get("qName")
            or entry.get("questionName")
            or entry.get("qname")
            or "unknown"
        )
        domain = domain.rstrip(".")  # Remove trailing dot

        # Skip internal/infrastructure queries
        if domain in ("unknown", "", "localhost"):
            continue

        # Detect if the query was blocked
        response_type = str(entry.get("responseType", "")).lower()
        rcode         = str(entry.get("responseCode", entry.get("rcode", ""))).lower()

        blocked_keywords = [
            "blocked", "upstreamblocked", "cacheblocked",
            "customblocked", "blocklist", "adblocked"
        ]

        is_blocked = (
            any(kw in response_type for kw in blocked_keywords)
            or rcode in ("refused", "nxdomain")  # depends on your block config
            or entry.get("isBlocked", False)
        )

        all_domains.append(domain)

        if is_blocked:
            blocked_domains.append(domain)
        else:
            allowed_domains.append(domain)

    return allowed_domains, blocked_domains, all_domains


def build_report(allowed_domains, blocked_domains, all_domains):
    """Build a formatted text report."""
    now       = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
    week_ago  = (datetime.now() - timedelta(days=7)).strftime("%Y-%m-%d")
    today     = datetime.now().strftime("%Y-%m-%d")

    allowed_counter = Counter(allowed_domains)
    blocked_counter = Counter(blocked_domains)
    all_counter     = Counter(all_domains)

    # ---- Build the report string ----
    lines = []
    lines.append("=" * 50)
    lines.append(f"📊 WEEKLY DNS REPORT")
    lines.append(f"📱 Device: {DEVICE_NAME} ({TARGET_DEVICE_IP})")
    lines.append(f"📅 Period: {week_ago} → {today}")
    lines.append(f"🕐 Generated: {now}")
    lines.append("=" * 50)

    # Summary
    lines.append("")
    lines.append("📈 SUMMARY")
    lines.append(f"  Total Queries    : {len(all_domains)}")
    lines.append(f"  Allowed Queries  : {len(allowed_domains)}")
    lines.append(f"  Blocked Queries  : {len(blocked_domains)}")
    if all_domains:
        block_pct = (len(blocked_domains) / len(all_domains)) * 100
        lines.append(f"  Block Rate       : {block_pct:.1f}%")
    lines.append(f"  Unique Sites     : {len(all_counter)}")
    lines.append(f"  Unique Allowed   : {len(allowed_counter)}")
    lines.append(f"  Unique Blocked   : {len(blocked_counter)}")

    # ---- ALL VISITED SITES (sorted by query count) ----
    lines.append("")
    lines.append("🌐 ALL VISITED SITES (by query count)")
    lines.append("-" * 50)

    for i, (domain, count) in enumerate(allowed_counter.most_common(), 1):
        lines.append(f"  {i:>4}. {domain}  ({count})")

    # ---- ALL BLOCKED SITES ----
    lines.append("")
    lines.append("🚫 ALL BLOCKED SITES (by query count)")
    lines.append("-" * 50)

    if blocked_counter:
        for i, (domain, count) in enumerate(blocked_counter.most_common(), 1):
            lines.append(f"  {i:>4}. {domain}  ({count})")
    else:
        lines.append("  (No blocked queries)")

    lines.append("")
    lines.append("=" * 50)

    return "\n".join(lines)


def build_short_summary(allowed_domains, blocked_domains, all_domains, top_n=15):
    """Build a shorter summary for ntfy (fits in message limit)."""
    allowed_counter = Counter(allowed_domains)
    blocked_counter = Counter(blocked_domains)
    week_ago = (datetime.now() - timedelta(days=7)).strftime("%Y-%m-%d")
    today    = datetime.now().strftime("%Y-%m-%d")

    lines = []
    lines.append(f"📱 {DEVICE_NAME} ({TARGET_DEVICE_IP})")
    lines.append(f"📅 {week_ago} → {today}")
    lines.append(f"📊 Queries: {len(all_domains)} | Blocked: {len(blocked_domains)}")
    if all_domains:
        lines.append(f"🛡️ Block rate: {(len(blocked_domains)/len(all_domains))*100:.1f}%")
    lines.append("")

    lines.append(f"🌐 Top {top_n} Visited:")
    for i, (domain, count) in enumerate(allowed_counter.most_common(top_n), 1):
        lines.append(f" {i}. {domain} ({count})")

    lines.append("")
    lines.append(f"🚫 Top {min(top_n, len(blocked_counter))} Blocked:")
    if blocked_counter:
        for i, (domain, count) in enumerate(blocked_counter.most_common(top_n), 1):
            lines.append(f" {i}. {domain} ({count})")
    else:
        lines.append(" (none)")

    return "\n".join(lines)


def send_ntfy(full_report, short_summary):
    """Send notification via ntfy.sh with full report as attachment."""
    if not NTFY_ENABLED:
        return

    print("\n📤 Sending ntfy notification...")

    # ---- Send the full report as a file attachment ----
    try:
        timestamp = datetime.now().strftime("%Y%m%d")
        filename = f"dns_report_{timestamp}.txt"

        resp = requests.put(
            NTFY_URL,
            data=full_report.encode("utf-8"),
            headers={
                "Title":    NTFY_TITLE,
                "Tags":     NTFY_TAGS,
                "Priority": NTFY_PRIORITY,
                "Filename": filename,
            },
            timeout=15,
        )
        resp.raise_for_status()
        print(f"   ✅ Full report sent as attachment: {filename}")
    except Exception as e:
        print(f"   ⚠️  Attachment send failed: {e}")

    # ---- Send a short summary as a readable notification ----
    try:
        resp = requests.post(
            NTFY_URL,
            data=short_summary.encode("utf-8"),
            headers={
                "Title":    f"{NTFY_TITLE} - {DEVICE_NAME}",
                "Tags":     NTFY_TAGS,
                "Priority": NTFY_PRIORITY,
            },
            timeout=15,
        )
        resp.raise_for_status()
        print("   ✅ Summary notification sent!")
    except Exception as e:
        print(f"   ❌ Notification failed: {e}")


def send_email(full_report):
    """Send the full report via email."""
    if not EMAIL_ENABLED:
        return

    print("\n📧 Sending email report...")

    try:
        msg = MIMEMultipart("alternative")
        msg["Subject"] = f"{EMAIL_SUBJECT} - {DEVICE_NAME}"
        msg["From"]    = EMAIL_FROM
        msg["To"]      = EMAIL_TO

        # Plain text version
        text_part = MIMEText(full_report, "plain", "utf-8")
        msg.attach(text_part)

        # HTML version (optional - makes it look nicer)
        html_report = "<pre style='font-family: monospace; font-size: 13px;'>\n"
        html_report += full_report.replace("\n", "<br>")
        html_report += "\n</pre>"
        html_part = MIMEText(html_report, "html", "utf-8")
        msg.attach(html_part)

        with smtplib.SMTP(SMTP_SERVER, SMTP_PORT) as server:
            if SMTP_USE_TLS:
                server.starttls()
            server.login(SMTP_USER, SMTP_PASSWORD)
            server.sendmail(EMAIL_FROM, EMAIL_TO, msg.as_string())

        print("   ✅ Email sent successfully!")
    except Exception as e:
        print(f"   ❌ Email failed: {e}")


def save_report_local(full_report):
    """Save the report to a local file as backup."""
    timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
    filename = f"dns_report_{TARGET_DEVICE_IP}_{timestamp}.txt"
    try:
        with open(filename, "w", encoding="utf-8") as f:
            f.write(full_report)
        print(f"\n💾 Report saved locally: {filename}")
    except Exception as e:
        print(f"\n⚠️  Could not save locally: {e}")


# ===================== MAIN =====================

def main():
    print("🚀 Technitium DNS Weekly Report Generator\n")

    # Step 1: Authenticate
    token = get_token()

    # Step 2: Fetch logs for the last 7 days
    entries = fetch_logs_for_week(token, TARGET_DEVICE_IP)

    if not entries:
        no_data_msg = f"No DNS queries found for {DEVICE_NAME} ({TARGET_DEVICE_IP}) in the last 7 days."
        print(f"\n⚠️  {no_data_msg}")

        # Still notify that there's no data
        if NTFY_ENABLED:
            requests.post(
                NTFY_URL,
                data=no_data_msg.encode("utf-8"),
                headers={"Title": NTFY_TITLE, "Tags": "warning"},
                timeout=15,
            )
        return

    # Step 3: Parse logs
    allowed, blocked, all_domains = parse_logs(entries)
    print(f"\n   Allowed: {len(allowed)} | Blocked: {len(blocked)} | Total: {len(all_domains)}")

    # Step 4: Build reports
    full_report   = build_report(allowed, blocked, all_domains)
    short_summary = build_short_summary(allowed, blocked, all_domains, top_n=15)

    # Print to console
    print("\n" + full_report)

    # Step 5: Send notifications
    send_ntfy(full_report, short_summary)
    send_email(full_report)
    save_report_local(full_report)

    print("\n🎉 Done!")


if __name__ == "__main__":
    main()

What This Does

┌─────────────────────────────────────────────┐
│         Technitium DNS Server               │
│         (last 7 days of logs)               │
└──────────────┬──────────────────────────────┘
               │ API query filtered by IP
               ▼
┌─────────────────────────────────────────────┐
│         Python Script                       │
│  • Fetches all logs for TARGET_DEVICE_IP    │
│  • Separates allowed vs blocked             │
│  • Counts & ranks domains                   │
│  • Builds full report + short summary       │
└──────┬──────────────┬──────────────┬────────┘
       │              │              │
       ▼              ▼              ▼
   📱 ntfy         📧 Email      💾 Local
   (2 messages)    (full report)   (.txt file)
   • Summary msg
   • Full .txt
     attachment

ntfy Notifications You’ll Receive

Notification 1 — Readable Summary:

📱 Test's PC (192.168.1.100)
📅 2025-01-08 → 2025-01-15
📊 Queries: 12847 | Blocked: 2341
🛡️ Block rate: 18.2%

🌐 Top 15 Visited:
 1. www.google.com (834)
 2. youtube.com (612)
 3. reddit.com (445)
 ...

🚫 Top 15 Blocked:
 1. ads.doubleclick.net (312)
 2. tracking.facebook.com (198)
 ...

Notification 2 — Full report attached as dns_report_20250115.txt

Setup Steps

1. Edit the Configuration

DNS_SERVER       = "http://192.168.1.5:5380"    # Your Technitium IP
PASSWORD         = "your_actual_password"
TARGET_DEVICE_IP = "192.168.1.100"              # Device to track
DEVICE_NAME      = "Test's PC"

2. Enable Query Logging in Technitium

Technitium Dashboard → Settings → Logging

• ✅ Enable Query Logging
• ✅ Log to local folder
• Set log retention ≥ 7 days

3. Test It

pip install requests
python3 dns_report.py

4. Schedule Weekly (Every Monday 8 AM)

Linux (cron):

crontab -e
# Add:
0 8 * * 1 /usr/bin/python3 /home/test/dns_report.py >> /home/test/dns_report.log 2>&1

Windows (Task Scheduler):

Action: Start a program
Program: python
Arguments: C:\scripts\dns_report.py
Trigger: Weekly, Monday, 8:00 AM

Optional: Enable Email Too

Set EMAIL_ENABLED = True and fill in your SMTP details. For Gmail, use an App Password:

EMAIL_ENABLED  = True
SMTP_SERVER    = "smtp.gmail.com"
SMTP_PORT      = 587
SMTP_USER      = "you@gmail.com"
SMTP_PASSWORD  = "xxxx xxxx xxxx xxxx"  # Gmail App Password
EMAIL_TO       = "you@gmail.com"

PowerToys Peek on Spacebar Is a UX Trap in Windows 11

Windows 11 Spacebar Opens File Preview? It’s Probably PowerToys — And It’s Bad UX

If pressing Spacebar in Windows 11 File Explorer opens a preview window, it’s easy to assume Windows is broken.

It probably isn’t.

In most cases, the real culprit is PowerToys Peek — and if it’s bound to Spacebar, it creates a genuinely bad user experience.

Why? Because Spacebar is not a “feature key.” It’s a typing key.

That means a preview shortcut can suddenly hijack normal actions like:

• renaming files,
• typing in search,
• or simply using File Explorer the way people expect it to work.

This post explains what’s happening, how to fix it, and why binding Peek to Spacebar is a design choice that can easily backfire.

TL;DR

If Spacebar previews files in Windows 11, the issue is usually:

• PowerToys → Peek
• configured to use Spacebar

Fix:

Open:

PowerToys → Peek

Then either:

• Disable Peek, or
• Change the activation shortcut to something like:
  • Ctrl + Space
  • Ctrl + Shift + Space

First: This Is Not a Native Windows 11 Feature

This part matters.

Windows 11 does not natively use plain Spacebar in File Explorer to open a floating preview popup.

What Windows does include is:

• Preview Pane
• Shortcut: Alt + P
• Opens as a side panel inside File Explorer

That’s the built-in behavior.

If you’re getting a floating popup preview when pressing Spacebar, that’s almost always coming from:

• PowerToys Peek
• QuickLook
• Seer
• or another third-party Explorer enhancement

In my case, it was PowerToys Peek.

Why This Feels Like a Windows Bug

Because PowerToys is made by Microsoft.

That’s what makes this so misleading.

PowerToys integrates well with Windows, so when it changes File Explorer behavior, it can feel “native” enough that users assume the OS itself is responsible.

But PowerToys is not Windows.

It’s an optional utility suite layered on top of Windows — and that distinction matters when troubleshooting weird keyboard behavior.

The Real Problem Isn’t the Preview — It’s the Shortcut

The preview feature itself is not the issue.

The issue is binding it to Spacebar.

That’s where the UX falls apart.

Why this is bad UX

Spacebar is a core input key.

It’s not like F8, Ctrl + Shift + P, or some obscure combo nobody types accidentally.

Users press Spacebar all the time, and not just in documents.

Inside File Explorer alone, it’s part of normal workflow behavior.

That means assigning a global-ish preview action to Spacebar creates a shortcut collision with basic file operations.

The Best Example: Renaming Files

This is where the problem becomes obvious.

Typical workflow

1. Select a file
2. Press F2 to rename it
3. Start typing the new file name
4. Press Spacebar to separate words

What happens instead

Instead of inserting a space in the file name:

• Peek intercepts the keypress
• a preview window opens
• your rename flow gets interrupted

That’s not just annoying.

That’s a direct conflict with one of the most common actions in File Explorer.

Why this matters

When a utility hijacks a normal text-input key, users experience:

• broken typing behavior
• interrupted workflows
• accidental popups
• confusion about what the system is doing
• loss of trust in File Explorer behavior

That’s why this feels worse than “just a shortcut issue.”

It’s a usability problem.

How I Confirmed It Was PowerToys

The fastest test took about 10 seconds.

Quick diagnostic

1. Press Ctrl + Shift + Esc to open Task Manager
2. Go to Processes
3. Find PowerToys
4. Right-click it
5. Click End task
6. Go back to File Explorer
7. Press Spacebar on a selected file

Result

If the preview stops:

✅ PowerToys Peek was the cause

That immediately proves the behavior is not coming from native Windows.

How to Fix It

You have two options:

• disable Peek
• or keep Peek, but stop using Spacebar

For most people, the second option is the better fix.

Option 1: Disable Peek Completely

If you don’t use file preview often:

1. Open PowerToys
2. Click Peek in the left sidebar
3. Turn Enable Peek Off

Done.

Option 2: Keep Peek, But Rebind the Shortcut (Recommended)

If you like the feature, keep it — just don’t bind it to a typing key.

Steps

1. Open PowerToys
2. Go to Peek
3. Find Activation shortcut
4. Change it from Spacebar to something safer

Better shortcut choices

• Ctrl + Space
• Ctrl + Shift + Space
• another modifier-based combination that doesn’t conflict with typing

This preserves the feature without breaking normal file operations.

My Opinion: Spacebar Should Never Be the Default Here

This is the part where I’ll be blunt:

Spacebar is a poor default for a preview tool inside File Explorer.

Yes, it mirrors the macOS Quick Look idea.

But Windows users don’t all have the same expectations or workflows, and File Explorer is not Finder.

More importantly:

• Spacebar is still a normal input key
• it’s heavily used in naming, searching, and general text entry
• binding it to a preview action creates too much friction unless it’s extremely context-aware

A good shortcut should be:

• intentional,
• hard to trigger accidentally,
• and should not interfere with typing

Spacebar fails that test in this context.

Recommended Best Practice

If you use PowerToys Peek, avoid assigning it to:

• Spacebar
• single letters
• number keys
• any key that doubles as regular text input

Use modifier-based shortcuts instead

Safer examples:

• Ctrl + Space
• Ctrl + Shift + Space
• Alt + Space (only if it doesn’t conflict with your setup)

The rule is simple:

If a key is part of normal typing, it shouldn’t be the sole trigger for a utility action in File Explorer.

If It’s Not PowerToys

If disabling or rebinding Peek doesn’t fix it, check for similar tools:

• QuickLook
• Seer
• Files
• QTTabBar

But if you already found PowerToys Peek bound to Spacebar, that’s almost certainly the root cause.

Final Take

The weird part about this issue is that it looks like Windows.

The frustrating part is that it feels like a Windows bug.

But the real problem is simpler:

• PowerToys Peek was bound to Spacebar
• Spacebar is a terrible key to hijack for this
• That breaks common workflows like file renaming

Best fix

Open:

PowerToys → Peek

Then:

• disable Peek, or
• rebind it to a modifier-based shortcut

That keeps the feature useful without making File Explorer feel broken.

Lenovo Workstation Recommendation for Research

[2] ASSISTANT (claude-opus-4-6-thinking)

Lenovo Workstation Recommendation for Research (Abaqus, MATLAB, CATIA)

Software Minimum & Recommended Requirements Summary

⚠️ CATIA is the most demanding regarding GPU certification. Always cross-check the chosen GPU against the Dassault Systèmes certified hardware list.

Recommended Lenovo Models & Configurations

✅ Option 1: Lenovo ThinkStation P3 Tower (Best value for most researchers)

🔶 Option 2: Lenovo ThinkStation P620 (Heavy simulation workloads)

Key Points & Tips

1. Abaqus scaling: Abaqus/Standard benefits from high clock speed; Abaqus/Explicit benefits from more cores. Ask the researcher what type of analyses they run.

2. ECC Memory: For long-running simulations (hours/days), ECC RAM is strongly recommended to prevent silent data corruption. Xeon/Threadripper Pro platforms support this.

3. GPU Certification: CATIA can be unstable on non-certified GPUs. Stick with NVIDIA RTX A-series (A2000, A4000, A5000) — these are on Dassault’s certified list.

4. MATLAB Parallel Computing: If the researcher uses MATLAB’s Parallel Computing Toolbox or GPU computing, ensure the NVIDIA GPU has CUDA Compute Capability 3.5+ (all RTX A-series qualify).

5. Scratch/Temp Storage: Abaqus writes large temporary files during solves. A secondary NVMe SSD dedicated to scratch space can significantly speed up large simulations.

White Desktop Icon in Windows 11 Caused by OneDrive

How To Fix the Zombie White Desktop Icon in Windows 11 Caused by OneDrive

If you’ve deployed a customized Windows 11 image and are seeing a mysterious blank white desktop icon that reappears every time you delete it — even though it has no name, target, or properties — you’re not alone.

This ghostly icon is one of the most frustrating issues in Windows imaging and deployment. But the good news? It’s not random, and it can be permanently fixed.

In this guide, I’ll show you exactly how to identify, remove, and prevent this issue — especially when it’s caused by OneDrive, which is one of the most common root causes.

🧟‍♂️ What Is This “Zombie” Icon?

You see:

• A single blank white icon on the desktop
• No right-click menu options (or only “Delete”)
• Properties shows nothing useful (no target path)
• Deleting it → refresh (F5) → it comes back instantly
• Appears for every new user on machines deployed from your image

❌ This is NOT an icon cache issue
✅ This is a namespace object baked into the Default User profile

🔍 Why Does This Happen?

When you run sysprep /generalize /oobe /unattend:unattend.xml with CopyProfile enabled, Windows copies settings from your reference user account to the Default User profile.

If OneDrive was ever installed, partially removed, disabled, or unprovisioned during your build process, its desktop namespace registration may have been left behind as an orphaned registry entry.

Even if you:

• Removed OneDrive via PowerShell
• Disabled it via Group Policy
• Deleted the shortcut manually

…if the namespace key remains in the registry, it gets copied to all future users.

And because the app can’t be found at login, Explorer displays it as a white placeholder icon.

✅ Step-by-Step Fix: Remove the Orphaned OneDrive Namespace Entry

🔧 For Already-Deployed Machines (Quick Fix)

1. Press Win + R, type regedit, and press Enter
2. Navigate to:

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
   

3. Look through each subkey (they are GUIDs like {A0953C92-50DC-43BF-BE83-575D374FBC1}).
4. Click each one and check the (Default) value in the right pane.
5. Find the key where the Default value says “OneDrive”.
6. Right-click that GUID key → Export (to backup) → then Delete
7. Also check the same path under:

   HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
   

   And delete the OneDrive GUID there too, if present.

8. Restart Explorer or log off and back in:
   • Open Task Manager → find Windows Explorer → click Restart

✅ The white icon should now be gone — and stay gone.

💣 Nuclear Option: Fix It Permanently in Your Reference Image

To ensure this never happens again on any machine you deploy, clean up the Default User profile before capturing your image.

⚠️ Warning:

Never edit C:\Users\Default directly. Always use the registry hive method.

Step 1: Load the Default User Registry Hive

Run Command Prompt as Administrator on your reference machine:

reg load HKLM\DefaultUser C:\Users\Default\NTUSER.DAT

This loads the Default User’s NTUSER.DAT into the registry under HKEY_LOCAL_MACHINE\DefaultUser.

Step 2: Delete the OneDrive Namespace Key

1. Open regedit
2. Go to:

   HKEY_LOCAL_MACHINE\DefaultUser\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
   

3. Browse each GUID subkey.
4. If you find a key where the (Default) value is “OneDrive”, delete it.
   • Example GUIDs (may vary):
     • {018D5C66-4533-4307-9B53-224DE2ED1FE6} ← Common OneDrive namespace
     • {905E63B6-C1BF-494E-B29C-65B732D3D21A} ← Older Microsoft 365/OneDrive combo

🔎 Tip: Sort by the “Data” column to spot “OneDrive” entries faster.

Step 3: Unload the Hive (Critical!)

Back in the admin Command Prompt:

reg unload HKLM\DefaultUser

❗ Never skip this step. Failing to unload the hive can corrupt the Default profile and cause bigger issues.

Step 4: Run Sysprep & Capture

Now proceed with:

sysprep /generalize /oobe /shutdown /unattend:unattend.xml

Then capture your WIM/ESD image.

🎉 Any machine deployed from this image will no longer inherit the OneDrive zombie icon.

🛠 Prevent This Issue in Future Builds

Add these steps to your standard image build checklist:

📜 Bonus: PowerShell Script to Remove OneDrive Namespace (For Deployment Tools)

Use this in MDT, SCCM, or Intune to fix existing machines:

# Remove OneDrive from Machine-wide Desktop Namespace
$oneDriveGuids = '{018D5C66-4533-4307-9B53-224DE2ED1FE6}', '{905E63B6-C1BF-494E-B29C-65B732D3D21A}'

foreach ($guid in $oneDriveGuids) {
    $path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\$guid"
    if (Test-Path $path) {
        Remove-Item -Path $path -Force -ErrorAction SilentlyContinue
    }
}

# Optional: Kill explorer and restart to refresh immediately
Get-Process explorer | Stop-Process

Add this script to your task sequence just before sysprep.

🔄 Alternative: Disable OneDrive Without Breaking the Desktop

Instead of removing OneDrive entirely, consider suppressing it more cleanly:

Via Group Policy (Recommended)

• Path: User Configuration → Administrative Templates → Windows Components → OneDrive
• Enable: “Remove OneDrive shortcut from This PC”

This hides the icon without leaving broken registry entries.

✅ Final Thoughts

That blank white desktop icon is not magic — it’s a misconfigured namespace object inherited from a dirty Default User profile.

By understanding that OneDrive is a frequent offender, and using the reg load / reg unload method to clean the Default hive, you can:

• Fix existing deployments
• Prevent future ones
• Save hours of troubleshooting across your fleet

Building an OEM-Style Factory Reset for Windows 11 — Complete Guide

Building an OEM-Style Factory Reset for Windows 11 — Complete Guide

A Step-by-Step Blog Post

# How to Create an OEM-Style Factory Reset Partition in Windows 11
### Restore Your PC with All Apps, Drivers & Settings — Like Dell/HP/Lenovo

---

## Table of Contents

1. [Introduction](#introduction)
2. [Architecture Overview](#architecture-overview)
3. [Prerequisites](#prerequisites)
4. [Phase 1: Create the Recovery Partition](#phase-1-create-the-recovery-partition)
5. [Phase 2: The PowerShell Script — Explained](#phase-2-the-powershell-script)
6. [Phase 3: How the Restore Scripts Work](#phase-3-restore-scripts)
7. [Phase 4: Testing & Validation](#phase-4-testing)
8. [Lessons Learned & Pitfalls](#lessons-learned)
9. [Complete Script Download](#complete-script)
10. [FAQ](#faq)

---

## Introduction

Ever wondered how Dell, HP, and Lenovo ship PCs with a "Factory Reset" option 
that restores Windows with **all pre-installed applications and drivers**? 

Windows 11's built-in "Reset this PC" feature **strips away all Win32 
desktop applications** during the reset process. It's designed to return 
Windows to a clean state — not to restore a fully configured system.

This guide shows you how to build a **true OEM-style factory reset** 
that preserves everything:

- ✅ All installed applications (Win32, .NET, etc.)
- ✅ All hardware drivers  
- ✅ System settings and configurations
- ✅ Silent OOBE (no setup screens after restore)
- ✅ Hidden, protected recovery partition
- ✅ Works even when Windows won't boot

### Why Not Just Use "Reset this PC"?

| Feature | Reset this PC | Our Solution |
|---------|:------------:|:------------:|
| Restores base Windows | ✅ | ✅ |
| Keeps Win32 apps | ❌ | ✅ |
| Keeps drivers | ❌ | ✅ |
| Silent OOBE | ❌ | ✅ |
| Works from hidden partition | ❌ | ✅ |
| OEM-style experience | ❌ | ✅ |

---

## Architecture Overview

### How It Works

```text
CREATING THE RECOVERY IMAGE:

┌─────────────────┐     VSS Snapshot     ┌──────────────────┐
│  C:\ (live OS)  │ ──────────────────→  │ Shadow Copy      │
│  Files locked   │                      │ No locks ✅      │
└─────────────────┘                      └────────┬─────────┘
                                                  │
                                           DISM /Capture
                                                  │
                                         ┌────────▼─────────┐
                                         │ Recovery Partition│
                                         │ install.wim      │
                                         │ unattend.xml     │
                                         │ restore.cmd      │
                                         └──────────────────┘

RESTORING THE SYSTEM:

┌─────────────────┐
│ Boot to WinRE   │
│ (SHIFT+Restart) │
└────────┬────────┘
         │
         ▼
┌───────────────────────────────┐
│ CMD Prompt                    |
|   Diskpart                    │
| list vol                      |
|check for the vol name recovery|
|Select that volume             |
|Assign Letter R                |
|CD R:\RecoveryImage            |
│ Run restore.cmd               │
└────────┬──────────────────────┘
         │
         ▼
┌─────────────────────────────────────────┐
│ restore.cmd:                             │
│ 1. Scan all drives for install.wim       │
│ 2. Format C:                             │
│ 3. DISM /Apply-Image to C:\              │
│ 4. Rebuild bootloader                    │
│ 5. Apply unattend.xml                    │
│ 6. Re-hide recovery partition            │
│ 7. Reboot → Windows ready!               │
└──────────────────────────────────────────┘

File Structure

Recovery Partition (hidden):
└── RecoveryImage/
    ├── install.wim           ← Full system image (15-40 GB)
    ├── unattend.xml          ← Silent OOBE configuration
    ├── restore.cmd           ← Interactive factory reset
    ├── diagnose.cmd          ← Safe pre-restore testing
    ├── quick_restore.cmd     ← Automated (no prompts)
    ├── recovery_metadata.txt ← Partition info reference
    └── INSTRUCTIONS.txt      ← Human-readable guide

Desktop (on C:):
├── Factory Reset.bat                 ← Double-click launcher
├── FactoryReset_Launcher.ps1        ← PowerShell confirmation
└── Factory Reset - Instructions.txt ← Restore guide

Prerequisites

System Requirements

• Windows 11 (any edition)
• Administrator privileges
• All desired applications and drivers installed
• At least 30-50 GB free space for recovery partition
• UEFI boot mode (not Legacy BIOS)

Before You Begin

1. Install all applications and drivers
2. Configure all settings
3. Run Windows Update
4. Clean up temp files (Disk Cleanup)
5. Restart the PC for a clean state

Phase 1: Create the Recovery Partition

Before running the script, create a partition manually:

Step 1: Open Disk Management

Win + X → Disk Management

Step 2: Shrink C: Drive

1. Right-click C: → "Shrink Volume"
2. Enter amount: 30000-50000 MB (30-50 GB)
   (Should be ~70% of your used space on C:)
3. Click "Shrink"

Step 3: Create New Volume

1. Right-click the new "Unallocated" space
2. "New Simple Volume"
3. Wizard:
   - Use all available space
   - Assign letter: R
   - Format: NTFS
   - Volume Label: Recovery
4. Click "Finish"

You should now see a Recovery (R:) drive in File Explorer.

Phase 2: The PowerShell Script

How the Script Works

The PowerShell script automates 4 steps:

Key Technical Decisions

Why VSS Shadow Copy?

You cannot capture a live Windows drive — files are locked by the OS:

Direct DISM on C:\ → ERROR 0x80070020 (Sharing Violation)

VSS creates a frozen point-in-time snapshot that DISM can capture without any file locks.

# Create shadow copy
$result = (Get-WmiObject -List Win32_ShadowCopy).Create("C:\", "ClientAccessible")

# Mount it
cmd /c "mklink /d C:\ShadowCopyMount \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\"

# Capture from snapshot (no locks!)
DISM.exe /Capture-Image /ImageFile:R:\RecoveryImage\install.wim `
         /CaptureDir:C:\ShadowCopyMount /Name:"Recovery" /Compress:maximum

Why Not “Reset this PC” with reagentc?

reagentc /setosimage → "Reset this PC" → Windows RECONSTRUCTS the OS
                                        → Win32 apps are STRIPPED OUT ❌

DISM /Apply-Image → Writes image BYTE-FOR-BYTE back to disk
                  → EVERYTHING preserved ✅

Why Hardcoded Paths in restore.cmd?

WinRE has a stripped-down cmd.exe that doesn’t support EnableDelayedExpansion:

:: BROKEN in WinRE:
setlocal EnableDelayedExpansion
set WIM=R:\RecoveryImage\install.wim
DISM.exe /ImageFile:"!WIM!"          ← Expands to "" → Error 87

:: WORKS in WinRE:
DISM.exe /ImageFile:R:\RecoveryImage\install.wim    ← Hardcoded, always works

Why Scan All Drive Letters?

WinRE reassigns drive letters differently than normal Windows:

Normal Windows:     WinRE:
  C: = Windows        C: = Windows (usually)
  R: = Recovery        D: = Recovery (auto-assigned!)
                       R: = nothing

The restore script scans every letter before resorting to diskpart:

if exist D:\RecoveryImage\install.wim set RECOVERY_DRIVE=D:& goto FOUND
if exist E:\RecoveryImage\install.wim set RECOVERY_DRIVE=E:& goto FOUND
...
:: If none found, mount via diskpart with known disk/partition numbers

Why ping Instead of timeout?

timeout.exe doesn’t exist in WinRE:

timeout /t 3 /nobreak > nul    ← ERROR in WinRE
ping -n 4 127.0.0.1 > nul      ← Works everywhere (3 second delay)

Why Separate DiskPart Calls for Re-hide?

Combining all operations in one script causes cascading failures:

:: BROKEN: If "remove letter" fails, set id and gpt also fail
select partition 5
remove letter=R          ← fails if letter isn't R
set id=de94bba4...       ← skipped!
gpt attributes=0x80...   ← skipped!

:: FIXED: Each operation is independent
:: Call 1:
select partition 5
remove                   ← removes whatever letter is assigned
exit

:: Call 2:
select partition 5
set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac override
exit

:: Call 3:
select partition 5
gpt attributes=0x8000000000000001
exit

The Complete Script

Save as Create-RecoveryPartition.ps1 and run as Administrator:

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Windows 11 Recovery Partition Creator — Final Version
    
.DESCRIPTION
    All fixes included:
    - VSS Shadow Copy for WIM capture
    - Hardcoded DISM paths (no variables, no delayed expansion)
    - ping instead of timeout (WinRE compatible)
    - Separate diskpart calls for re-hide
    - Full logging to C:\temp\restore_log.txt
    - Unattend.xml for silent OOBE
    - Hidden partition support
    - Desktop shortcuts

.NOTES
    Run as Administrator
    Requires existing recovery partition (create in Disk Management first)
#>

# ============================================================
# CONFIGURATION
# ============================================================
$RecoveryDriveLetter = ""
$RecoveryFolderName  = "RecoveryImage"
$RecoveryVolumeLabel = "Recovery"
$ImageName           = "Windows11CustomRecovery"
$ImageDescription    = "FullSystemWithAppsAndDrivers"
$CompressionType     = "maximum"
$LogFile             = "$env:USERPROFILE\Desktop\RecoverySetup_Log.txt"
$ShadowMountPoint    = "C:\ShadowCopyMount"

# ============================================================
# LOGGING
# ============================================================

function Write-Log {
    param([string]$Message, [string]$Level = "INFO")
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $logEntry  = "[$timestamp] [$Level] $Message"
    switch ($Level) {
        "INFO"    { Write-Host $logEntry -ForegroundColor Cyan }
        "SUCCESS" { Write-Host $logEntry -ForegroundColor Green }
        "WARNING" { Write-Host $logEntry -ForegroundColor Yellow }
        "ERROR"   { Write-Host $logEntry -ForegroundColor Red }
        "STEP"    {
            Write-Host ""
            Write-Host ("=" * 70) -ForegroundColor Magenta
            Write-Host "  $Message" -ForegroundColor Magenta
            Write-Host ("=" * 70) -ForegroundColor Magenta
        }
    }
    Add-Content -Path $LogFile -Value $logEntry
}

function Show-Banner {
    Clear-Host
    Write-Host ""
    Write-Host "  ╔════════════════════════════════════════════════════════════╗" -ForegroundColor Cyan
    Write-Host "  ║  Windows 11 - Recovery Partition Creator (Final)           ║" -ForegroundColor Cyan
    Write-Host "  ║  Full System Restore — Apps + Drivers + Settings           ║" -ForegroundColor Cyan
    Write-Host "  ║  WinRE Compatible — Logging — Hidden Partition Support    ║" -ForegroundColor Cyan
    Write-Host "  ╚════════════════════════════════════════════════════════════╝" -ForegroundColor Cyan
    Write-Host ""
}

# ============================================================
# PARTITION SELECTION & PREREQUISITES
# ============================================================

function Show-AvailablePartitions {
    $volumes = Get-Volume | Where-Object {
        $_.DriveLetter -and $_.DriveType -eq 'Fixed' -and $_.DriveLetter -ne 'C'
    } | Sort-Object DriveLetter

    if ($volumes.Count -eq 0) {
        Write-Log "No suitable partitions found!" "ERROR"
        Write-Host ""
        Write-Host "  Create a recovery partition first:" -ForegroundColor Yellow
        Write-Host "  1. Win+X → Disk Management" -ForegroundColor White
        Write-Host "  2. Shrink C: by 30-50 GB" -ForegroundColor White
        Write-Host "  3. Create New Simple Volume (NTFS, label: Recovery)" -ForegroundColor White
        Write-Host ""
        return $null
    }

    Write-Host "  Available Drives:" -ForegroundColor Yellow
    Write-Host "  ────────────────────────────────────────────────────────" -ForegroundColor Gray
    foreach ($vol in $volumes) {
        $sizeGB = [math]::Round($vol.Size / 1GB, 2)
        $freeGB = [math]::Round($vol.SizeRemaining / 1GB, 2)
        $label  = if ($vol.FileSystemLabel) { $vol.FileSystemLabel } else { "No Label" }
        Write-Host ("  [{0}:]  {1,-20}  Total: {2,8} GB  |  Free: {3,8} GB" -f
            $vol.DriveLetter, $label, $sizeGB, $freeGB) -ForegroundColor White
    }
    Write-Host "  ────────────────────────────────────────────────────────" -ForegroundColor Gray
    Write-Host ""
    return $volumes
}

function Get-RecoveryDrive {
    $volumes = Show-AvailablePartitions
    if ($null -eq $volumes) { return $null }
    do {
        $inputDrive = Read-Host "  Enter Recovery partition drive letter (e.g., R, D, E)"
        $inputDrive = $inputDrive.Trim().ToUpper().TrimEnd(':')
        $selectedVol = $volumes | Where-Object { $_.DriveLetter -eq $inputDrive }
        if (-not $selectedVol) { Write-Log "Invalid drive letter. Try again." "WARNING" }
    } while (-not $selectedVol)
    return "${inputDrive}:"
}

function Test-Prerequisites {
    param([string]$RecoveryDrive)

    Write-Log "Running prerequisite checks..." "INFO"
    Write-Host ""
    $allPassed = $true

    # Admin check
    $identity  = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($identity)
    if ($principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
        Write-Host "  [✓] Administrator privileges" -ForegroundColor Green
    } else {
        Write-Host "  [✗] Administrator privileges" -ForegroundColor Red
        $allPassed = $false
    }

    # DISM check
    if (Test-Path "$env:SystemRoot\System32\Dism.exe") {
        Write-Host "  [✓] DISM.exe found" -ForegroundColor Green
    } else {
        Write-Host "  [✗] DISM.exe not found" -ForegroundColor Red
        $allPassed = $false
    }

    # Recovery drive check
    if (Test-Path "$RecoveryDrive\") {
        Write-Host "  [✓] Recovery drive ($RecoveryDrive) accessible" -ForegroundColor Green
    } else {
        Write-Host "  [✗] Recovery drive ($RecoveryDrive) not accessible" -ForegroundColor Red
        $allPassed = $false
    }

    # VSS check
    $vssSvc = Get-Service -Name VSS -ErrorAction SilentlyContinue
    if ($vssSvc) {
        Write-Host "  [✓] VSS Service available ($($vssSvc.Status))" -ForegroundColor Green
    } else {
        Write-Host "  [✗] VSS Service not found" -ForegroundColor Red
        $allPassed = $false
    }

    # Free space check
    $recVol = Get-Volume -DriveLetter ($RecoveryDrive.TrimEnd(':')) -ErrorAction SilentlyContinue
    $srcVol = Get-Volume -DriveLetter 'C' -ErrorAction SilentlyContinue
    if ($recVol -and $srcVol) {
        $usedGB     = [math]::Round(($srcVol.Size - $srcVol.SizeRemaining) / 1GB, 2)
        $requiredGB = [math]::Round($usedGB * 0.7, 2)
        $freeGB     = [math]::Round($recVol.SizeRemaining / 1GB, 2)
        if ($freeGB -ge $requiredGB) {
            Write-Host "  [✓] Free space OK (Need ~${requiredGB}GB, Have ${freeGB}GB)" -ForegroundColor Green
        } else {
            Write-Host "  [✗] Insufficient space (Need ~${requiredGB}GB, Have ${freeGB}GB)" -ForegroundColor Red
            $allPassed = $false
        }
        Write-Host "  [i] C: used space: ${usedGB} GB" -ForegroundColor Gray
    }

    Write-Host ""
    return $allPassed
}

# ============================================================
# VSS SHADOW COPY
# ============================================================

function New-ShadowCopy {
    Write-Log "Creating VSS Shadow Copy of C: drive..." "INFO"

    Start-Service VSS -ErrorAction SilentlyContinue
    Start-Service swprv -ErrorAction SilentlyContinue
    Start-Sleep -Seconds 3

    try {
        $result = (Get-WmiObject -List Win32_ShadowCopy).Create("C:\", "ClientAccessible")

        if ($result.ReturnValue -ne 0) {
            Write-Log "Shadow copy failed with code: $($result.ReturnValue)" "ERROR"
            return $null
        }

        $shadowID   = $result.ShadowID
        $shadowCopy = Get-WmiObject Win32_ShadowCopy | Where-Object { $_.ID -eq $shadowID }
        $shadowPath = $shadowCopy.DeviceObject

        Write-Log "Shadow copy created: $shadowPath" "SUCCESS"
        return @{
            ID         = $shadowID
            DevicePath = $shadowPath
        }
    }
    catch {
        Write-Log "Shadow copy exception: $_" "ERROR"
        return $null
    }
}

function Mount-ShadowCopy {
    param([string]$ShadowDevicePath, [string]$MountPoint)

    if (Test-Path $MountPoint) {
        cmd /c "rmdir `"$MountPoint`"" 2>$null
    }

    $deviceWithSlash = $ShadowDevicePath
    if (-not $deviceWithSlash.EndsWith('\')) {
        $deviceWithSlash += '\'
    }

    cmd /c "mklink /d `"$MountPoint`" `"$deviceWithSlash`"" 2>&1 | Out-Null

    if ((Test-Path $MountPoint) -and (Get-ChildItem $MountPoint -ErrorAction SilentlyContinue)) {
        Write-Log "Shadow copy mounted at $MountPoint" "SUCCESS"
        return $true
    }

    Write-Log "Shadow copy mount failed!" "ERROR"
    return $false
}

function Remove-ShadowCopyAndMount {
    param([string]$ShadowID, [string]$MountPoint)

    if (Test-Path $MountPoint) {
        cmd /c "rmdir `"$MountPoint`"" 2>$null
    }

    if ($ShadowID) {
        try {
            $shadow = Get-WmiObject Win32_ShadowCopy | Where-Object { $_.ID -eq $ShadowID }
            if ($shadow) { $shadow.Delete() }
            Write-Log "Shadow copy cleaned up." "SUCCESS"
        }
        catch {
            Write-Log "Shadow cleanup warning: $_" "WARNING"
        }
    }
}

# ============================================================
# STEP 1: CAPTURE WIM IMAGE
# ============================================================

function Invoke-Step1_CaptureWIM {
    param(
        [string]$RecoveryDrive,
        [string]$FolderName,
        [string]$Name,
        [string]$Description,
        [string]$Compression
    )

    Write-Log "STEP 1: CAPTURE WIM IMAGE (via VSS Shadow Copy)" "STEP"

    $recoveryPath = Join-Path $RecoveryDrive $FolderName
    $wimFile      = Join-Path $recoveryPath "install.wim"
    $shadowInfo   = $null

    try {
        # Create folder
        if (-not (Test-Path $recoveryPath)) {
            New-Item -Path $recoveryPath -ItemType Directory -Force | Out-Null
            Write-Log "Created folder: $recoveryPath" "INFO"
        }

        # Check existing WIM
        if (Test-Path $wimFile) {
            $fileSize = [math]::Round((Get-Item $wimFile).Length / 1GB, 2)
            Write-Host ""
            Write-Host "  ⚠  Existing WIM found: $wimFile ($fileSize GB)" -ForegroundColor Yellow
            $overwrite = Read-Host "  Overwrite? (Y/N)"
            if ($overwrite -ne 'Y' -and $overwrite -ne 'y') {
                Write-Log "Using existing WIM file." "WARNING"
                return @{ Success = $true; WimFile = $wimFile; Skipped = $true }
            }
            Remove-Item $wimFile -Force
        }

        # Create shadow copy
        $shadowInfo = New-ShadowCopy
        if ($null -eq $shadowInfo) {
            return @{ Success = $false; WimFile = $null; Skipped = $false }
        }

        # Mount shadow copy
        $mounted = Mount-ShadowCopy -ShadowDevicePath $shadowInfo.DevicePath -MountPoint $ShadowMountPoint
        if (-not $mounted) {
            return @{ Success = $false; WimFile = $null; Skipped = $false }
        }

        # Capture
        Write-Host ""
        Write-Host "  ⏳ Capturing image... This takes 20-60 minutes." -ForegroundColor Yellow
        Write-Host "  ⚠  Do NOT restart or shut down your PC." -ForegroundColor Yellow
        Write-Host ""

        $startTime = Get-Date

        $batchFile = "$env:TEMP\dism_capture.cmd"
        @"
@echo off
DISM.exe /Capture-Image /ImageFile:"$wimFile" /CaptureDir:"$ShadowMountPoint" /Name:"$Name" /Description:"$Description" /Compress:$Compression
exit /b %errorlevel%
"@ | Out-File -FilePath $batchFile -Encoding ASCII -Force

        $proc = Start-Process -FilePath "cmd.exe" `
                              -ArgumentList "/c `"$batchFile`"" `
                              -NoNewWindow -Wait -PassThru

        $duration = (Get-Date) - $startTime
        Remove-Item $batchFile -Force -ErrorAction SilentlyContinue

        if ($proc.ExitCode -eq 0 -and (Test-Path $wimFile)) {
            $wimSize = [math]::Round((Get-Item $wimFile).Length / 1GB, 2)

            Write-Host ""
            Write-Host "  ┌──────────────────────────────────────────────────┐" -ForegroundColor Green
            Write-Host "  │  ✅ CAPTURE SUCCESSFUL!                           │" -ForegroundColor Green
            Write-Host "  │  File     : $wimFile" -ForegroundColor Green
            Write-Host "  │  Size     : $wimSize GB" -ForegroundColor Green
            Write-Host "  │  Duration : $($duration.ToString('hh\:mm\:ss'))" -ForegroundColor Green
            Write-Host "  └──────────────────────────────────────────────────┘" -ForegroundColor Green
            Write-Host ""

            # Verify
            Write-Log "Verifying captured image..." "INFO"
            & DISM.exe /Get-ImageInfo /ImageFile:"$wimFile"

            return @{ Success = $true; WimFile = $wimFile; Skipped = $false }
        }
        else {
            Write-Log "DISM capture FAILED! Exit code: $($proc.ExitCode)" "ERROR"
            Write-Host "  Check DISM log: notepad C:\Windows\Logs\DISM\dism.log" -ForegroundColor Yellow
            return @{ Success = $false; WimFile = $null; Skipped = $false }
        }
    }
    catch {
        Write-Log "Exception during capture: $_" "ERROR"
        return @{ Success = $false; WimFile = $null; Skipped = $false }
    }
    finally {
        # Always clean up shadow copy
        Write-Log "Cleaning up shadow copy..." "INFO"
        if ($shadowInfo) {
            Remove-ShadowCopyAndMount -ShadowID $shadowInfo.ID -MountPoint $ShadowMountPoint
        }
        elseif (Test-Path $ShadowMountPoint) {
            cmd /c "rmdir `"$ShadowMountPoint`"" 2>$null
        }
    }
}

# ============================================================
# STEP 1.5: UNATTEND.XML GENERATION
# ============================================================

function Get-CurrentSystemLocale {
    $culture  = Get-Culture
    $uiLang   = Get-WinSystemLocale
    $timezone = (Get-TimeZone).Id
    $keyboard = (Get-WinUserLanguageList)[0].InputMethodTips[0]
    $kbLayout = if ($keyboard) { $keyboard } else { "0409:00000409" }

    return @{
        SystemLocale = $uiLang.Name
        UILanguage   = $culture.Name
        UserLocale   = $culture.Name
        InputLocale  = $kbLayout
        TimeZone     = $timezone
        LanguageName = $culture.DisplayName
    }
}

function Get-UnattendSettings {
    Write-Log "STEP 1.5: CONFIGURE SILENT OOBE (unattend.xml)" "STEP"

    $currentLocale = Get-CurrentSystemLocale

    Write-Host ""
    Write-Host "  ── Detected System Settings ──" -ForegroundColor Yellow
    Write-Host "    Language  : $($currentLocale.LanguageName)" -ForegroundColor Gray
    Write-Host "    Locale    : $($currentLocale.SystemLocale)" -ForegroundColor Gray
    Write-Host "    Keyboard  : $($currentLocale.InputLocale)" -ForegroundColor Gray
    Write-Host "    Time Zone : $($currentLocale.TimeZone)" -ForegroundColor Gray
    Write-Host ""

    $useCurrentLocale = Read-Host "  Use current region/keyboard/language? (Y/N) [Y]"
    if ([string]::IsNullOrEmpty($useCurrentLocale)) { $useCurrentLocale = 'Y' }

    if ($useCurrentLocale -eq 'Y' -or $useCurrentLocale -eq 'y') {
        $locale      = $currentLocale.SystemLocale
        $uiLanguage  = $currentLocale.UILanguage
        $userLocale  = $currentLocale.UserLocale
        $inputLocale = $currentLocale.InputLocale
        $timeZone    = $currentLocale.TimeZone
    }
    else {
        Write-Host "  Common codes: en-US, fr-FR, de-DE, es-ES, nl-NL, pt-BR, ja-JP" -ForegroundColor Gray
        $locale      = Read-Host "  System Locale (e.g., fr-FR)"
        $uiLanguage  = Read-Host "  UI Language (e.g., fr-FR)"
        $userLocale  = Read-Host "  User Locale (e.g., fr-FR)"
        $inputLocale = Read-Host "  Keyboard (e.g., 040c:0000040c for French)"
        $timeZone    = Read-Host "  Time Zone (e.g., Romance Standard Time)"
    }

    Write-Host ""
    Write-Host "  ── Local User Account ──" -ForegroundColor Yellow

    $currentUser = $env:USERNAME
    $username    = Read-Host "  Username [$currentUser]"
    if ([string]::IsNullOrEmpty($username)) { $username = $currentUser }

    $password    = Read-Host "  Password (leave blank for no password)"
    $hasPassword = -not [string]::IsNullOrEmpty($password)

    $isAdmin     = Read-Host "  Make Administrator? (Y/N) [Y]"
    if ([string]::IsNullOrEmpty($isAdmin)) { $isAdmin = 'Y' }
    $groupName   = if ($isAdmin -eq 'Y' -or $isAdmin -eq 'y') { "Administrators" } else { "Users" }

    $currentPC    = $env:COMPUTERNAME
    $computerName = Read-Host "  Computer Name [$currentPC]"
    if ([string]::IsNullOrEmpty($computerName)) { $computerName = $currentPC }

    $autoLogon = Read-Host "  Auto-login after restore? (Y/N) [Y]"
    if ([string]::IsNullOrEmpty($autoLogon)) { $autoLogon = 'Y' }

    # Summary
    Write-Host ""
    Write-Host "  ┌──────────────────────────────────────────────────┐" -ForegroundColor White
    Write-Host "  │  Locale     : $locale" -ForegroundColor White
    Write-Host "  │  Keyboard   : $inputLocale" -ForegroundColor White
    Write-Host "  │  Time Zone  : $timeZone" -ForegroundColor White
    Write-Host "  │  Username   : $username" -ForegroundColor White
    Write-Host "  │  Password   : $(if ($hasPassword) {'****'} else {'(none)'})" -ForegroundColor White
    Write-Host "  │  Admin      : $groupName" -ForegroundColor White
    Write-Host "  │  PC Name    : $computerName" -ForegroundColor White
    Write-Host "  │  Auto-login : $autoLogon" -ForegroundColor White
    Write-Host "  └──────────────────────────────────────────────────┘" -ForegroundColor White
    Write-Host ""

    $confirm = Read-Host "  Confirm these settings? (Y/N)"
    if ($confirm -ne 'Y' -and $confirm -ne 'y') { return $null }

    return @{
        Locale       = $locale
        UILanguage   = $uiLanguage
        UserLocale   = $userLocale
        InputLocale  = $inputLocale
        TimeZone     = $timeZone
        Username     = $username
        Password     = $password
        HasPassword  = $hasPassword
        GroupName    = $groupName
        ComputerName = $computerName
        AutoLogon    = ($autoLogon -eq 'Y' -or $autoLogon -eq 'y')
    }
}

function New-UnattendXml {
    param([hashtable]$S)

    $arch = if ([Environment]::Is64BitOperatingSystem) { "amd64" } else { "x86" }

    $passwordBlock = if ($S.HasPassword) {
        $encodedPwd = [Convert]::ToBase64String(
            [System.Text.Encoding]::Unicode.GetBytes($S.Password + "Password")
        )
        "<Password><Value>$encodedPwd</Value><PlainText>false</PlainText></Password>"
    } else {
        "<Password><Value></Value><PlainText>true</PlainText></Password>"
    }

    $autoLogonBlock = ""
    if ($S.AutoLogon) {
        $autoLogonBlock = @"
                <AutoLogon>
                    <Enabled>true</Enabled>
                    <Username>$($S.Username)</Username>
                    <Password>
                        <Value>$($S.Password)</Value>
                        <PlainText>true</PlainText>
                    </Password>
                    <LogonCount>3</LogonCount>
                </AutoLogon>
"@
    }

    return @"
<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend"
          xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
    <settings pass="specialize">
        <component name="Microsoft-Windows-Shell-Setup"
                   processorArchitecture="$arch"
                   publicKeyToken="31bf3856ad364e35"
                   language="neutral" versionScope="nonSxS">
            <ComputerName>$($S.ComputerName)</ComputerName>
        </component>
        <component name="Microsoft-Windows-Deployment"
                   processorArchitecture="$arch"
                   publicKeyToken="31bf3856ad364e35"
                   language="neutral" versionScope="nonSxS">
            <RunSynchronous>
                <RunSynchronousCommand wcm:action="add">
                    <Order>1</Order>
                    <Path>reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v BypassNRO /t REG_DWORD /d 1 /f</Path>
                </RunSynchronousCommand>
            </RunSynchronous>
        </component>
    </settings>
    <settings pass="oobeSystem">
        <component name="Microsoft-Windows-International-Core"
                   processorArchitecture="$arch"
                   publicKeyToken="31bf3856ad364e35"
                   language="neutral" versionScope="nonSxS">
            <InputLocale>$($S.InputLocale)</InputLocale>
            <SystemLocale>$($S.Locale)</SystemLocale>
            <UILanguage>$($S.UILanguage)</UILanguage>
            <UILanguageFallback>en-US</UILanguageFallback>
            <UserLocale>$($S.UserLocale)</UserLocale>
        </component>
        <component name="Microsoft-Windows-Shell-Setup"
                   processorArchitecture="$arch"
                   publicKeyToken="31bf3856ad364e35"
                   language="neutral" versionScope="nonSxS">
            <OOBE>
                <HideEULAPage>true</HideEULAPage>
                <HideLocalAccountScreen>true</HideLocalAccountScreen>
                <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
                <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
                <NetworkLocation>Work</NetworkLocation>
                <ProtectYourPC>3</ProtectYourPC>
                <SkipMachineOOBE>true</SkipMachineOOBE>
                <SkipUserOOBE>true</SkipUserOOBE>
            </OOBE>
            <TimeZone>$($S.TimeZone)</TimeZone>
            <UserAccounts>
                <LocalAccounts>
                    <LocalAccount wcm:action="add">
                        <Name>$($S.Username)</Name>
                        <Group>$($S.GroupName)</Group>
                        <DisplayName>$($S.Username)</DisplayName>
                        $passwordBlock
                    </LocalAccount>
                </LocalAccounts>
            </UserAccounts>
$autoLogonBlock
            <FirstLogonCommands>
                <SynchronousCommand wcm:action="add">
                    <Order>1</Order>
                    <CommandLine>reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f</CommandLine>
                    <RequiresUserInput>false</RequiresUserInput>
                </SynchronousCommand>
                <SynchronousCommand wcm:action="add">
                    <Order>2</Order>
                    <CommandLine>reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE" /v DisablePrivacyExperience /t REG_DWORD /d 1 /f</CommandLine>
                    <RequiresUserInput>false</RequiresUserInput>
                </SynchronousCommand>
            </FirstLogonCommands>
        </component>
    </settings>
</unattend>
"@
}

function Save-UnattendXml {
    param([string]$RecoveryPath, [hashtable]$Settings)

    if ($null -eq $Settings) {
        Write-Log "Unattend configuration skipped." "WARNING"
        return
    }

    $xml = New-UnattendXml -S $Settings
    $unattendFile = Join-Path $RecoveryPath "unattend.xml"
    $xml | Out-File -FilePath $unattendFile -Encoding UTF8 -Force
    Write-Log "Saved: $unattendFile" "SUCCESS"
}

# ============================================================
# STEP 2: CREATE RECOVERY SCRIPTS
# ════════════════════════════════════════════════════════════
# Key design:
# - NO setlocal EnableDelayedExpansion
# - NO !variables! in any DISM/diskpart commands
# - ALL paths hardcoded at generation time
# - ping instead of timeout (WinRE compatible)
# - Separate diskpart calls for re-hide
# - Full logging to C:\temp\restore_log.txt
# ============================================================

function Invoke-Step2_CreateRecoveryScripts {
    param(
        [string]$RecoveryDrive,
        [string]$RecoveryPath,
        [string]$WimFile
    )

    Write-Log "STEP 2: CREATE RECOVERY SCRIPTS" "STEP"

    $diskNumber = (Get-Partition -DriveLetter C).DiskNumber
    $cPartNum   = (Get-Partition -DriveLetter C).PartitionNumber
    $partitions = Get-Partition -DiskNumber $diskNumber
    $efiPart    = $partitions | Where-Object {
        $_.Type -eq 'System' -or $_.GptType -eq '{c12a7328-f81f-11d2-ba4b-00a0c93ec93b}'
    }
    $efiPartNum = if ($efiPart) { $efiPart.PartitionNumber } else { 1 }

    $recDriveLetter = $RecoveryDrive.TrimEnd(':')
    $recPartition   = Get-Partition -DriveLetter $recDriveLetter
    $recPartNum     = $recPartition.PartitionNumber
    $recDiskNum     = $recPartition.DiskNumber
    $osPartSize     = [math]::Round((Get-Partition -DriveLetter C).Size / 1GB, 0)

    Write-Host ""
    Write-Host "  ── Partition Layout ──" -ForegroundColor Yellow
    Write-Host "    OS Disk       : $diskNumber, Partition $cPartNum (C:)" -ForegroundColor Gray
    Write-Host "    EFI           : $diskNumber, Partition $efiPartNum" -ForegroundColor Gray
    Write-Host "    Recovery      : $recDiskNum, Partition $recPartNum" -ForegroundColor Gray
    Write-Host ""

    # ════════════════════════════════════════════════════════
    #  RESTORE.CMD
    #
    #  Fix: Scans ALL drive letters first to find install.wim
    #  Only uses diskpart if WIM not found on any letter
    # ════════════════════════════════════════════════════════

    $restoreScript = @"
@echo off
cls
color 1F

mkdir C:\temp 2>nul

echo ================================================== > C:\temp\restore_log.txt
echo  FACTORY RESET LOG >> C:\temp\restore_log.txt
echo  Started: %date% %time% >> C:\temp\restore_log.txt
echo ================================================== >> C:\temp\restore_log.txt

echo.
echo  ========================================================
echo   FACTORY RESET - FULL SYSTEM RESTORE
echo   All data on C: will be PERMANENTLY DELETED!
echo   Log: C:\temp\restore_log.txt
echo  ========================================================
echo.

if /i "%1"=="AUTO" goto SKIP_CONFIRM

echo  Type YES to confirm factory reset:
set /p CONFIRM=
if /i not "%CONFIRM%"=="YES" (
    echo  Cancelled.
    echo  [%time%] Cancelled >> C:\temp\restore_log.txt
    pause
    exit /b 0
)

:SKIP_CONFIRM
echo  [%time%] Confirmed >> C:\temp\restore_log.txt

REM ──────────────────────────────────────────────────────
REM  STEP 1/6: FIND the recovery image
REM
REM  Method A: Scan all existing drive letters (D-Z)
REM            WinRE may have already assigned a letter
REM  Method B: Use diskpart to mount known partition as R:
REM            For when partition is truly hidden
REM ──────────────────────────────────────────────────────

echo.
echo  [1/6] Searching for recovery image...
echo.
echo  [%time%] STEP 1: Finding recovery image >> C:\temp\restore_log.txt

set RECOVERY_DRIVE=
set WIM_FOUND=0

REM ── Method A: Scan all existing drive letters ──
echo  Scanning all drive letters...
echo  [%time%] Scanning drive letters A-Z >> C:\temp\restore_log.txt

if exist C:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=C:
    set WIM_FOUND=1
    echo  Found on C:
    echo  [%time%] Found on C: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist D:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=D:
    set WIM_FOUND=1
    echo  Found on D:
    echo  [%time%] Found on D: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist E:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=E:
    set WIM_FOUND=1
    echo  Found on E:
    echo  [%time%] Found on E: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist F:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=F:
    set WIM_FOUND=1
    echo  Found on F:
    echo  [%time%] Found on F: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist G:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=G:
    set WIM_FOUND=1
    echo  Found on G:
    echo  [%time%] Found on G: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist H:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=H:
    set WIM_FOUND=1
    echo  Found on H:
    echo  [%time%] Found on H: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist I:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=I:
    set WIM_FOUND=1
    echo  Found on I:
    echo  [%time%] Found on I: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist J:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=J:
    set WIM_FOUND=1
    echo  Found on J:
    echo  [%time%] Found on J: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist K:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=K:
    set WIM_FOUND=1
    echo  Found on K:
    echo  [%time%] Found on K: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist L:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=L:
    set WIM_FOUND=1
    echo  Found on L:
    echo  [%time%] Found on L: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist M:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=M:
    set WIM_FOUND=1
    echo  Found on M:
    echo  [%time%] Found on M: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist N:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=N:
    set WIM_FOUND=1
    echo  Found on N:
    echo  [%time%] Found on N: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist O:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=O:
    set WIM_FOUND=1
    echo  Found on O:
    echo  [%time%] Found on O: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist P:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=P:
    set WIM_FOUND=1
    echo  Found on P:
    echo  [%time%] Found on P: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist Q:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=Q:
    set WIM_FOUND=1
    echo  Found on Q:
    echo  [%time%] Found on Q: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist R:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=R:
    set WIM_FOUND=1
    echo  Found on R:
    echo  [%time%] Found on R: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist S:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=S:
    set WIM_FOUND=1
    echo  Found on S:
    echo  [%time%] Found on S: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist T:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=T:
    set WIM_FOUND=1
    echo  Found on T:
    echo  [%time%] Found on T: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist U:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=U:
    set WIM_FOUND=1
    echo  Found on U:
    echo  [%time%] Found on U: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist V:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=V:
    set WIM_FOUND=1
    echo  Found on V:
    echo  [%time%] Found on V: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist W:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=W:
    set WIM_FOUND=1
    echo  Found on W:
    echo  [%time%] Found on W: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist X:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=X:
    set WIM_FOUND=1
    echo  Found on X:
    echo  [%time%] Found on X: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist Y:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=Y:
    set WIM_FOUND=1
    echo  Found on Y:
    echo  [%time%] Found on Y: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)
if exist Z:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=Z:
    set WIM_FOUND=1
    echo  Found on Z:
    echo  [%time%] Found on Z: >> C:\temp\restore_log.txt
    goto FOUND_WIM
)

REM ── Method B: Not found on any letter — mount via diskpart ──
echo.
echo  Not found on any lettered drive.
echo  Mounting hidden partition (Disk $recDiskNum, Part $recPartNum) as R: ...
echo  [%time%] Not on any letter. Trying diskpart mount... >> C:\temp\restore_log.txt

(
echo select disk $recDiskNum
echo select partition $recPartNum
echo assign letter=R
echo exit
) > %TEMP%\dp_mount.txt

diskpart /s %TEMP%\dp_mount.txt >> C:\temp\restore_log.txt 2>&1
echo  [%time%] diskpart mount exit: %errorlevel% >> C:\temp\restore_log.txt
del %TEMP%\dp_mount.txt 2>nul

ping -n 5 127.0.0.1 > nul

if exist R:\$RecoveryFolderName\install.wim (
    set RECOVERY_DRIVE=R:
    set WIM_FOUND=1
    echo  Found after diskpart mount on R:
    echo  [%time%] Found on R: after diskpart >> C:\temp\restore_log.txt
    goto FOUND_WIM
)

REM ── ALL METHODS FAILED ──
echo.
echo  ════════════════════════════════════════════════════
echo   ERROR: Recovery image not found anywhere!
echo  ════════════════════════════════════════════════════
echo.
echo  [%time%] FATAL: Recovery image not found! >> C:\temp\restore_log.txt
echo  [%time%] Dumping volume list: >> C:\temp\restore_log.txt
(echo list volume
echo exit) > %TEMP%\dp_dbg.txt
diskpart /s %TEMP%\dp_dbg.txt >> C:\temp\restore_log.txt 2>&1
diskpart /s %TEMP%\dp_dbg.txt
del %TEMP%\dp_dbg.txt 2>nul
echo.
echo  Check log: C:\temp\restore_log.txt
pause
exit /b 1

:FOUND_WIM
echo.
echo  Recovery drive : %RECOVERY_DRIVE%
echo  Image file     : %RECOVERY_DRIVE%\$RecoveryFolderName\install.wim
echo.
echo  [%time%] Using drive: %RECOVERY_DRIVE% >> C:\temp\restore_log.txt

REM ──────────────────────────────────────────────────────
REM  STEP 2/6: Format C:
REM ──────────────────────────────────────────────────────

echo  [2/6] Formatting C: drive...
echo.
echo  [%time%] STEP 2: Formatting C: >> C:\temp\restore_log.txt

REM ── Save log before format ──
mkdir %RECOVERY_DRIVE%\temp 2>nul
copy /y C:\temp\restore_log.txt %RECOVERY_DRIVE%\temp\restore_log.txt > nul 2>nul

format C: /FS:NTFS /Q /Y /V:Windows
set FMT_ERR=%errorlevel%

REM ── Restore log after format ──
mkdir C:\temp 2>nul
copy /y %RECOVERY_DRIVE%\temp\restore_log.txt C:\temp\restore_log.txt > nul 2>nul
echo  [%time%] format exit: %FMT_ERR% >> C:\temp\restore_log.txt

if %FMT_ERR% neq 0 (
    echo  format.exe failed, using diskpart...
    echo  [%time%] format failed, trying diskpart >> C:\temp\restore_log.txt

    (
    echo select disk $diskNumber
    echo select partition $cPartNum
    echo format fs=ntfs quick label=Windows
    echo assign letter=C
    echo exit
    ) > %TEMP%\dp_fmt.txt

    diskpart /s %TEMP%\dp_fmt.txt >> C:\temp\restore_log.txt 2>&1
    del %TEMP%\dp_fmt.txt 2>nul

    mkdir C:\temp 2>nul
    copy /y %RECOVERY_DRIVE%\temp\restore_log.txt C:\temp\restore_log.txt > nul 2>nul
)

echo  C: formatted.
echo  [%time%] Format done >> C:\temp\restore_log.txt

REM ──────────────────────────────────────────────────────
REM  STEP 3/6: Apply recovery image
REM
REM  Uses %RECOVERY_DRIVE% which was set during scan.
REM  This is a SIMPLE %var% — works fine in basic cmd.exe
REM  (only !var! delayed expansion is broken in WinRE)
REM ──────────────────────────────────────────────────────

echo.
echo  [3/6] Applying recovery image (15-30 minutes)...
echo  DO NOT turn off your computer!
echo.
echo  [%time%] STEP 3: Applying image >> C:\temp\restore_log.txt
echo  [%time%] Source: %RECOVERY_DRIVE%\$RecoveryFolderName\install.wim >> C:\temp\restore_log.txt

DISM.exe /Apply-Image /ImageFile:%RECOVERY_DRIVE%\$RecoveryFolderName\install.wim /Index:1 /ApplyDir:C:\
set DISM_ERR=%errorlevel%
echo  [%time%] DISM exit: %DISM_ERR% >> C:\temp\restore_log.txt

if %DISM_ERR% neq 0 (
    echo.
    echo  Attempt 1 failed (code: %DISM_ERR%).
    echo  Trying without trailing backslash...
    echo  [%time%] Trying /ApplyDir:C: >> C:\temp\restore_log.txt

    DISM.exe /Apply-Image /ImageFile:%RECOVERY_DRIVE%\$RecoveryFolderName\install.wim /Index:1 /ApplyDir:C:
    set DISM_ERR2=%errorlevel%
    echo  [%time%] DISM attempt 2 exit: %DISM_ERR2% >> C:\temp\restore_log.txt

    if %DISM_ERR2% neq 0 (
        echo.
        echo  ALL DISM ATTEMPTS FAILED!
        echo  [%time%] ALL DISM FAILED >> C:\temp\restore_log.txt
        echo.
        echo  Source: %RECOVERY_DRIVE%\$RecoveryFolderName\install.wim
        echo  Target: C:\
        echo  Log: C:\temp\restore_log.txt
        pause
        exit /b 1
    )
)

echo.
echo  Image applied successfully!
echo  [%time%] Image applied OK >> C:\temp\restore_log.txt

REM ──────────────────────────────────────────────────────
REM  STEP 4/6: Rebuild boot
REM ──────────────────────────────────────────────────────

echo.
echo  [4/6] Rebuilding boot configuration...
echo.
echo  [%time%] STEP 4: Boot config >> C:\temp\restore_log.txt

(
echo select disk $diskNumber
echo select partition $efiPartNum
echo assign letter=S
echo exit
) > %TEMP%\dp_efi.txt

diskpart /s %TEMP%\dp_efi.txt >> C:\temp\restore_log.txt 2>&1
del %TEMP%\dp_efi.txt 2>nul

ping -n 3 127.0.0.1 > nul

echo  [%time%] bcdboot C:\Windows /s S: /f UEFI >> C:\temp\restore_log.txt
bcdboot C:\Windows /s S: /f UEFI >> C:\temp\restore_log.txt 2>&1
set BCD_ERR=%errorlevel%
echo  [%time%] bcdboot exit: %BCD_ERR% >> C:\temp\restore_log.txt

if %BCD_ERR% neq 0 (
    echo  [%time%] Trying without /s S: >> C:\temp\restore_log.txt
    bcdboot C:\Windows /f UEFI >> C:\temp\restore_log.txt 2>&1
)

(
echo select disk $diskNumber
echo select partition $efiPartNum
echo remove letter=S
echo exit
) > %TEMP%\dp_efi2.txt

diskpart /s %TEMP%\dp_efi2.txt >> C:\temp\restore_log.txt 2>&1
del %TEMP%\dp_efi2.txt 2>nul

echo  Boot rebuilt.
echo  [%time%] Boot done >> C:\temp\restore_log.txt

REM ──────────────────────────────────────────────────────
REM  STEP 5/6: Unattend.xml
REM ──────────────────────────────────────────────────────

echo.
echo  [5/6] Applying unattend.xml...
echo.
echo  [%time%] STEP 5: Unattend >> C:\temp\restore_log.txt

if exist %RECOVERY_DRIVE%\$RecoveryFolderName\unattend.xml (
    echo  [%time%] unattend.xml found >> C:\temp\restore_log.txt

    mkdir C:\Windows\Panther\unattend 2>nul
    mkdir C:\Windows\System32\Sysprep 2>nul

    copy /y %RECOVERY_DRIVE%\$RecoveryFolderName\unattend.xml C:\Windows\Panther\unattend\unattend.xml >> C:\temp\restore_log.txt 2>&1
    copy /y %RECOVERY_DRIVE%\$RecoveryFolderName\unattend.xml C:\Windows\Panther\unattend.xml >> C:\temp\restore_log.txt 2>&1
    copy /y %RECOVERY_DRIVE%\$RecoveryFolderName\unattend.xml C:\Windows\System32\Sysprep\unattend.xml >> C:\temp\restore_log.txt 2>&1

    reg load HKLM\OFFLINE_SW C:\Windows\System32\config\SOFTWARE >> C:\temp\restore_log.txt 2>&1
    reg add "HKLM\OFFLINE_SW\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f >> C:\temp\restore_log.txt 2>&1
    reg add "HKLM\OFFLINE_SW\Policies\Microsoft\Windows\OOBE" /v DisablePrivacyExperience /t REG_DWORD /d 1 /f >> C:\temp\restore_log.txt 2>&1
    reg unload HKLM\OFFLINE_SW >> C:\temp\restore_log.txt 2>&1

    echo  Unattend.xml applied.
    echo  [%time%] Unattend OK >> C:\temp\restore_log.txt
) else (
    echo  No unattend.xml found.
    echo  [%time%] No unattend.xml >> C:\temp\restore_log.txt
)

REM ──────────────────────────────────────────────────────
REM  STEP 6/6: Re-hide recovery partition
REM  Separate diskpart calls for reliability
REM ──────────────────────────────────────────────────────

echo.
echo  [6/6] Re-hiding recovery partition...
echo.
echo  [%time%] STEP 6: Re-hide >> C:\temp\restore_log.txt

REM ── 6a: Remove whatever letter recovery has ──
echo  [%time%] 6a: Removing recovery drive letter >> C:\temp\restore_log.txt

(
echo select disk $recDiskNum
echo select partition $recPartNum
echo remove
echo exit
) > %TEMP%\dp_rh1.txt

diskpart /s %TEMP%\dp_rh1.txt >> C:\temp\restore_log.txt 2>&1
echo  [%time%] Remove letter exit: %errorlevel% >> C:\temp\restore_log.txt
del %TEMP%\dp_rh1.txt 2>nul

ping -n 3 127.0.0.1 > nul

REM ── 6b: Set partition type ──
echo  [%time%] 6b: Setting partition type >> C:\temp\restore_log.txt

(
echo select disk $recDiskNum
echo select partition $recPartNum
echo set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac override
echo exit
) > %TEMP%\dp_rh2.txt

diskpart /s %TEMP%\dp_rh2.txt >> C:\temp\restore_log.txt 2>&1
echo  [%time%] Set type exit: %errorlevel% >> C:\temp\restore_log.txt
del %TEMP%\dp_rh2.txt 2>nul

ping -n 3 127.0.0.1 > nul

REM ── 6c: Set GPT attributes ──
echo  [%time%] 6c: Setting GPT attributes >> C:\temp\restore_log.txt

(
echo select disk $recDiskNum
echo select partition $recPartNum
echo gpt attributes=0x8000000000000001
echo exit
) > %TEMP%\dp_rh3.txt

diskpart /s %TEMP%\dp_rh3.txt >> C:\temp\restore_log.txt 2>&1
echo  [%time%] Set GPT exit: %errorlevel% >> C:\temp\restore_log.txt
del %TEMP%\dp_rh3.txt 2>nul

echo  Re-hide complete.
echo  [%time%] Re-hide done >> C:\temp\restore_log.txt

REM ── Verify ──
echo  [%time%] Final volume list: >> C:\temp\restore_log.txt
(echo list volume
echo exit) > %TEMP%\dp_vfy.txt
diskpart /s %TEMP%\dp_vfy.txt >> C:\temp\restore_log.txt 2>&1
del %TEMP%\dp_vfy.txt 2>nul

REM ──────────────────────────────────────────────────────
REM  DONE
REM ──────────────────────────────────────────────────────

echo. >> C:\temp\restore_log.txt
echo ================================================== >> C:\temp\restore_log.txt
echo  COMPLETED: %date% %time% >> C:\temp\restore_log.txt
echo ================================================== >> C:\temp\restore_log.txt

echo.
echo  ========================================================
echo.
echo   FACTORY RESET COMPLETE!
echo   All applications, drivers, and settings restored.
echo   Log: C:\temp\restore_log.txt
echo.
echo   Restarting in 15 seconds...
echo.
echo  ========================================================
echo.

echo  15...
ping -n 4 127.0.0.1 > nul
echo  12...
ping -n 4 127.0.0.1 > nul
echo  8...
ping -n 5 127.0.0.1 > nul
echo  3...
ping -n 4 127.0.0.1 > nul

wpeutil reboot
"@

    # ════════════════════════════════════════════════════════
    #  DIAGNOSE.CMD
    # ════════════════════════════════════════════════════════

    $diagnoseScript = @"
@echo off
cls
color 1F

mkdir C:\temp 2>nul

echo RECOVERY DIAGNOSTICS LOG > C:\temp\diagnose_log.txt
echo %date% %time% >> C:\temp\diagnose_log.txt

echo.
echo  ========================================================
echo   RECOVERY DIAGNOSTICS (safe - no changes)
echo   Log: C:\temp\diagnose_log.txt
echo  ========================================================
echo.

echo  ── Current volumes ──
echo.
(echo list volume
echo exit) > %TEMP%\dd1.txt
diskpart /s %TEMP%\dd1.txt
diskpart /s %TEMP%\dd1.txt >> C:\temp\diagnose_log.txt 2>&1
del %TEMP%\dd1.txt 2>nul

echo.
echo  ── Partitions on Disk $diskNumber ──
echo.
(echo select disk $diskNumber
echo list partition
echo exit) > %TEMP%\dd2.txt
diskpart /s %TEMP%\dd2.txt
diskpart /s %TEMP%\dd2.txt >> C:\temp\diagnose_log.txt 2>&1
del %TEMP%\dd2.txt 2>nul

echo.
echo  ── Expected layout ──
echo    Windows  : Disk $diskNumber, Partition $cPartNum (C:)
echo    EFI      : Disk $diskNumber, Partition $efiPartNum
echo    Recovery : Disk $recDiskNum, Partition $recPartNum

echo.
echo  ── Scanning ALL drives for install.wim ──
echo.
echo  Scanning... >> C:\temp\diagnose_log.txt

if exist C:\$RecoveryFolderName\install.wim echo  FOUND on C:
if exist D:\$RecoveryFolderName\install.wim echo  FOUND on D:
if exist E:\$RecoveryFolderName\install.wim echo  FOUND on E:
if exist F:\$RecoveryFolderName\install.wim echo  FOUND on F:
if exist G:\$RecoveryFolderName\install.wim echo  FOUND on G:
if exist H:\$RecoveryFolderName\install.wim echo  FOUND on H:
if exist I:\$RecoveryFolderName\install.wim echo  FOUND on I:
if exist J:\$RecoveryFolderName\install.wim echo  FOUND on J:
if exist K:\$RecoveryFolderName\install.wim echo  FOUND on K:
if exist R:\$RecoveryFolderName\install.wim echo  FOUND on R:

echo.
echo  ── Trying diskpart mount (Disk $recDiskNum, Part $recPartNum as R:) ──
echo.
(echo select disk $recDiskNum
echo select partition $recPartNum
echo assign letter=R
echo exit) > %TEMP%\dd3.txt
diskpart /s %TEMP%\dd3.txt >> C:\temp\diagnose_log.txt 2>&1
del %TEMP%\dd3.txt 2>nul

ping -n 5 127.0.0.1 > nul

if exist R:\$RecoveryFolderName\install.wim (
    echo  FOUND on R: after diskpart mount
    DISM.exe /Get-ImageInfo /ImageFile:R:\$RecoveryFolderName\install.wim
) else (
    echo  NOT FOUND on R: after mount
    echo  R: contents:
    dir R:\ 2>nul
)

echo.
echo  ── Cleanup ──
(echo select disk $recDiskNum
echo select partition $recPartNum
echo remove
echo exit) > %TEMP%\dd4.txt
diskpart /s %TEMP%\dd4.txt >> C:\temp\diagnose_log.txt 2>&1
del %TEMP%\dd4.txt 2>nul

echo.
echo  ========================================================
echo   DONE. Log: C:\temp\diagnose_log.txt
echo.
echo   restore.cmd will auto-find the WIM on any drive letter.
echo   Just run: [drive]:\$RecoveryFolderName\restore.cmd
echo  ========================================================
echo.
pause
"@

    # ════════════════════════════════════════════════════════
    #  QUICK_RESTORE.CMD
    # ════════════════════════════════════════════════════════

    $quickRestoreScript = @"
@echo off
cls
mkdir C:\temp 2>nul
echo QUICK RESTORE %date% %time% > C:\temp\quick_restore_log.txt

echo  AUTOMATED FACTORY RESET...

set RECOVERY_DRIVE=
set WIM_FOUND=0

REM ── Scan all letters ──
if exist C:\$RecoveryFolderName\install.wim set RECOVERY_DRIVE=C:& set WIM_FOUND=1& goto QF
if exist D:\$RecoveryFolderName\install.wim set RECOVERY_DRIVE=D:& set WIM_FOUND=1& goto QF
if exist E:\$RecoveryFolderName\install.wim set RECOVERY_DRIVE=E:& set WIM_FOUND=1& goto QF
if exist F:\$RecoveryFolderName\install.wim set RECOVERY_DRIVE=F:& set WIM_FOUND=1& goto QF
if exist G:\$RecoveryFolderName\install.wim set RECOVERY_DRIVE=G:& set WIM_FOUND=1& goto QF
if exist H:\$RecoveryFolderName\install.wim set RECOVERY_DRIVE=H:& set WIM_FOUND=1& goto QF
if exist R:\$RecoveryFolderName\install.wim set RECOVERY_DRIVE=R:& set WIM_FOUND=1& goto QF

REM ── Diskpart mount ──
(echo select disk $recDiskNum
echo select partition $recPartNum
echo assign letter=R
echo exit) > %TEMP%\qm.txt
diskpart /s %TEMP%\qm.txt >> C:\temp\quick_restore_log.txt 2>&1
del %TEMP%\qm.txt 2>nul
ping -n 5 127.0.0.1 > nul

if exist R:\$RecoveryFolderName\install.wim set RECOVERY_DRIVE=R:& set WIM_FOUND=1& goto QF

echo FATAL: Not found! >> C:\temp\quick_restore_log.txt
echo FATAL: Recovery image not found!
pause
exit /b 1

:QF
echo  Found on %RECOVERY_DRIVE% >> C:\temp\quick_restore_log.txt

mkdir %RECOVERY_DRIVE%\temp 2>nul
copy /y C:\temp\quick_restore_log.txt %RECOVERY_DRIVE%\temp\quick_restore_log.txt > nul 2>nul

format C: /FS:NTFS /Q /Y /V:Windows

if errorlevel 1 (
    (echo select disk $diskNumber
    echo select partition $cPartNum
    echo format fs=ntfs quick label=Windows
    echo assign letter=C
    echo exit) > %TEMP%\qf.txt
    diskpart /s %TEMP%\qf.txt > nul 2>&1
    del %TEMP%\qf.txt 2>nul
)

mkdir C:\temp 2>nul
copy /y %RECOVERY_DRIVE%\temp\quick_restore_log.txt C:\temp\quick_restore_log.txt > nul 2>nul

DISM.exe /Apply-Image /ImageFile:%RECOVERY_DRIVE%\$RecoveryFolderName\install.wim /Index:1 /ApplyDir:C:\

if errorlevel 1 (
    DISM.exe /Apply-Image /ImageFile:%RECOVERY_DRIVE%\$RecoveryFolderName\install.wim /Index:1 /ApplyDir:C:
    if errorlevel 1 (
        echo DISM FAILED! >> C:\temp\quick_restore_log.txt
        echo CRITICAL: DISM failed!
        pause
        exit /b 1
    )
)

(echo select disk $diskNumber
echo select partition $efiPartNum
echo assign letter=S
echo exit) > %TEMP%\qe.txt
diskpart /s %TEMP%\qe.txt > nul 2>&1
del %TEMP%\qe.txt 2>nul
ping -n 3 127.0.0.1 > nul

bcdboot C:\Windows /s S: /f UEFI > nul 2>&1

if exist %RECOVERY_DRIVE%\$RecoveryFolderName\unattend.xml (
    mkdir C:\Windows\Panther\unattend 2>nul
    copy /y %RECOVERY_DRIVE%\$RecoveryFolderName\unattend.xml C:\Windows\Panther\unattend\unattend.xml
    copy /y %RECOVERY_DRIVE%\$RecoveryFolderName\unattend.xml C:\Windows\Panther\unattend.xml
    copy /y %RECOVERY_DRIVE%\$RecoveryFolderName\unattend.xml C:\Windows\System32\Sysprep\unattend.xml
    reg load HKLM\OFFLINE_SW C:\Windows\System32\config\SOFTWARE 2>nul
    reg add "HKLM\OFFLINE_SW\Microsoft\Windows\CurrentVersion\OOBE" /v BypassNRO /t REG_DWORD /d 1 /f 2>nul
    reg add "HKLM\OFFLINE_SW\Policies\Microsoft\Windows\OOBE" /v DisablePrivacyExperience /t REG_DWORD /d 1 /f 2>nul
    reg unload HKLM\OFFLINE_SW 2>nul
)

(echo select disk $diskNumber
echo select partition $efiPartNum
echo remove letter=S
echo exit) > %TEMP%\qe2.txt
diskpart /s %TEMP%\qe2.txt > nul 2>&1
del %TEMP%\qe2.txt 2>nul
ping -n 3 127.0.0.1 > nul

(echo select disk $recDiskNum
echo select partition $recPartNum
echo remove
echo exit) > %TEMP%\qr1.txt
diskpart /s %TEMP%\qr1.txt > nul 2>&1
del %TEMP%\qr1.txt 2>nul
ping -n 3 127.0.0.1 > nul

(echo select disk $recDiskNum
echo select partition $recPartNum
echo set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac override
echo exit) > %TEMP%\qr2.txt
diskpart /s %TEMP%\qr2.txt > nul 2>&1
del %TEMP%\qr2.txt 2>nul
ping -n 3 127.0.0.1 > nul

(echo select disk $recDiskNum
echo select partition $recPartNum
echo gpt attributes=0x8000000000000001
echo exit) > %TEMP%\qr3.txt
diskpart /s %TEMP%\qr3.txt > nul 2>&1
del %TEMP%\qr3.txt 2>nul

echo COMPLETE >> C:\temp\quick_restore_log.txt
wpeutil reboot
"@

    # ── Save ──
    $restoreScript      | Out-File (Join-Path $RecoveryPath "restore.cmd") -Encoding ASCII -Force
    $diagnoseScript     | Out-File (Join-Path $RecoveryPath "diagnose.cmd") -Encoding ASCII -Force
    $quickRestoreScript | Out-File (Join-Path $RecoveryPath "quick_restore.cmd") -Encoding ASCII -Force

    @"
Recovery Partition Metadata
===========================
Created       : $(Get-Date)
OS Disk       : $diskNumber
OS Partition  : $cPartNum (C:, ~${osPartSize} GB)
EFI Partition : $efiPartNum
Recovery Disk : $recDiskNum
Recovery Part : $recPartNum
Folder        : $RecoveryFolderName

How restore.cmd finds the image:
  1. Scans ALL drive letters C: through Z:
  2. If not found, mounts Disk $recDiskNum Part $recPartNum as R:
  3. Uses whichever letter has the WIM

Re-hide uses separate diskpart calls:
  Step 1: remove (letter)
  Step 2: set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac
  Step 3: gpt attributes=0x8000000000000001
"@ | Out-File (Join-Path $RecoveryPath "recovery_metadata.txt") -Encoding ASCII -Force

    Write-Log "Created: restore.cmd" "SUCCESS"
    Write-Log "Created: diagnose.cmd" "SUCCESS"
    Write-Log "Created: quick_restore.cmd" "SUCCESS"

    Write-Host ""
    Write-Host "  ┌──────────────────────────────────────────────────────────┐" -ForegroundColor Green
    Write-Host "  │  ✅ Recovery Scripts Created                              │" -ForegroundColor Green
    Write-Host "  │                                                            │" -ForegroundColor Green
    Write-Host "  │  Image search order:                                       │" -ForegroundColor Green
    Write-Host "  │  1. Scan ALL drive letters (C: through Z:)                │" -ForegroundColor Green
    Write-Host "  │  2. Diskpart mount Disk $recDiskNum Part $recPartNum as R:" -ForegroundColor Green
    Write-Host "  │  3. Use whichever letter has install.wim                  │" -ForegroundColor Green
    Write-Host "  │                                                            │" -ForegroundColor Green
    Write-Host "  │  Works whether partition is D:, R:, or hidden!            │" -ForegroundColor Green
    Write-Host "  └──────────────────────────────────────────────────────────┘" -ForegroundColor Green

    return $true
}

# ============================================================
# STEP 3: CREATE DESKTOP SHORTCUTS
# ============================================================

function Invoke-Step3_CreateShortcuts {
    param(
        [string]$RecoveryDrive,
        [string]$RecoveryPath
    )

    Write-Log "STEP 3: CREATE DESKTOP SHORTCUTS" "STEP"

    $recPartition = Get-Partition -DriveLetter ($RecoveryDrive.TrimEnd(':'))
    $recPartNum   = $recPartition.PartitionNumber
    $recDiskNum   = $recPartition.DiskNumber

    $createShortcut = Read-Host "  Create desktop shortcuts? (Y/N) [Y]"
    if ([string]::IsNullOrEmpty($createShortcut)) { $createShortcut = 'Y' }

    if ($createShortcut -ne 'Y' -and $createShortcut -ne 'y') {
        Write-Log "Desktop shortcuts skipped." "INFO"
        return $true
    }

    # ── PowerShell Launcher ──
    $launcherPS = @"
#Requires -RunAsAdministrator
Add-Type -AssemblyName System.Windows.Forms

`$msg = "WARNING: This will ERASE ALL DATA on C: and restore the factory image with all original apps and drivers.`n`nALL personal files will be DELETED.`n`nProceed?"
`$r = [System.Windows.Forms.MessageBox]::Show(`$msg, "FACTORY RESET", "YesNo", "Warning")

if (`$r -eq "Yes") {
    `$r2 = [System.Windows.Forms.MessageBox]::Show(
        "FINAL CONFIRMATION`n`nComputer will restart into recovery.`nEstimated time: 20-40 minutes.`n`nContinue?",
        "CONFIRM FACTORY RESET", "YesNo", "Stop")

    if (`$r2 -eq "Yes") {
        Write-Host "Preparing recovery environment..."
        reagentc /enable 2>`$null
        reagentc /boottore
        shutdown /r /t 5 /c "Restarting for Factory Reset..."
    }
}
"@

    # ── Batch Wrapper (auto-elevates) ──
    $batchWrapper = @"
@echo off
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo Requesting administrator privileges...
    powershell -Command "Start-Process cmd -ArgumentList '/c cd /d \"%~dp0\" && powershell -ExecutionPolicy Bypass -File \"%~dp0FactoryReset_Launcher.ps1\"' -Verb RunAs"
    exit /b
)
powershell -ExecutionPolicy Bypass -File "%~dp0FactoryReset_Launcher.ps1"
"@

    # ── Instructions ──
    $instructions = @"
FACTORY RESET INSTRUCTIONS
===========================

AUTOMATIC (Windows boots normally):
  1. Double-click "Factory Reset.bat" on Desktop
  2. Confirm twice
  3. PC restarts into recovery mode
  4. In recovery CMD, mount R: and run restore:
     diskpart
     select disk $recDiskNum
     select partition $recPartNum
     assign letter=R
     exit
     R:\$RecoveryFolderName\restore.cmd

MANUAL (SHIFT + Restart):
  1. Hold SHIFT + click Restart
  2. Troubleshoot → Command Prompt
  3. Run the diskpart + restore commands above

USB BOOT (Windows won't start):
  1. Boot from Windows 11 USB
  2. Repair → Command Prompt
  3. Run the diskpart + restore commands above

DIAGNOSTICS (safe test first):
  Mount R: then run: R:\$RecoveryFolderName\diagnose.cmd

LOG FILES:
  C:\temp\restore_log.txt   (after restore)
  C:\temp\diagnose_log.txt  (after diagnostics)

PARTITION INFO:
  Recovery: Disk $recDiskNum, Partition $recPartNum
"@

    # ── Save files ──
    $desktop = "$env:USERPROFILE\Desktop"

    $launcherPS   | Out-File "$desktop\FactoryReset_Launcher.ps1" -Encoding UTF8 -Force
    $batchWrapper | Out-File "$desktop\Factory Reset.bat" -Encoding ASCII -Force
    $instructions | Out-File "$desktop\Factory Reset - Instructions.txt" -Encoding UTF8 -Force
    $instructions | Out-File (Join-Path $RecoveryPath "INSTRUCTIONS.txt") -Encoding UTF8 -Force

    Write-Host "    ✓ Factory Reset.bat" -ForegroundColor Green
    Write-Host "    ✓ FactoryReset_Launcher.ps1" -ForegroundColor Green
    Write-Host "    ✓ Factory Reset - Instructions.txt" -ForegroundColor Green
    Write-Host "    ✓ INSTRUCTIONS.txt (on recovery partition)" -ForegroundColor Green

    Write-Log "Desktop shortcuts created." "SUCCESS"
    return $true
}

# ============================================================
# STEP 4: HIDE PARTITION (Optional)
# ============================================================

function Invoke-Step4_HidePartition {
    param([string]$RecoveryDrive)

    Write-Log "STEP 4: HIDE & PROTECT RECOVERY PARTITION" "STEP"

    $driveLetter = $RecoveryDrive.TrimEnd(':')

    # Find volume number
    $dpListFile = "$env:TEMP\dp_list.txt"
    "list volume" | Out-File -FilePath $dpListFile -Encoding ASCII
    $dpOutput = & diskpart /s $dpListFile 2>&1
    Remove-Item $dpListFile -Force -ErrorAction SilentlyContinue

    $volumeNumber = $null
    foreach ($line in $dpOutput) {
        if ($line -match "Volume\s+(\d+)\s+$driveLetter\s") {
            $volumeNumber = $Matches[1]
            break
        }
    }

    if ($null -eq $volumeNumber) {
        Write-Log "Could not find volume for ${driveLetter}:." "ERROR"
        return $false
    }

    Write-Host ""
    Write-Host "  This will:" -ForegroundColor Yellow
    Write-Host "    • Remove drive letter ${driveLetter}:" -ForegroundColor White
    Write-Host "    • Hide partition from File Explorer" -ForegroundColor White
    Write-Host "    • Set GPT recovery attributes" -ForegroundColor White
    Write-Host "    • Restore scripts will auto-mount it as R:" -ForegroundColor White
    Write-Host ""
    Write-Host "  Volume $volumeNumber = ${driveLetter}:" -ForegroundColor Cyan
    Write-Host ""

    $confirm = Read-Host "  Type 'HIDE' to proceed (anything else to cancel)"

    if ($confirm -eq 'HIDE') {
        # Separate operations for reliability

        # Remove letter
        $dp1 = @"
select volume $volumeNumber
remove letter=$driveLetter
exit
"@
        $dp1 | Out-File "$env:TEMP\dp_h1.txt" -Encoding ASCII
        & diskpart /s "$env:TEMP\dp_h1.txt"
        Remove-Item "$env:TEMP\dp_h1.txt" -Force -ErrorAction SilentlyContinue
        Start-Sleep -Seconds 2

        # Set partition type
        $dp2 = @"
select volume $volumeNumber
set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac override
exit
"@
        $dp2 | Out-File "$env:TEMP\dp_h2.txt" -Encoding ASCII
        & diskpart /s "$env:TEMP\dp_h2.txt"
        Remove-Item "$env:TEMP\dp_h2.txt" -Force -ErrorAction SilentlyContinue
        Start-Sleep -Seconds 2

        # Set GPT attributes
        $dp3 = @"
select volume $volumeNumber
gpt attributes=0x8000000000000001
exit
"@
        $dp3 | Out-File "$env:TEMP\dp_h3.txt" -Encoding ASCII
        & diskpart /s "$env:TEMP\dp_h3.txt"
        Remove-Item "$env:TEMP\dp_h3.txt" -Force -ErrorAction SilentlyContinue

        Write-Host ""
        Write-Host "  ┌──────────────────────────────────────────────────┐" -ForegroundColor Green
        Write-Host "  │  ✅ Partition hidden and protected!               │" -ForegroundColor Green
        Write-Host "  │                                                    │" -ForegroundColor Green
        Write-Host "  │  To unhide later:                                 │" -ForegroundColor Green
        Write-Host "  │  diskpart → list volume → select volume X →       │" -ForegroundColor Green
        Write-Host "  │  assign letter=R                                  │" -ForegroundColor Green
        Write-Host "  └──────────────────────────────────────────────────┘" -ForegroundColor Green

        Write-Log "Partition hidden successfully." "SUCCESS"
        return $true
    }

    Write-Log "Hide cancelled by user." "WARNING"
    return $false
}

# ============================================================
# MAIN
# ============================================================

function Main {
    "Recovery Setup Log (Final) - $(Get-Date)" | Out-File -FilePath $LogFile -Force

    Show-Banner

    # ── Admin check ──
    $identity  = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($identity)
    if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
        Write-Log "Must run as Administrator!" "ERROR"
        Write-Host "  Right-click PowerShell → Run as Administrator" -ForegroundColor Yellow
        Read-Host "  Press Enter to exit"
        exit 1
    }

    Write-Log "Running with Administrator privileges." "SUCCESS"

    # ── Select recovery drive ──
    if ([string]::IsNullOrEmpty($RecoveryDriveLetter)) {
        $RecoveryDriveLetter = Get-RecoveryDrive
        if ($null -eq $RecoveryDriveLetter) {
            Write-Log "No recovery partition selected. Exiting." "ERROR"
            Read-Host "  Press Enter to exit"
            exit 1
        }
    }

    Write-Log "Selected recovery drive: $RecoveryDriveLetter" "INFO"

    # ── Prerequisites ──
    if (-not (Test-Prerequisites -RecoveryDrive $RecoveryDriveLetter)) {
        Write-Log "Prerequisites FAILED. Fix issues above and re-run." "ERROR"
        Read-Host "  Press Enter to exit"
        exit 1
    }

    Write-Log "All prerequisites PASSED." "SUCCESS"

    # ── Confirm ──
    Write-Host ""
    Write-Host "  ┌──────────────────────────────────────────────────────────┐" -ForegroundColor Yellow
    Write-Host "  │  Process:                                                 │" -ForegroundColor Yellow
    Write-Host "  │                                                            │" -ForegroundColor Yellow
    Write-Host "  │  Step 1  : Capture WIM (VSS Shadow Copy)                  │" -ForegroundColor Yellow
    Write-Host "  │  Step 1.5: Generate unattend.xml (silent OOBE)            │" -ForegroundColor Yellow
    Write-Host "  │  Step 2  : Create restore scripts (WinRE-compatible)      │" -ForegroundColor Yellow
    Write-Host "  │  Step 3  : Desktop shortcuts                              │" -ForegroundColor Yellow
    Write-Host "  │  Step 4  : (Optional) Hide partition                      │" -ForegroundColor Yellow
    Write-Host "  │                                                            │" -ForegroundColor Yellow
    Write-Host "  │  ✅ All apps, drivers, settings preserved on restore      │" -ForegroundColor Yellow
    Write-Host "  │  ⏱  Estimated: 30-75 minutes                              │" -ForegroundColor Yellow
    Write-Host "  └──────────────────────────────────────────────────────────┘" -ForegroundColor Yellow
    Write-Host ""

    $proceed = Read-Host "  Proceed? (Y/N)"
    if ($proceed -ne 'Y' -and $proceed -ne 'y') {
        Write-Log "User cancelled." "WARNING"
        exit 0
    }

    $recoveryFolderPath = Join-Path $RecoveryDriveLetter $RecoveryFolderName

    # ═══════════════════════════════════
    #  STEP 1: Capture WIM
    # ═══════════════════════════════════
    $step1 = Invoke-Step1_CaptureWIM `
        -RecoveryDrive $RecoveryDriveLetter `
        -FolderName $RecoveryFolderName `
        -Name $ImageName `
        -Description $ImageDescription `
        -Compression $CompressionType

    if (-not $step1.Success) {
        Write-Log "Step 1 FAILED. Check DISM log." "ERROR"
        Write-Host "  notepad C:\Windows\Logs\DISM\dism.log" -ForegroundColor Yellow
        Read-Host "  Press Enter to exit"
        exit 1
    }

    # ═══════════════════════════════════
    #  STEP 1.5: Unattend.xml
    # ═══════════════════════════════════
    Write-Host ""
    $doUnattend = Read-Host "  Configure silent recovery (skip OOBE screens)? (Y/N) [Y]"
    if ([string]::IsNullOrEmpty($doUnattend)) { $doUnattend = 'Y' }

    if ($doUnattend -eq 'Y' -or $doUnattend -eq 'y') {
        $settings = Get-UnattendSettings
        Save-UnattendXml -RecoveryPath $recoveryFolderPath -Settings $settings
    }
    else {
        Write-Log "Unattend.xml skipped. OOBE screens will appear on restore." "INFO"
    }

    # ═══════════════════════════════════
    #  STEP 2: Recovery Scripts
    # ═══════════════════════════════════
    Invoke-Step2_CreateRecoveryScripts `
        -RecoveryDrive $RecoveryDriveLetter `
        -RecoveryPath $recoveryFolderPath `
        -WimFile $step1.WimFile

    # ═══════════════════════════════════
    #  STEP 3: Desktop Shortcuts
    # ═══════════════════════════════════
    Invoke-Step3_CreateShortcuts `
        -RecoveryDrive $RecoveryDriveLetter `
        -RecoveryPath $recoveryFolderPath

    # ═══════════════════════════════════
    #  STEP 4: Hide Partition
    # ═══════════════════════════════════
    Write-Host ""
    Write-Host "  ┌──────────────────────────────────────────────────────────┐" -ForegroundColor Cyan
    Write-Host "  │  Hide recovery partition?                                 │" -ForegroundColor Cyan
    Write-Host "  │                                                            │" -ForegroundColor Cyan
    Write-Host "  │  [Y] Production — hidden from Explorer, auto-mounted     │" -ForegroundColor Cyan
    Write-Host "  │  [N] Testing — keep visible for debugging                │" -ForegroundColor Cyan
    Write-Host "  └──────────────────────────────────────────────────────────┘" -ForegroundColor Cyan
    Write-Host ""

    $hide = Read-Host "  (Y/N)"
    if ($hide -eq 'Y' -or $hide -eq 'y') {
        Invoke-Step4_HidePartition -RecoveryDrive $RecoveryDriveLetter
    }
    else {
        Write-Log "Partition not hidden (testing mode)." "INFO"
    }

    # ═══════════════════════════════════
    #  COMPLETE
    # ═══════════════════════════════════
    Write-Host ""
    Write-Host "  ╔════════════════════════════════════════════════════════════╗" -ForegroundColor Green
    Write-Host "  ║  ✅  RECOVERY PARTITION SETUP COMPLETE!                    ║" -ForegroundColor Green
    Write-Host "  ╠════════════════════════════════════════════════════════════╣" -ForegroundColor Green
    Write-Host "  ║                                                            ║" -ForegroundColor Green
    Write-Host "  ║  Recovery Partition Contents:                               ║" -ForegroundColor Green
    Write-Host "  ║  ├── install.wim           (full system image)            ║" -ForegroundColor Green
    Write-Host "  ║  ├── unattend.xml          (silent OOBE)                  ║" -ForegroundColor Green
    Write-Host "  ║  ├── restore.cmd           (interactive restore + log)    ║" -ForegroundColor Green
    Write-Host "  ║  ├── diagnose.cmd          (safe testing)                 ║" -ForegroundColor Green
    Write-Host "  ║  ├── quick_restore.cmd     (automated)                    ║" -ForegroundColor Green
    Write-Host "  ║  ├── recovery_metadata.txt (partition info)               ║" -ForegroundColor Green
    Write-Host "  ║  └── INSTRUCTIONS.txt      (how to restore)              ║" -ForegroundColor Green
    Write-Host "  ║                                                            ║" -ForegroundColor Green
    Write-Host "  ║  Desktop Files:                                            ║" -ForegroundColor Green
    Write-Host "  ║  ├── Factory Reset.bat                                    ║" -ForegroundColor Green
    Write-Host "  ║  ├── FactoryReset_Launcher.ps1                            ║" -ForegroundColor Green
    Write-Host "  ║  └── Factory Reset - Instructions.txt                     ║" -ForegroundColor Green
    Write-Host "  ║                                                            ║" -ForegroundColor Green
    Write-Host "  ║  HOW TO RESTORE:                                           ║" -ForegroundColor Green
    Write-Host "  ║  1. SHIFT+Restart → Troubleshoot → CMD                    ║" -ForegroundColor Green
    Write-Host "  ║  2. Mount R: (diskpart commands in Instructions.txt)      ║" -ForegroundColor Green
    Write-Host "  ║  3. R:\$RecoveryFolderName\diagnose.cmd  (test first)"       -ForegroundColor Green
    Write-Host "  ║  4. R:\$RecoveryFolderName\restore.cmd   (restore)"          -ForegroundColor Green
    Write-Host "  ║                                                            ║" -ForegroundColor Green
    Write-Host "  ║  LOG FILES (after restore):                                ║" -ForegroundColor Green
    Write-Host "  ║  C:\temp\restore_log.txt                                  ║" -ForegroundColor Green
    Write-Host "  ║  C:\temp\diagnose_log.txt                                 ║" -ForegroundColor Green
    Write-Host "  ║                                                            ║" -ForegroundColor Green
    Write-Host "  ║  Setup log: $LogFile" -ForegroundColor Green
    Write-Host "  ║                                                            ║" -ForegroundColor Green
    Write-Host "  ╚════════════════════════════════════════════════════════════╝" -ForegroundColor Green
    Write-Host ""

    Write-Log "Setup completed successfully." "SUCCESS"
    Read-Host "  Press Enter to exit"
}

# ── Run ──
Main

Phase 3: How the Restore Scripts Work

How to Perform a Factory Reset

Method 1: From Windows (System Boots Normally)

1. Hold SHIFT + click "Restart"
2. Troubleshoot → Command Prompt
3. Mount the recovery partition:
   diskpart
   select disk 0
   select partition 5        ← your recovery partition number
   assign letter=R
   exit
4. Run: R:\RecoveryImage\restore.cmd

Method 2: From USB (Windows Won’t Boot)

1. Boot from Windows 11 installation USB
2. Click "Repair your computer"
3. Troubleshoot → Command Prompt
4. Same diskpart + restore commands as above

What restore.cmd Does

Step 1: FIND the recovery image
  ├── Scans C: through Z: for RecoveryImage\install.wim
  ├── If found (e.g., on D:) → uses that drive
  └── If not found → diskpart mounts known partition as R:

Step 2: FORMAT C: drive
  ├── format C: /FS:NTFS /Q /Y
  └── Fallback: diskpart format

Step 3: APPLY image
  └── DISM.exe /Apply-Image /ImageFile:[drive]:\RecoveryImage\install.wim
               /Index:1 /ApplyDir:C:\

Step 4: REBUILD boot
  ├── Assign S: to EFI partition
  ├── bcdboot C:\Windows /s S: /f UEFI
  └── Remove S:

Step 5: APPLY unattend.xml
  ├── Copy to C:\Windows\Panther\unattend\
  ├── Copy to C:\Windows\System32\Sysprep\
  └── Inject BypassNRO into offline registry

Step 6: RE-HIDE recovery partition
  ├── Call 1: remove (drive letter)
  ├── Call 2: set id=de94bba4... (recovery type)
  └── Call 3: gpt attributes=0x80... (protected)

Reboot → Windows starts → Silent OOBE → Desktop → Done!

Log Files

After a restore, check these logs:

Phase 4: Testing & Validation

Pre-Restore Test (Safe)

1. Boot into WinRE (SHIFT + Restart)
2. Command Prompt
3. Mount recovery partition
4. Run: R:\RecoveryImage\diagnose.cmd
   (Makes no changes — just verifies everything)

Post-Restore Verification Checklist

After restoring, verify:

[ ] Windows boots successfully
[ ] All applications are present (Start Menu)
[ ] All drivers work (Device Manager — no yellow triangles)
[ ] Network connectivity works
[ ] User account was auto-created (if unattend configured)
[ ] No OOBE setup screens appeared (if unattend configured)
[ ] C:\temp\restore_log.txt shows all steps succeeded
[ ] Recovery partition is hidden (not visible in Explorer)

Lessons Learned & Pitfalls

Pitfall 1: “ClientAccessible” Typo

❌ "ClientAccesible"  (one 's')  → VSS returns error 5
✅ "ClientAccessible" (two 's') → Works

Pitfall 2: DISM Error 0x80070020

❌ DISM /Capture-Image /CaptureDir:C:\  → Files locked by running OS
✅ VSS Shadow Copy → Mount → DISM captures from snapshot

Pitfall 3: “Reset this PC” Strips Apps

❌ reagentc /setosimage → "Reset this PC" → Apps removed
✅ DISM /Apply-Image → Byte-for-byte restore → Everything preserved

Pitfall 4: DISM Error 87 in WinRE

❌ setlocal EnableDelayedExpansion + !var! → Empty in WinRE
✅ Hardcoded paths, no delayed expansion

Pitfall 5: timeout Doesn’t Exist in WinRE

❌ timeout /t 3 /nobreak > nul → Command not found
✅ ping -n 4 127.0.0.1 > nul → 3-second delay

Pitfall 6: WinRE Reassigns Drive Letters

❌ Assume R: = Recovery → WinRE assigns D: instead
✅ Scan ALL letters C-Z first, then diskpart fallback

Pitfall 7: Combined DiskPart Re-hide Fails

❌ remove letter=R (fails if letter is D:) → set id skipped
✅ Separate calls: remove (no letter specified) → set id → gpt attributes

Pitfall 8: Log Lost When C: Formatted

❌ Log on C: → format C: → Log gone
✅ Copy log to recovery drive before format, restore after

FAQ

Q: How much space does the recovery partition need? A: About 70% of your used space on C:. If you have 40 GB used, you need ~28 GB for the WIM file. Plan for 30-50 GB.

Q: Can I update the recovery image later? A: Yes! Re-run the PowerShell script. When it asks about the existing WIM, choose “Y” to overwrite with a fresh capture.

Q: Does this work with BitLocker? A: You’ll need to suspend BitLocker before capturing and ensure the recovery environment can access the drives. The restore scripts don’t handle BitLocker decryption.

Q: Can I deploy this to multiple identical PCs? A: For multi-PC deployment, add Sysprep generalization before capture: C:\Windows\System32\Sysprep\sysprep.exe /generalize /oobe /shutdown Then boot from WinPE and capture.

Q: What if the recovery partition gets deleted? A: The WIM file is gone. Always keep a backup copy on an external drive. You can recreate the partition and re-run the script.

Q: Why not use WinPE USB for capture instead of VSS? A: You can! Boot from WinPE USB, then run: DISM /Capture-Image /ImageFile:R:\RecoveryImage\install.wim /CaptureDir:C:\ /Name:Recovery /Compress:maximum No file locks from WinPE. VSS is the “no reboot needed” alternative.

License

This script is provided as-is for educational purposes. Test thoroughly before deploying in production environments. Always maintain backups before performing system modifications.

How to Use This Blog Post

1. Copy everything between the outer ` markdown ` and ` ` tags
2. Paste into your blog editor (WordPress, Ghost, Hugo, Jekyll, etc.)
3. The code blocks inside will render correctly since they use indented fences
4. The complete PowerShell script is included inline — readers can copy-paste directly
5. All diagrams use ASCII art — no external images needed

Driver Update script

Driver update script thats called using Autounattended xml file

Driver update from Networkshare

Execution flow

flowchart TB
    START([🚀 Script Start]) --> INIT[Initialize-PersistentScript<br/>Copy script to C:\Temp\]
    INIT -->|Failed| FAIL_INIT([❌ Throw Error])
    INIT -->|Success| TRANSCRIPT[Start-Transcript<br/>C:\Temp\DriverUpdateScript.log]
    TRANSCRIPT --> HEADER[Display Header<br/>User, Computer, Model, Config]
    HEADER --> ORPHAN[Stop Orphan Driver Processes<br/>drvinst, pnputil, DPInst, etc.]
    ORPHAN --> LOADSTATE[Get-ScriptState<br/>Load or create state JSON]
    LOADSTATE --> SHOWSTATE[Display Current State<br/>All properties]
    SHOWSTATE --> CHECKPHASE{state.Phase?}

    %% ============================================================
    %% PHASE 0
    %% ============================================================
    CHECKPHASE -->|Phase 0| USB_CHECK{USBCompleted?}

    subgraph PHASE0A ["🔌 PHASE-0A: USB Network Drivers"]
        USB_CHECK -->|No| USB_FIND[Scan drives D: - Z:<br/>Look for DriversOS / Drivers folder]
        USB_FIND -->|Not Found| USB_SKIP[No USB folder found<br/>Skip USB phase]
        USB_FIND -->|Found| USB_INSTALL[Install-DriversFromFolder<br/>SkipDeviceMatching = TRUE<br/>Install ALL drivers from USB]
        USB_INSTALL --> USB_EACH[For each INF file:<br/>Install-SingleDriver<br/>pnputil /add-driver /install]
        USB_EACH --> USB_RESULT{NeedsReboot?}
        USB_RESULT -->|Yes| USB_REBOOT[Schedule-RebootAndContinue<br/>Set RunOnce registry<br/>Reboot in 15 seconds]
        USB_REBOOT --> REBOOT_USB([🔄 REBOOT])
        REBOOT_USB -.->|After reboot| USB_CHECK
        USB_RESULT -->|No| USB_DONE[USBCompleted = true<br/>USBRebootDone = true]
        USB_SKIP --> USB_DONE
    end

    USB_CHECK -->|Yes, not rebooted| USB_FINALIZE[Post-reboot:<br/>USB drivers finalized]
    USB_FINALIZE --> NET_CHECK
    USB_CHECK -->|Yes, rebooted| NET_CHECK
    USB_DONE --> NET_CHECK

    subgraph PHASE0B ["📡 PHASE-0B: Network Share Drivers"]
        NET_CHECK{NetworkShare<br/>Completed?}
        NET_CHECK -->|No| GUEST_CHECK{GuestAuth<br/>Configured?}

        subgraph GUESTAUTH ["🔓 SMB Guest Access Fix"]
            GUEST_CHECK -->|No| GUEST_POLICY[Create policy key if missing<br/>HKLM:\SOFTWARE\Policies\<br/>Microsoft\Windows\LanmanWorkstation]
            GUEST_POLICY --> GUEST_INSECURE[AllowInsecureGuestAuth = 1<br/>Policy + Service level]
            GUEST_INSECURE --> GUEST_SIGN1[RequireSecuritySignature = 0<br/>Disable 'always sign']
            GUEST_SIGN1 --> GUEST_SIGN2[EnableSecuritySignature = 0<br/>Disable 'sign if server agrees']
            GUEST_SIGN2 --> GUEST_RESTART[Restart LanmanWorkstation<br/>+ dependent services]
            GUEST_RESTART --> GUEST_VERIFY[Verify: Read back all 4 values<br/>Display OK/FAIL table]
            GUEST_VERIFY --> SYSINFO
        end

        GUEST_CHECK -->|Yes| SYSINFO

        subgraph MODELPATH ["🏷️ Model Detection & Path Building"]
            SYSINFO[Get-SystemInfo<br/>Manufacturer + Model]
            SYSINFO --> CLEANMODEL["Clean model name<br/>'Latitude 5400' → 'latitude5400'"]
            CLEANMODEL --> MFGFOLDER["Map manufacturer → folder<br/>'Dell Inc.' → 'dell'"]
            MFGFOLDER --> BUILDPATH["Build UNC path<br/>\\networkshare\dell\driver\latitude5400"]
        end

        BUILDPATH --> TESTSHARE[Test-NetworkShareAccess<br/>10 retries × 10s delay]
        TESTSHARE -->|Accessible| DEVSCAN
        TESTSHARE -->|Failed| TRYALT["Try alternative names:<br/>latitude-5400<br/>latitude_5400<br/>latitude 5400"]
        TRYALT -->|Found| DEVSCAN
        TRYALT -->|All failed| NET_NOTFOUND[No share folder found<br/>Skip network share phase]

        subgraph DEVMATCH ["🔍 Device Matching"]
            DEVSCAN[Get-SystemDeviceIds<br/>WMI Win32_PnPEntity<br/>Fallback: Get-PnpDevice]
            DEVSCAN --> MATCHINFS["For each INF:<br/>Parse [Manufacturer] + [Models]<br/>Extract hardware IDs"]
            MATCHINFS --> COMPARE["Compare INF IDs vs System IDs<br/>HashSet O(1) lookup"]
            COMPARE --> MATCHRESULT["Display results:<br/>Matched / Skipped / Mode"]
        end

        MATCHRESULT --> NETINSTALL[Install-DriversFromFolder<br/>Only MATCHED drivers]
        NETINSTALL --> NET_EACH["For each matched INF:<br/>Install-SingleDriver<br/>pnputil /add-driver /install<br/>Timeout monitoring<br/>Spinner animation"]
        NET_EACH --> NET_RESULT{NeedsReboot?}
        NET_RESULT -->|Yes| NET_REBOOT[Schedule-RebootAndContinue]
        NET_REBOOT --> REBOOT_NET([🔄 REBOOT])
        REBOOT_NET -.->|After reboot| NET_CHECK
        NET_RESULT -->|No| NET_DONE[NetworkShareCompleted = true<br/>Phase = 1]
        NET_NOTFOUND --> NET_DONE
    end

    NET_CHECK -->|Yes, not rebooted| NET_FINALIZE[Post-reboot:<br/>Share drivers finalized<br/>Phase = 1]
    NET_CHECK -->|Yes, rebooted| PHASE1_START
    NET_FINALIZE --> PHASE1_START
    NET_DONE --> PHASE1_START

    %% ============================================================
    %% PHASE 1
    %% ============================================================
    CHECKPHASE -->|Phase ≥ 1| PHASE1_START

    subgraph PHASE1 ["🌐 PHASE-1: Online OEM Updates"]
        PHASE1_START[PHASE 1: ONLINE OEM UPDATES]
        PHASE1_START --> INET[Test-InternetConnectivity<br/>15 retries × 10s delay<br/>HEAD https://google.com]
        INET -->|No Internet| INET_FAIL([❌ Exit 1<br/>No internet])
        INET -->|Connected| CHOCO

        subgraph CHOCO_SETUP ["🍫 Chocolatey Setup"]
            CHOCO[Install-ChocolateyIfNeeded]
            CHOCO --> CHOCO_SRC["Set-ChocolateySource<br/>Add: chocosia → choco.local.xyz.com<br/>Disable: default community source"]
        end

        CHOCO_SRC --> MFG_DETECT[Get-SystemManufacturer<br/>Win32_ComputerSystem]
        MFG_DETECT --> MFG_CHECK{Manufacturer?}

        subgraph DELL ["🖥️ Dell Updates"]
            MFG_CHECK -->|Dell| DELL_CLI[Locate dcu-cli.exe<br/>or install via Chocolatey]
            DELL_CLI -->|Not found| DELL_CHOCO["Install-ChocoPackage<br/>'dellcommandupdate'<br/>Invoke-CommandVerbose"]
            DELL_CLI -->|Found| DELL_PHASE
            DELL_CHOCO --> DELL_PHASE

            DELL_PHASE{ManufacturerPhase?}
            DELL_PHASE -->|0| DELL_ADR["Dell Phase-0: ADR<br/>Configure ADR enable<br/>dcu-cli /driverinstall<br/>Verbose output streaming"]
            DELL_ADR --> DELL_ADR_EXIT{Exit code?}
            DELL_ADR_EXIT -->|0, 3| DELL_P2
            DELL_ADR_EXIT -->|1, 5| DELL_ADR_REBOOT[Reboot required]
            DELL_ADR_REBOOT --> REBOOT_DELL([🔄 REBOOT])
            REBOOT_DELL -.-> DELL_PHASE
            DELL_ADR_EXIT -->|2, other| DELL_ADR_FAIL[ADR failed<br/>Skip to Phase-2]
            DELL_ADR_FAIL --> DELL_P2

            DELL_PHASE -->|1| DELL_SCAN["Dell Phase-1: Scan<br/>dcu-cli /scan"]
            DELL_SCAN --> DELL_P2

            DELL_P2["Dell Phase-2: Apply Updates<br/>dcu-cli /applyupdates<br/>-forceUpdate=enable<br/>-autoSuspendBitLocker=enable<br/>Verbose: each driver shown"]
            DELL_PHASE -->|2| DELL_P2
            DELL_P2 --> DELL_P2_EXIT{Exit code?}
            DELL_P2_EXIT -->|0, 3| DELL_DONE[Dell updates complete]
            DELL_P2_EXIT -->|1, 5| DELL_P2_REBOOT[Reboot required]
            DELL_P2_REBOOT --> REBOOT_DELL2([🔄 REBOOT])
            REBOOT_DELL2 -.-> DELL_PHASE
            DELL_P2_EXIT -->|other| DELL_DONE

            DELL_PHASE -->|3+| DELL_DONE
        end

        subgraph HP ["🖨️ HP Updates"]
            MFG_CHECK -->|HP| HP_CLI[Locate HPImageAssistant.exe<br/>or install via Chocolatey]
            HP_CLI -->|Not found| HP_CHOCO["Install-ChocoPackage<br/>'hpimageassistant'<br/>Invoke-CommandVerbose"]
            HP_CLI -->|Found| HP_RUN
            HP_CHOCO --> HP_RUN

            HP_RUN["HP Image Assistant<br/>/Operation:Analyze<br/>/Action:Install<br/>/Selection:All<br/>Verbose output streaming"]
            HP_RUN --> HP_EXIT{Exit code?}
            HP_EXIT -->|0| HP_DONE[HP updates complete]
            HP_EXIT -->|256, 3010| HP_REBOOT_WARN[Reboot recommended]
            HP_EXIT -->|other| HP_CONTINUE[Continue anyway]
            HP_REBOOT_WARN --> HP_DONE
            HP_CONTINUE --> HP_DONE
        end

        MFG_CHECK -->|Other| MFG_UNSUPPORTED[Unsupported manufacturer<br/>Only Dell & HP handled]
    end

    %% ============================================================
    %% FINAL
    %% ============================================================
    DELL_DONE --> FINAL
    HP_DONE --> FINAL
    MFG_UNSUPPORTED --> FINAL

    subgraph CLEANUP ["✅ Final Cleanup"]
        FINAL[Stop remaining driver processes]
        FINAL --> SUMMARY["Display Final Summary<br/>System, Model, Share path<br/>Reboots, Added, Installed<br/>Skipped, Failed, Timed out<br/>Total time"]
        SUMMARY --> REMOVESTATE["Remove-ScriptState<br/>Delete state JSON<br/>Delete RunOnce registry<br/>Delete scheduled task"]
    end

    REMOVESTATE --> DONE([✅ Script Complete])

    %% ============================================================
    %% ERROR HANDLING
    %% ============================================================
    FAIL_INIT --> CATCH
    subgraph ERRORHANDLER ["❌ Error Handler"]
        CATCH[Catch block<br/>Display error message + line<br/>Display stack trace]
        CATCH --> EMERGENCY[Emergency cleanup<br/>Stop all driver processes<br/>ErrorAction = SilentlyContinue]
        EMERGENCY --> KEEPSTATE[State file kept<br/>Re-run script to continue]
    end
    KEEPSTATE --> FINALLY

    DONE --> FINALLY
    FINALLY[Finally block<br/>Stop-Transcript]

    %% ============================================================
    %% INSTALL-SINGLEDRIVER DETAIL
    %% ============================================================
    subgraph SINGLEDRIVER ["⚙️ Install-SingleDriver (called per INF)"]
        direction TB
        SD_START[Write driver header<br/>Progress bar + name] --> SD_CLEAN[Clear-DriverInstallEnvironment<br/>Kill leftover processes]
        SD_CLEAN --> SD_WRAPPER["Create wrapper .ps1<br/>Runs pnputil in child process"]
        SD_WRAPPER --> SD_SPAWN["Start-Process powershell<br/>-WindowStyle Hidden"]
        SD_SPAWN --> SD_MONITOR["Monitor loop:<br/>Spinner animation<br/>Elapsed/Remaining timer<br/>Check timeout"]
        SD_MONITOR --> SD_TIMEOUT{Timed out?}
        SD_TIMEOUT -->|Yes| SD_KILL["Kill process<br/>Stop-DriverInstallProcesses<br/>Return TimedOut result"]
        SD_TIMEOUT -->|No| SD_READ["Read output file<br/>Read exit code file"]
        SD_READ --> SD_PARSE["Parse pnputil output:<br/>added / installed /<br/>already exists / reboot"]
        SD_PARSE --> SD_EXIT["Evaluate exit code:<br/>0=OK, 1=warn, 259=staged<br/>3010=reboot, 482=partial"]
        SD_EXIT --> SD_RETURN[Return result object]
    end

    %% ============================================================
    %% INVOKE-COMMANDVERBOSE DETAIL
    %% ============================================================
    subgraph VERBOSE ["📺 Invoke-CommandVerbose (used by Dell/HP/Choco)"]
        direction TB
        V_START[Start process with<br/>RedirectStdout + Stderr] --> V_LOOP["Async ReadLineAsync loop:<br/>stdout → White text<br/>stderr → Yellow text<br/>Each line timestamped"]
        V_LOOP --> V_HEARTBEAT["If silent >30s:<br/>Print heartbeat message<br/>'...still running (120s)'"]
        V_HEARTBEAT --> V_DONE["Process exits<br/>Save full log to C:\Temp\<br/>Display duration + exit code"]
    end

    %% ============================================================
    %% STYLING
    %% ============================================================
    classDef phase fill:#c9f1f5,stroke:#e94560,color:#fff,stroke-width:2px
    classDef success fill:#0bd979,stroke:#00ff88,color:#fff,stroke-width:2px
    classDef reboot fill:#533483,stroke:#ffcc00,color:#fff,stroke-width:2px
    classDef error fill:#4a0000,stroke:#ff0000,color:#fff,stroke-width:2px
    classDef decision fill:#26948b,stroke:#0f3460,color:#fff,stroke-width:1px
    classDef process fill:#c9f1f5,stroke:#e2e2e2,color:#fff,stroke-width:1px

    class START,DONE success
    class REBOOT_USB,REBOOT_NET,REBOOT_DELL,REBOOT_DELL2 reboot
    class FAIL_INIT,INET_FAIL,CATCH error
    class CHECKPHASE,USB_CHECK,NET_CHECK,GUEST_CHECK,MFG_CHECK,DELL_PHASE,USB_RESULT,NET_RESULT,DELL_ADR_EXIT,DELL_P2_EXIT,HP_EXIT,SD_TIMEOUT decision

Reboot Flow

sequenceDiagram
    participant S as Script
    participant R as Registry RunOnce
    participant W as Windows

    S->>S: Save state to JSON
    S->>R: Write RunOnce entry (64-bit)
    alt RunOnce failed
        S->>W: Create Scheduled Task (fallback)
    end
    S->>W: Restart-Computer -Force
    W->>W: Reboot
    W->>R: Read RunOnce entry
    R->>S: Launch script automatically
    S->>S: Load state from JSON
    S->>S: Resume from saved Phase

Network Share Folder Structure

graph LR
    SHARE["\\networkshare"] --> DELL[dell/]
    SHARE --> HP[hp/]
    DELL --> DDRIVER[driver/]
    HP --> HDRIVER[driver/]
    DDRIVER --> LAT5400[latitude5400/]
    DDRIVER --> PREC3500[precision3500/]
    DDRIVER --> OPT7080[optiplex7080/]
    HDRIVER --> ELITE840[elitebook840g7/]
    HDRIVER --> PRO400[prodesk400g6/]
    LAT5400 --> AUDIO[Audio/]
    LAT5400 --> VIDEO[Video/]
    LAT5400 --> CHIP[Chipset/]
    AUDIO --> INF1[realtek.inf]
    VIDEO --> INF2[igdlh64.inf]
    CHIP --> INF3[SetupChipset.inf]

    style SHARE fill:#e94560,color:#fff
    style DELL fill:#0f3460,color:#fff
    style HP fill:#0f3460,color:#fff
    style LAT5400 fill:#533483,color:#fff

USB Stick Structure (Minimal)

graph LR
    USB["USB Drive E:\"] --> DOS[DriversOS/]
    DOS --> INTEL_LAN["Intel-I219LM/"]
    DOS --> INTEL_WIFI["Intel-AX211/"]
    DOS --> REALTEK["Realtek-RTL8111/"]
    INTEL_LAN --> INF1["e1d68x64.inf"]
    INTEL_WIFI --> INF2["netwtw10.inf"]
    REALTEK --> INF3["rt640x64.inf"]

    style USB fill:#e94560,color:#fff
    style DOS fill:#533483,color:#fff

Powershell Script That searches the network share for drivers

#Requires -RunAsAdministrator
Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

#===================================================================
#  CONFIGURATION
#===================================================================
$Script:TempFolder       = "C:\Temp"
$Script:PersistentScript = "C:\Temp\DriverUpdateScript.ps1"
$Script:StateFile        = "C:\Temp\DriverUpdateState.json"
$Script:LogFile          = "C:\Temp\DriverUpdateScript.log"
$Script:RunOnceKey       = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
$Script:RunOnceName      = 'DriverUpdateScript_RunOnce'
$Script:DriverTimeout    = 300
$Script:CooldownSeconds  = 5
$Script:DriverProcesses  = @('drvinst','pnputil','DPInst','DPInst64','SetupAPI')
$Script:SpinnerFrames    = @('[ ]','[= ]','[== ]','[=== ]','[====]','[ ===]','[ ==]','[ =]')
$Script:ChocoSourceName  = 'chocosia'
$Script:ChocoSourceUrl   = 'http://choco.local.iut-troyes.univ-reims.fr/repository/chocolatey-group'
$Script:NetworkShareBase    = '\\synosia.local.iut-troyes.univ-reims.fr\batchs'
$Script:ShareDriverFolder   = 'driver'
$Script:ManufacturerShareMap = @{
    'Dell'             = 'dell'
    'Dell Inc.'        = 'dell'
    'HP'               = 'hp'
    'Hewlett-Packard'  = 'hp'
}
$Script:USBDriverFolders = @('DriversOS','Drivers')

#===================================================================
#  LOGGING HELPERS
#===================================================================
function Append-ToLog {
    param([Parameter(Mandatory=$false)][AllowEmptyString()][string]$Message = "")
    # No-op: Start-Transcript captures all console output automatically
}

function Write-Status {
    param(
        [Parameter(Mandatory)]
        [ValidateSet('ERROR','WARN','INFO','STEP','OK','PROGRESS','DEBUG','DRIVER','TIME','SKIP','KILL')]
        [string]$Level,
        [Parameter(Mandatory)][string]$Message
    )
    $timestamp = Get-Date -Format "HH:mm:ss"
    $color = switch ($Level.ToUpper()) {
        'ERROR'    { 'Red' }
        'WARN'     { 'Yellow' }
        'INFO'     { 'Cyan' }
        'STEP'     { 'Magenta' }
        'OK'       { 'Green' }
        'PROGRESS' { 'White' }
        'DEBUG'    { 'DarkGray' }
        'DRIVER'   { 'Blue' }
        'TIME'     { 'DarkYellow' }
        'SKIP'     { 'DarkMagenta' }
        'KILL'     { 'Red' }
        default    { 'White' }
    }
    $prefix = switch ($Level.ToUpper()) {
        'ERROR'    { '[X]' }
        'WARN'     { '[!]' }
        'INFO'     { '[i]' }
        'STEP'     { '[>]' }
        'OK'       { '[+]' }
        'PROGRESS' { '[o]' }
        'DEBUG'    { '[.]' }
        'DRIVER'   { '[D]' }
        'TIME'     { '[T]' }
        'SKIP'     { '[S]' }
        'KILL'     { '[K]' }
        default    { '[ ]' }
    }
    $line = "[$timestamp] $prefix [$Level] $Message"
    Write-Host $line -ForegroundColor $color
}

function Write-Banner {
    param([string]$Text)
    $sep = "=" * 70
    Write-Host ""
    Write-Host $sep -ForegroundColor Magenta
    Write-Host "  $Text" -ForegroundColor Magenta
    Write-Host $sep -ForegroundColor Magenta
    Write-Host ""
}

function Write-SubBanner {
    param([string]$Text)
    Write-Host ""
    Write-Host "--- $Text ---" -ForegroundColor Yellow
    Write-Host ""
}

function Write-LoggedHost {
    param(
        [Parameter(Mandatory=$false)][AllowEmptyString()][string]$Message = "",
        [string]$ForegroundColor = 'White'
    )
    if ($Message) {
        Write-Host $Message -ForegroundColor $ForegroundColor
    }
    else {
        Write-Host ""
    }
}

function Format-Duration {
    param([double]$Seconds)
    if ($Seconds -lt 60) { return "{0:N1}s" -f $Seconds }
    elseif ($Seconds -lt 3600) {
        $m = [math]::Floor($Seconds / 60); $s = $Seconds % 60
        return "{0}m {1:N0}s" -f $m, $s
    }
    else {
        $h = [math]::Floor($Seconds / 3600); $m = [math]::Floor(($Seconds % 3600) / 60)
        return "{0}h {1}m" -f $h, $m
    }
}

function Get-ConsoleWidth {
    $w = 100
    try { $w = [Console]::WindowWidth - 5; if ($w -lt 50) { $w = 100 } } catch { }
    return $w
}

function Write-DriverHeader {
    param([string]$DriverName, [int]$Current, [int]$Total)
    if ($Total -le 0) { $Total = 1 }
    $pct = [math]::Round(($Current / $Total) * 100)
    $filled = [math]::Floor($pct / 5)
    $empty = 20 - $filled
    $bar = "[" + ("#" * $filled) + ("-" * $empty) + "]"
    $lines = @(
        "  ======================================================================"
        "  $bar $pct% ($Current of $Total drivers)"
        "  Driver: $DriverName"
        "  Timeout: $Script:DriverTimeout seconds"
        "  ======================================================================"
    )
    Write-Host ""
    foreach ($l in $lines) {
        Write-Host $l -ForegroundColor DarkCyan
    }
}

#===================================================================
#  INITIALISATION
#===================================================================
function Initialize-PersistentScript {
    if (-not (Test-Path $Script:TempFolder)) {
        New-Item -Path $Script:TempFolder -ItemType Directory -Force | Out-Null
    }
    $sessionHeader = @(
        ""
        "=================================================================="
        "  NEW SESSION: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
        "  PID: $PID | User: $env:USERNAME | Computer: $env:COMPUTERNAME"
        "=================================================================="
        ""
    )
    foreach ($line in $sessionHeader) {
        Write-Host $line -ForegroundColor DarkGray
    }
    $currentScript = $MyInvocation.ScriptName
    if (-not $currentScript) { $currentScript = $PSCommandPath }
    if ($currentScript -and $currentScript -ne $Script:PersistentScript) {
        if (Test-Path $currentScript) {
            Write-LoggedHost "[INIT] Copying script to $Script:PersistentScript" -ForegroundColor Yellow
            Copy-Item -Path $currentScript -Destination $Script:PersistentScript -Force
            Write-LoggedHost "[INIT] Script copied successfully." -ForegroundColor Green
        }
    }
    if (-not (Test-Path $Script:PersistentScript)) {
        Write-LoggedHost "[ERROR] Persistent script could not be created." -ForegroundColor Red
        return $false
    }
    return $true
}

#===================================================================
#  PROCESS-HANDLING HELPERS
#===================================================================
function Get-DriverInstallProcesses {
    [System.Collections.ArrayList]$collector = @()
    foreach ($name in $Script:DriverProcesses) {
        $found = $null
        try { $found = Get-Process -Name $name -ErrorAction SilentlyContinue } catch { }
        if ($null -ne $found) {
            foreach ($p in @($found)) { [void]$collector.Add($p) }
        }
    }
    $arr = [object[]]$collector.ToArray()
    return ,$arr
}

function Stop-DriverInstallProcesses {
    param([switch]$Silent)
    $killed = 0
    foreach ($name in $Script:DriverProcesses) {
        $found = $null
        try { $found = Get-Process -Name $name -ErrorAction SilentlyContinue } catch { }
        if ($null -ne $found) {
            foreach ($proc in @($found)) {
                if (-not $Silent) {
                    Write-Status KILL "Terminating: $($proc.ProcessName) (PID $($proc.Id))"
                }
                try { $proc.CloseMainWindow() | Out-Null } catch { }
                Start-Sleep -Milliseconds 300
                try {
                    if (-not $proc.HasExited) { Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue }
                } catch { }
                $killed++
            }
        }
    }
    foreach ($name in $Script:DriverProcesses) {
        try {
            $saveEA = $ErrorActionPreference
            $ErrorActionPreference = 'SilentlyContinue'
            $null = cmd.exe /c "taskkill /F /IM `"$name.exe`" >nul 2>&1"
            $ErrorActionPreference = $saveEA
        }
        catch { try { $ErrorActionPreference = $saveEA } catch { } }
    }
    return $killed
}

function Wait-ForDriverProcesses {
    param([int]$TimeoutSeconds = 30)
    $sw = [System.Diagnostics.Stopwatch]::StartNew()
    while ($sw.Elapsed.TotalSeconds -lt $TimeoutSeconds) {
        $procs = Get-DriverInstallProcesses
        $procCount = ($procs | Measure-Object).Count
        if ($procCount -eq 0) { return $true }
        Start-Sleep -Milliseconds 500
    }
    return $false
}

function Clear-DriverInstallEnvironment {
    $procs = Get-DriverInstallProcesses
    $procCount = ($procs | Measure-Object).Count
    if ($procCount -gt 0) {
        Write-Status WARN "Found $procCount leftover driver process(es) - cleaning up..."
        $k = Stop-DriverInstallProcesses
        Write-Status INFO "Terminated $k process(es)"
        Start-Sleep -Seconds 2
    }
}

#===================================================================
#  EXECUTABLE FINDER (validates file, not directory)
#===================================================================
function Find-Executable {
    param(
        [Parameter(Mandatory)][string]$FileName,
        [Parameter(Mandatory)][string[]]$KnownPaths,
        [string[]]$SearchRoots = @(),
        [string]$Label = "executable"
    )

    # 1 - Check known paths (MUST be a file, not a directory)
    foreach ($p in $KnownPaths) {
        if (Test-Path $p -PathType Leaf) {
            Write-Status OK "Found $Label at known path: $p"
            return $p
        }
    }
    Write-Status INFO "$Label not found at known paths."

    # 2 - Search Chocolatey lib folder
    $chocoLib = "$env:ProgramData\chocolatey\lib"
    if (Test-Path $chocoLib) {
        Write-Status INFO "Searching Chocolatey lib for $FileName..."
        $found = Get-ChildItem -Path $chocoLib -Filter $FileName -Recurse -File -ErrorAction SilentlyContinue | Select-Object -First 1
        if ($found) {
            Write-Status OK "Found $Label in Chocolatey: $($found.FullName)"
            return $found.FullName
        }
    }

    # 3 - Search Chocolatey bin for shims
    $chocoBin = "$env:ProgramData\chocolatey\bin"
    if (Test-Path $chocoBin) {
        $shimPath = Join-Path $chocoBin $FileName
        if (Test-Path $shimPath -PathType Leaf) {
            Write-Status OK "Found $Label shim: $shimPath"
            return $shimPath
        }
    }

    # 4 - Search provided root directories
    $defaultRoots = @(
        'C:\Program Files'
        'C:\Program Files (x86)'
        $env:ProgramData
        'C:\HP'
        'C:\SWSetup'
        'C:\Dell'
    )
    $allRoots = @($SearchRoots) + $defaultRoots | Select-Object -Unique
    foreach ($root in $allRoots) {
        if (-not (Test-Path $root)) { continue }
        Write-Status DEBUG "Searching $root for $FileName..."
        $found = Get-ChildItem -Path $root -Filter $FileName -Recurse -File -ErrorAction SilentlyContinue | Select-Object -First 1
        if ($found) {
            Write-Status OK "Found $Label via search: $($found.FullName)"
            return $found.FullName
        }
    }

    Write-Status WARN "$Label ($FileName) not found anywhere."
    return $null
}

#===================================================================
#  VERBOSE COMMAND EXECUTION
#===================================================================
function Invoke-CommandVerbose {
    param(
        [Parameter(Mandatory)][string]$FilePath,
        [Parameter(Mandatory)][string]$Arguments,
        [Parameter(Mandatory)][string]$Label
    )

    # Validate: must exist AND be a file (not a directory)
    if (-not (Test-Path $FilePath -PathType Leaf)) {
        Write-Status ERROR "Executable not found or is a directory: $FilePath"
        return 999
    }

    $exeName = Split-Path $FilePath -Leaf
    Write-Status INFO "Executing: $exeName $Arguments"
    Write-Status DEBUG "Full path: $FilePath"

    $psi = [System.Diagnostics.ProcessStartInfo]::new()
    $psi.FileName = $FilePath
    $psi.Arguments = $Arguments
    $psi.UseShellExecute = $false
    $psi.RedirectStandardOutput = $true
    $psi.RedirectStandardError = $true
    $psi.CreateNoWindow = $true
    $process = [System.Diagnostics.Process]::new()
    $process.StartInfo = $psi
    try { $null = $process.Start() }
    catch {
        Write-Status ERROR "Failed to start $exeName : $($_.Exception.Message)"
        return 999
    }
    $sw = [System.Diagnostics.Stopwatch]::StartNew()
    $lastActivity = [System.Diagnostics.Stopwatch]::StartNew()
    $heartbeatSec = 30
    $logLines = [System.Collections.ArrayList]::new()
    $stdoutTask = $process.StandardOutput.ReadLineAsync()
    $stderrTask = $process.StandardError.ReadLineAsync()
    $stdoutDone = $false
    $stderrDone = $false
    while ((-not $stdoutDone) -or (-not $stderrDone)) {
        $activity = $false
        if ((-not $stdoutDone) -and $stdoutTask.IsCompleted) {
            $line = $null
            try { $line = $stdoutTask.Result } catch { $stdoutDone = $true; continue }
            if ($null -ne $line) {
                $trimmed = $line.Trim()
                if ($trimmed) {
                    $ts = Get-Date -Format 'HH:mm:ss'
                    $formatted = "  [$ts] [$Label] $trimmed"
                    Write-Host $formatted -ForegroundColor White
                    [void]$logLines.Add("[$ts] $trimmed")
                }
                $stdoutTask = $process.StandardOutput.ReadLineAsync()
                $activity = $true; $lastActivity.Restart()
            }
            else { $stdoutDone = $true }
        }
        if ((-not $stderrDone) -and $stderrTask.IsCompleted) {
            $line = $null
            try { $line = $stderrTask.Result } catch { $stderrDone = $true; continue }
            if ($null -ne $line) {
                $trimmed = $line.Trim()
                if ($trimmed) {
                    $ts = Get-Date -Format 'HH:mm:ss'
                    $formatted = "  [$ts] [$Label] [STDERR] $trimmed"
                    Write-Host $formatted -ForegroundColor Yellow
                    [void]$logLines.Add("[$ts] [STDERR] $trimmed")
                }
                $stderrTask = $process.StandardError.ReadLineAsync()
                $activity = $true; $lastActivity.Restart()
            }
            else { $stderrDone = $true }
        }
        if ((-not $activity) -and ($lastActivity.Elapsed.TotalSeconds -ge $heartbeatSec)) {
            $ts = Get-Date -Format 'HH:mm:ss'
            $elapsed = [math]::Round($sw.Elapsed.TotalSeconds)
            $heartbeatMsg = "  [$ts] [$Label] ... still running (${elapsed}s elapsed)"
            Write-Host $heartbeatMsg -ForegroundColor DarkGray
            [void]$logLines.Add("[$ts] [heartbeat] ${elapsed}s elapsed")
            $lastActivity.Restart()
        }
        if (-not $activity) { Start-Sleep -Milliseconds 100 }
    }
    $process.WaitForExit()
    $sw.Stop()
    $exitCode = $process.ExitCode
    $safeLabel = $Label -replace '[^a-zA-Z0-9]', '_'
    $cmdLogFile = Join-Path $Script:TempFolder "${safeLabel}_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
    try {
        $header = "Command : $FilePath $Arguments`nExit    : $exitCode`nDuration: $(Format-Duration $sw.Elapsed.TotalSeconds)`n$('=' * 60)`n"
        $body = ($logLines | ForEach-Object { $_ }) -join "`n"
        "$header$body" | Out-File $cmdLogFile -Encoding UTF8 -Force
    } catch { }
    Write-Status TIME "Completed in $(Format-Duration $sw.Elapsed.TotalSeconds)"
    Write-Status INFO "Exit code: $exitCode"
    Write-Status DEBUG "Per-command log: $cmdLogFile"
    try { $process.Dispose() } catch { }
    return $exitCode
}

function Get-ChocoExePath {
    $cmd = Get-Command choco -ErrorAction SilentlyContinue
    if ($null -ne $cmd) { return $cmd.Source }
    $default = "$env:ProgramData\chocolatey\bin\choco.exe"
    if (Test-Path $default) { return $default }
    return $null
}

#===================================================================
#  SMB GUEST AUTH & SIGNING FIX
#===================================================================
function Enable-GuestNetworkAccess {
    Write-SubBanner "Configuring SMB Guest Access & Signing"
    Write-Status INFO "Windows 11 blocks guest SMB access by default."
    Write-Status INFO "Applying registry fixes..."
    $policyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation'
    $servicePath = 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters'
    $changes = 0
    if (-not (Test-Path $policyPath)) {
        Write-Status INFO "Creating policy key: $policyPath"
        try {
            New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows' -Name 'LanmanWorkstation' -Force | Out-Null
            Write-Status OK "Policy key created."
            $changes++
        }
        catch { Write-Status ERROR "Failed to create policy key: $($_.Exception.Message)" }
    }
    else { Write-Status OK "Policy key exists." }
    try {
        $currentVal = $null
        try { $currentVal = Get-ItemPropertyValue -Path $policyPath -Name 'AllowInsecureGuestAuth' -ErrorAction SilentlyContinue } catch { }
        if ($currentVal -eq 1) { Write-Status OK "AllowInsecureGuestAuth (policy) already 1." }
        else {
            Set-ItemProperty -Path $policyPath -Name 'AllowInsecureGuestAuth' -Value 1 -Type DWord -Force
            Write-Status OK "AllowInsecureGuestAuth (policy) set to 1."
            $changes++
        }
    }
    catch { Write-Status ERROR "Failed: $($_.Exception.Message)" }
    try {
        $currentVal = $null
        try { $currentVal = Get-ItemPropertyValue -Path $servicePath -Name 'AllowInsecureGuestAuth' -ErrorAction SilentlyContinue } catch { }
        if ($currentVal -eq 1) { Write-Status OK "AllowInsecureGuestAuth (service) already 1." }
        else {
            Set-ItemProperty -Path $servicePath -Name 'AllowInsecureGuestAuth' -Value 1 -Type DWord -Force
            Write-Status OK "AllowInsecureGuestAuth (service) set to 1."
            $changes++
        }
    }
    catch { Write-Status ERROR "Failed: $($_.Exception.Message)" }
    try {
        $currentVal = $null
        try { $currentVal = Get-ItemPropertyValue -Path $servicePath -Name 'RequireSecuritySignature' -ErrorAction SilentlyContinue } catch { }
        if ($currentVal -eq 0) { Write-Status OK "RequireSecuritySignature already 0." }
        else {
            Set-ItemProperty -Path $servicePath -Name 'RequireSecuritySignature' -Value 0 -Type DWord -Force
            Write-Status OK "RequireSecuritySignature set to 0."
            $changes++
        }
    }
    catch { Write-Status ERROR "Failed: $($_.Exception.Message)" }
    try {
        $currentVal = $null
        try { $currentVal = Get-ItemPropertyValue -Path $servicePath -Name 'EnableSecuritySignature' -ErrorAction SilentlyContinue } catch { }
        if ($currentVal -eq 0) { Write-Status OK "EnableSecuritySignature already 0." }
        else {
            Set-ItemProperty -Path $servicePath -Name 'EnableSecuritySignature' -Value 0 -Type DWord -Force
            Write-Status OK "EnableSecuritySignature set to 0."
            $changes++
        }
    }
    catch { Write-Status ERROR "Failed: $($_.Exception.Message)" }
    if ($changes -gt 0) {
        Write-Status INFO "Restarting LanmanWorkstation service ($changes changes)..."
        try {
            $saveEA = $ErrorActionPreference
            $ErrorActionPreference = 'SilentlyContinue'
            $null = cmd.exe /c "net stop LanmanWorkstation /y >nul 2>&1"
            Start-Sleep -Seconds 2
            $null = cmd.exe /c "net start LanmanWorkstation >nul 2>&1"
            $null = cmd.exe /c "net start LanmanServer >nul 2>&1"
            $null = cmd.exe /c "net start Netlogon >nul 2>&1"
            $ErrorActionPreference = $saveEA
            Start-Sleep -Seconds 3
            Write-Status OK "LanmanWorkstation restarted."
        }
        catch {
            try { $ErrorActionPreference = $saveEA } catch { }
            Write-Status WARN "Service restart may need reboot."
        }
    }
    else { Write-Status OK "No changes needed." }
    $readBack = @(
        @{ Name = 'AllowInsecureGuestAuth (policy)';  Path = $policyPath;  Key = 'AllowInsecureGuestAuth'; Expected = 1 }
        @{ Name = 'AllowInsecureGuestAuth (service)'; Path = $servicePath; Key = 'AllowInsecureGuestAuth'; Expected = 1 }
        @{ Name = 'RequireSecuritySignature';         Path = $servicePath; Key = 'RequireSecuritySignature'; Expected = 0 }
        @{ Name = 'EnableSecuritySignature';          Path = $servicePath; Key = 'EnableSecuritySignature'; Expected = 0 }
    )
    Write-LoggedHost
    Write-LoggedHost "  ======================================================================" -ForegroundColor DarkCyan
    Write-LoggedHost "              SMB GUEST ACCESS VERIFICATION" -ForegroundColor Cyan
    Write-LoggedHost "  ======================================================================" -ForegroundColor DarkCyan
    foreach ($item in $readBack) {
        $val = $null
        try { $val = Get-ItemPropertyValue -Path $item.Path -Name $item.Key -ErrorAction SilentlyContinue } catch { }
        $valStr = if ($null -ne $val) { $val.ToString() } else { 'NOT SET' }
        $match = ($val -eq $item.Expected)
        $statusColor = if ($match) { 'Green' } else { 'Red' }
        $statusIcon = if ($match) { 'OK' } else { 'FAIL' }
        Write-LoggedHost "  [$statusIcon] $($item.Name): $valStr (expected: $($item.Expected))" -ForegroundColor $statusColor
    }
    Write-LoggedHost "  Changes applied: $changes" -ForegroundColor White
    Write-LoggedHost "  ======================================================================" -ForegroundColor DarkCyan
    Write-LoggedHost
    return ($changes -ge 0)
}

#===================================================================
#  SYSTEM MODEL & NETWORK SHARE PATH HELPERS
#===================================================================
function Get-SystemInfo {
    $cs = Get-CimInstance Win32_ComputerSystem
    $rawManufacturer = $cs.Manufacturer.Trim()
    $rawModel = $cs.Model.Trim()
    $cleanModel = ($rawModel -replace '\s', '').ToLower()
    return [PSCustomObject]@{
        RawManufacturer = $rawManufacturer
        RawModel        = $rawModel
        CleanModel      = $cleanModel
    }
}

function Get-ManufacturerShareFolder {
    param([Parameter(Mandatory)][string]$Manufacturer)
    foreach ($key in $Script:ManufacturerShareMap.Keys) {
        if ($Manufacturer -like "*$key*") { return $Script:ManufacturerShareMap[$key] }
    }
    return ($Manufacturer -replace '\s', '').ToLower()
}

function Build-NetworkDriverPath {
    param([Parameter(Mandatory)][string]$ManufacturerFolder, [Parameter(Mandatory)][string]$CleanModel)
    $path = Join-Path $Script:NetworkShareBase $ManufacturerFolder
    $path = Join-Path $path $Script:ShareDriverFolder
    $path = Join-Path $path $CleanModel
    return $path
}

function Test-NetworkShareAccess {
    param([Parameter(Mandatory)][string]$SharePath, [int]$MaxRetries = 10, [int]$RetryDelaySec = 10)
    Write-Status INFO "Testing access to: $SharePath"
    for ($i = 1; $i -le $MaxRetries; $i++) {
        try {
            if (Test-Path $SharePath -ErrorAction Stop) {
                Write-Status OK "Network share accessible: $SharePath"
                return $true
            }
        }
        catch { }
        if ($i -lt $MaxRetries) {
            Write-Status WARN "Attempt $i/$MaxRetries failed - waiting ${RetryDelaySec}s..."
            Start-Sleep -Seconds $RetryDelaySec
        }
    }
    Write-Status ERROR "Share not accessible after $MaxRetries attempts: $SharePath"
    return $false
}

#===================================================================
#  DEVICE SCANNING & INF MATCHING
#===================================================================
function Get-SystemDeviceIds {
    $ids = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
    $deviceCount = 0
    $problemDeviceNames = [System.Collections.ArrayList]::new()
    try {
        $devices = @(Get-CimInstance Win32_PnPEntity -ErrorAction Stop)
        $deviceCount = ($devices | Measure-Object).Count
        foreach ($dev in $devices) {
            if ($null -ne $dev.HardwareID) { foreach ($hwid in @($dev.HardwareID)) { if ($hwid) { [void]$ids.Add($hwid) } } }
            if ($null -ne $dev.CompatibleID) { foreach ($cid in @($dev.CompatibleID)) { if ($cid) { [void]$ids.Add($cid) } } }
            if ($null -ne $dev.ConfigManagerErrorCode -and $dev.ConfigManagerErrorCode -ne 0) {
                $devName = $dev.Name; if (-not $devName) { $devName = $dev.DeviceID }
                [void]$problemDeviceNames.Add("$devName (error $($dev.ConfigManagerErrorCode))")
            }
        }
    }
    catch { Write-Status WARN "WMI scan failed: $($_.Exception.Message)" }
    if ($ids.Count -eq 0) {
        try {
            $pnpDevs = @(Get-PnpDevice -ErrorAction SilentlyContinue)
            $deviceCount = ($pnpDevs | Measure-Object).Count
            foreach ($dev in $pnpDevs) {
                try {
                    $hwProp = $dev | Get-PnpDeviceProperty -KeyName 'DEVPKEY_Device_HardwareIds' -ErrorAction SilentlyContinue
                    if ($null -ne $hwProp -and $null -ne $hwProp.Data) { foreach ($id in @($hwProp.Data)) { if ($id) { [void]$ids.Add($id) } } }
                } catch { }
                try {
                    $cProp = $dev | Get-PnpDeviceProperty -KeyName 'DEVPKEY_Device_CompatibleIds' -ErrorAction SilentlyContinue
                    if ($null -ne $cProp -and $null -ne $cProp.Data) { foreach ($id in @($cProp.Data)) { if ($id) { [void]$ids.Add($id) } } }
                } catch { }
            }
        } catch { }
    }
    Write-Status OK "Scanned $deviceCount device(s), $($ids.Count) unique ID(s)."
    $probCount = ($problemDeviceNames | Measure-Object).Count
    if ($probCount -gt 0) {
        Write-Status WARN "$probCount device(s) with problems:"
        foreach ($pd in $problemDeviceNames) { Write-Status INFO "  - $pd" }
    }
    return $ids
}

function Get-InfHardwareIds {
    param([Parameter(Mandatory)][string]$InfPath)
    $hardwareIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
    try { $lines = @(Get-Content $InfPath -ErrorAction Stop) } catch { return @($hardwareIds) }
    $lineCount = ($lines | Measure-Object).Count
    if ($lineCount -eq 0) { return @($hardwareIds) }
    $modelSections = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
    $inManufacturer = $false
    foreach ($line in $lines) {
        $trimmed = $line.Trim()
        if ($trimmed.StartsWith(';')) { continue }
        if ($trimmed -match '^\[Manufacturer\]\s*$') { $inManufacturer = $true; continue }
        if ($inManufacturer) {
            if ($trimmed -match '^\[') { $inManufacturer = $false; continue }
            if (-not $trimmed) { continue }
            if ($trimmed -match '=') {
                $rightSide = ($trimmed -split '=', 2)[1]
                if ($null -eq $rightSide) { continue }
                $parts = $rightSide -split ','
                $baseName = $parts[0].Trim()
                if (-not $baseName) { continue }
                [void]$modelSections.Add($baseName)
                $partCount = ($parts | Measure-Object).Count
                for ($j = 1; $j -lt $partCount; $j++) {
                    $decoration = $parts[$j].Trim()
                    if ($decoration) { [void]$modelSections.Add("$baseName.$decoration") }
                }
            }
        }
    }
    foreach ($section in @($modelSections)) {
        $sectionHeader = "[$section]"
        $inSection = $false
        foreach ($line in $lines) {
            $trimmed = $line.Trim()
            if ($trimmed.StartsWith(';')) { continue }
            if ($trimmed -ieq $sectionHeader) { $inSection = $true; continue }
            if ($inSection) {
                if ($trimmed -match '^\[') { $inSection = $false; continue }
                if (-not $trimmed) { continue }
                if ($trimmed -match '=') {
                    $rightSide = ($trimmed -split '=', 2)[1]
                    if ($null -eq $rightSide) { continue }
                    $idParts = $rightSide -split ','
                    $idPartCount = ($idParts | Measure-Object).Count
                    for ($j = 1; $j -lt $idPartCount; $j++) {
                        $hwid = $idParts[$j].Trim().Trim('"').Trim()
                        if ($hwid -and $hwid -match '\\') { [void]$hardwareIds.Add($hwid) }
                    }
                }
            }
        }
    }
    return @($hardwareIds)
}

function Test-InfMatchesSystem {
    param([Parameter(Mandatory)][string]$InfPath, [Parameter(Mandatory)][System.Collections.Generic.HashSet[string]]$SystemIds)
    $infIds = Get-InfHardwareIds -InfPath $InfPath
    $infIdCount = ($infIds | Measure-Object).Count
    if ($infIdCount -eq 0) { return $true }
    foreach ($infId in $infIds) { if ($SystemIds.Contains($infId)) { return $true } }
    return $false
}

#===================================================================
#  STATE-MANAGEMENT
#===================================================================
function Get-ScriptState {
    if (Test-Path $Script:StateFile) {
        try {
            $json = Get-Content $Script:StateFile -Raw -ErrorAction Stop | ConvertFrom-Json
            $defaults = @{
                Phase = 0; USBCompleted = $false; USBRebootDone = $false
                NetworkShareCompleted = $false; NetworkShareRebootDone = $false
                NetworkSharePath = ""; NetworkShareProcessedDrivers = @()
                USBProcessedDrivers = @(); USBDriverRoot = ""
                ManufacturerPhase = 0; DellADRFailed = $false; LastExitCode = 0
                RebootCount = 0; TotalDriversAdded = 0; TotalDriversInstalled = 0
                TotalDriversFailed = 0; TotalDriversSkipped = 0
                TotalDriversTimedOut = 0; TotalTimeSpent = 0; TotalProcessesKilled = 0
                SystemManufacturer = ""; SystemModel = ""; CleanModel = ""
                GuestAuthConfigured = $false
            }
            foreach ($k in $defaults.Keys) {
                if (-not $json.PSObject.Properties[$k]) {
                    $json | Add-Member -NotePropertyName $k -NotePropertyValue $defaults[$k] -Force
                }
            }
            return $json
        }
        catch { Write-Status WARN "State file error - fresh start: $($_.Exception.Message)" }
    }
    return [PSCustomObject]@{
        Phase = 0; USBCompleted = $false; USBRebootDone = $false
        NetworkShareCompleted = $false; NetworkShareRebootDone = $false
        NetworkSharePath = ""; NetworkShareProcessedDrivers = @()
        USBProcessedDrivers = @(); USBDriverRoot = ""
        ManufacturerPhase = 0; DellADRFailed = $false; LastExitCode = 0
        RebootCount = 0; TotalDriversAdded = 0; TotalDriversInstalled = 0
        TotalDriversFailed = 0; TotalDriversSkipped = 0
        TotalDriversTimedOut = 0; TotalTimeSpent = 0; TotalProcessesKilled = 0
        SystemManufacturer = ""; SystemModel = ""; CleanModel = ""
        GuestAuthConfigured = $false
    }
}

function Set-ScriptState {
    param([pscustomobject]$State)
    $State | ConvertTo-Json -Depth 10 | Out-File $Script:StateFile -Encoding UTF8 -Force
}

function Remove-ScriptState {
    Write-Status INFO "Removing state and RunOnce..."
    if (Test-Path $Script:StateFile) { Remove-Item $Script:StateFile -Force -ErrorAction SilentlyContinue }
    try {
        $rk64 = [Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, [Microsoft.Win32.RegistryView]::Registry64).OpenSubKey('SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce', $true)
        if ($null -ne $rk64) { $rk64.DeleteValue($Script:RunOnceName, $false); $rk64.Close() }
    } catch { }
    $fallback = "$($Script:RunOnceName)_Task"
    try {
        $t = Get-ScheduledTask -TaskName $fallback -ErrorAction SilentlyContinue
        if ($null -ne $t) { Unregister-ScheduledTask -TaskName $fallback -Confirm:$false -ErrorAction SilentlyContinue }
    } catch { }
    Write-Status OK "Cleanup finished."
}

#===================================================================
#  RUNONCE & REBOOT
#===================================================================
function Set-RunOnceEntry {
    param([Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$Command)
    try {
        $rk64 = [Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, [Microsoft.Win32.RegistryView]::Registry64).OpenSubKey('SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce', $true)
        $rk64.SetValue($Name, $Command, [Microsoft.Win32.RegistryValueKind]::String); $rk64.Close()
        Write-Status OK "RunOnce: $Name"; return $true
    }
    catch { Write-Status WARN "RunOnce failed: $($_.Exception.Message)"; return $false }
}

function Set-RunOnceTask {
    param([Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$ScriptPath)
    try {
        $a = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "-NoLogo -NoProfile -ExecutionPolicy Bypass -File `"$ScriptPath`""
        $tr = New-ScheduledTaskTrigger -AtStartup
        $p = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest -LogonType ServiceAccount
        Register-ScheduledTask -TaskName $Name -Action $a -Trigger $tr -Principal $p -Force -ErrorAction Stop
        Write-Status OK "Fallback task: $Name"; return $true
    }
    catch { Write-Status ERROR "Task failed: $($_.Exception.Message)"; return $false }
}

function Schedule-RebootAndContinue {
    param([pscustomobject]$State, [string]$Reason = "Reboot required")
    Write-LoggedHost
    Write-LoggedHost "======================================================================" -ForegroundColor Yellow
    Write-LoggedHost "  REBOOT REQUIRED: $Reason" -ForegroundColor Yellow
    Write-LoggedHost "======================================================================" -ForegroundColor Yellow
    Write-LoggedHost
    Stop-DriverInstallProcesses -Silent | Out-Null
    $State.RebootCount++; Set-ScriptState -State $State
    $cmd = "powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File `"$Script:PersistentScript`""
    $ok = Set-RunOnceEntry -Name $Script:RunOnceName -Command $cmd
    if (-not $ok) { Set-RunOnceTask -Name "$($Script:RunOnceName)_Task" -ScriptPath $Script:PersistentScript | Out-Null }
    for ($i = 15; $i -ge 1; $i--) {
        Write-LoggedHost "  Rebooting in $i seconds..." -ForegroundColor Yellow
        Start-Sleep -Seconds 1
    }
    Write-LoggedHost "  Rebooting NOW!" -ForegroundColor Red
    try { Stop-Transcript } catch { }
    Restart-Computer -Force; exit 0
}

#===================================================================
#  SINGLE DRIVER INSTALL
#===================================================================
function Install-SingleDriver {
    param(
        [Parameter(Mandatory)][string]$InfPath,
        [Parameter(Mandatory)][string]$DriverName,
        [Parameter(Mandatory)][int]$CurrentNumber,
        [Parameter(Mandatory)][int]$TotalCount,
        [int]$TimeoutSeconds = $Script:DriverTimeout
    )
    $result = [PSCustomObject]@{
        InfPath = $InfPath; DriverName = $DriverName; Success = $false
        ExitCode = -1; Added = $false; Installed = $false; AlreadyExists = $false
        NeedsReboot = $false; TimedOut = $false; ProcessesKilled = 0
        ErrorMessage = ""; Output = ""; Duration = 0
    }
    Write-DriverHeader -DriverName $DriverName -Current $CurrentNumber -Total $TotalCount
    Write-Status DRIVER "Path: $InfPath"
    Clear-DriverInstallEnvironment
    Write-Status INFO "Starting pnputil installation..."
    $stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
    $consoleWidth = Get-ConsoleWidth
    $tempScript = [IO.Path]::GetTempFileName() + ".ps1"
    $outFile = [IO.Path]::GetTempFileName()
    $exitFile = [IO.Path]::GetTempFileName()
    $wrapperContent = @"
try {
    `$out = & pnputil.exe /add-driver "$InfPath" /install 2>&1 | Out-String
    `$out | Out-File -FilePath "$outFile" -Encoding UTF8
    `$LASTEXITCODE | Out-File -FilePath "$exitFile" -Encoding UTF8
} catch {
    `$_.Exception.Message | Out-File -FilePath "$outFile" -Encoding UTF8
    "999" | Out-File -FilePath "$exitFile" -Encoding UTF8
}
"@
    $wrapperContent | Out-File -FilePath $tempScript -Encoding UTF8
    $proc = Start-Process -FilePath "powershell.exe" -ArgumentList "-ExecutionPolicy Bypass -WindowStyle Hidden -File `"$tempScript`"" -PassThru -WindowStyle Hidden
    $frameIdx = 0; $frameCount = $Script:SpinnerFrames.Length
    $animLine = 0; try { $animLine = [Console]::CursorTop } catch { }
    Write-Host "[PNPUTIL] Installing: $DriverName ($CurrentNumber/$TotalCount)" -ForegroundColor Cyan
    while ((-not $proc.HasExited) -and ($stopwatch.Elapsed.TotalSeconds -lt $TimeoutSeconds)) {
        $elapsed = $stopwatch.Elapsed.TotalSeconds
        $remaining = [math]::Max(0, $TimeoutSeconds - $elapsed)
        $pct = [math]::Round(($elapsed / $TimeoutSeconds) * 100)
        $spinner = $Script:SpinnerFrames[$frameIdx % $frameCount]; $frameIdx++
        $line = "  $spinner $pct% | Elapsed: $([math]::Round($elapsed))s | Remaining: $([math]::Round($remaining))s"
        $padded = $line.PadRight($consoleWidth)
        try {
            [Console]::SetCursorPosition(0, $animLine)
            [Console]::ForegroundColor = [ConsoleColor]::Cyan
            [Console]::Write($padded); [Console]::ResetColor()
        }
        catch { Write-Host "`r$padded" -NoNewline -ForegroundColor Cyan }
        Start-Sleep -Milliseconds 150
    }
    try { [Console]::SetCursorPosition(0, $animLine); [Console]::Write(' ' * $consoleWidth); [Console]::SetCursorPosition(0, $animLine) }
    catch { Write-Host "`r$(' ' * $consoleWidth)`r" -NoNewline }
    $stopwatch.Stop()
    $result.Duration = $stopwatch.Elapsed.TotalSeconds
    if (-not $proc.HasExited) {
        Write-Status SKIP "TIMEOUT after $(Format-Duration $TimeoutSeconds)!"
        try { $proc.Kill() } catch { }
        $result.TimedOut = $true; $result.ErrorMessage = "Timeout"
        $killed = Stop-DriverInstallProcesses; $result.ProcessesKilled = $killed
        $null = Wait-ForDriverProcesses -TimeoutSeconds 10
        Remove-Item $tempScript, $outFile, $exitFile -Force -ErrorAction SilentlyContinue
        Write-Host "[PNPUTIL] TIMEOUT for $DriverName after $TimeoutSeconds seconds" -ForegroundColor Yellow
        if ($Script:CooldownSeconds -gt 0) { Start-Sleep -Seconds $Script:CooldownSeconds }
        return $result
    }
    $out = ""; $exit = -1
    if (Test-Path $outFile) { $out = Get-Content $outFile -Raw -ErrorAction SilentlyContinue }
    if (Test-Path $exitFile) {
        $raw = Get-Content $exitFile -Raw -ErrorAction SilentlyContinue
        if ($null -ne $raw) { [int]::TryParse($raw.Trim(), [ref]$exit) | Out-Null }
    }
    Remove-Item $tempScript, $outFile, $exitFile -Force -ErrorAction SilentlyContinue
    $result.ExitCode = $exit; $result.Output = $out
    if ($null -ne $out -and $out.Trim()) {
        Write-Host "[PNPUTIL] --- Output for $DriverName ---" -ForegroundColor DarkGray
        foreach ($outLine in ($out -split "`n")) {
            $trimLine = $outLine.Trim()
            if ($trimLine) { Write-Host "[PNPUTIL] $trimLine" -ForegroundColor DarkGray }
        }
        Write-Host "[PNPUTIL] --- End output ---" -ForegroundColor DarkGray
    }
    if ($null -ne $out) {
        if ($out -match 'added|successfully added|driver package added') { $result.Added = $true; Write-Status OK "Driver added to store" }
        if ($out -match 'install.*device|installed to device') { $result.Installed = $true; Write-Status OK "Driver installed on device" }
        if ($out -match 'already exists|up to date') { $result.AlreadyExists = $true; Write-Status INFO "Already up-to-date" }
        if ($out -match 'reboot|restart') { $result.NeedsReboot = $true; Write-Status WARN "Reboot required" }
    }
    switch ($exit) {
        0    { $result.Success = $true; Write-Status OK "Exit 0 - Success" }
        1    { $result.Success = $true; Write-Status INFO "Exit 1 - Warnings" }
        259  { $result.Success = $true; Write-Status INFO "Exit 259 - Staged" }
        3010 { $result.Success = $true; $result.NeedsReboot = $true; Write-Status WARN "Exit 3010 - Reboot" }
        482  { $result.Success = $true; $result.NeedsReboot = $true; Write-Status WARN "Exit 482 - Partial" }
        default {
            if ($exit -ge 0) {
                if ($result.Added -or $result.Installed -or $result.AlreadyExists) { $result.Success = $true }
                else { $result.Success = $false; $result.ErrorMessage = "Exit $exit"; Write-Status ERROR "Exit $exit" }
            } else { $result.Success = $true }
        }
    }
    Write-Status TIME "Time: $(Format-Duration $result.Duration)"
    if ($Script:CooldownSeconds -gt 0) { Start-Sleep -Seconds $Script:CooldownSeconds }
    return $result
}

#===================================================================
#  GENERIC FOLDER INSTALLER
#===================================================================
function Install-DriversFromFolder {
    param(
        [Parameter(Mandatory)][string]$DriverRoot,
        [Parameter(Mandatory)][string]$Label,
        [string[]]$ProcessedList = @(),
        [switch]$SkipDeviceMatching,
        [System.Collections.Generic.HashSet[string]]$SystemIds = $null
    )
    $result = [PSCustomObject]@{
        Success = $false; NeedsReboot = $false; NotFound = $false
        TotalFound = 0; TotalMatched = 0; TotalSkippedNoMatch = 0
        TotalAdded = 0; TotalInstalled = 0; TotalFailed = 0
        TotalAlreadyExist = 0; TotalTimedOut = 0; TotalTime = 0; TotalKilled = 0
        ProcessedDrivers = @($ProcessedList)
    }
    $allInfFiles = @(Get-ChildItem -Path $DriverRoot -Filter "*.inf" -Recurse -File -ErrorAction SilentlyContinue | Sort-Object FullName)
    $totalFound = ($allInfFiles | Measure-Object).Count
    if ($totalFound -eq 0) {
        Write-Status WARN "No .inf files in: $DriverRoot"
        $result.NotFound = $true; $result.Success = $true; return $result
    }
    $result.TotalFound = $totalFound
    Write-Status OK "Found $totalFound INF(s) in: $DriverRoot"
    $processed = @($ProcessedList)
    $processedCount = ($processed | Measure-Object).Count
    if ($processedCount -gt 0) { Write-Status INFO "$processedCount already processed." }
    $matchedInfs = [System.Collections.ArrayList]::new()
    $skippedNoMatch = [System.Collections.ArrayList]::new()
    if ($SkipDeviceMatching) {
        Write-Status INFO "Device matching DISABLED - installing ALL."
        foreach ($inf in $allInfFiles) { [void]$matchedInfs.Add($inf) }
    }
    else {
        if ($null -eq $SystemIds -or $SystemIds.Count -eq 0) {
            Write-SubBanner "Scanning System Devices"
            $SystemIds = Get-SystemDeviceIds
        }
        if ($SystemIds.Count -eq 0) {
            Write-Status WARN "No device IDs - installing ALL as fallback."
            foreach ($inf in $allInfFiles) { [void]$matchedInfs.Add($inf) }
        }
        else {
            Write-SubBanner "Matching $Label Drivers to Devices"
            foreach ($inf in $allInfFiles) {
                $rel = $inf.FullName.Substring($DriverRoot.Length + 1)
                if ($rel -in $processed) { continue }
                if (Test-InfMatchesSystem -InfPath $inf.FullName -SystemIds $SystemIds) { [void]$matchedInfs.Add($inf) }
                else { [void]$skippedNoMatch.Add($inf); Write-Status SKIP "No match: $rel" }
            }
        }
    }
    $matchedCount = ($matchedInfs | Measure-Object).Count
    $skippedNoMatchCount = ($skippedNoMatch | Measure-Object).Count
    $result.TotalMatched = $matchedCount; $result.TotalSkippedNoMatch = $skippedNoMatchCount
    $modeLabel = if ($SkipDeviceMatching) { "ALL (no filtering)" } else { "TARGETED" }
    $modeColor = if ($SkipDeviceMatching) { 'Yellow' } else { 'Green' }
    Write-LoggedHost
    Write-LoggedHost "  ======================================================================" -ForegroundColor DarkCyan
    Write-LoggedHost "              $Label - MATCHING RESULTS" -ForegroundColor Cyan
    Write-LoggedHost "  ======================================================================" -ForegroundColor DarkCyan
    Write-LoggedHost "  Total INFs:       $totalFound" -ForegroundColor White
    Write-LoggedHost "  Processed:        $processedCount" -ForegroundColor DarkGray
    Write-LoggedHost "  Matched:          $matchedCount" -ForegroundColor Green
    Write-LoggedHost "  Skipped:          $skippedNoMatchCount" -ForegroundColor Yellow
    Write-LoggedHost "  Mode:             $modeLabel" -ForegroundColor $modeColor
    Write-LoggedHost "  ======================================================================" -ForegroundColor DarkCyan
    Write-LoggedHost
    if ($matchedCount -eq 0) {
        Write-Status OK "No new drivers to install."; $result.Success = $true; return $result
    }
    $overallSw = [System.Diagnostics.Stopwatch]::StartNew()
    $globalReboot = $false; $i = 0
    Write-SubBanner "Installing $matchedCount $Label Driver(s)"
    foreach ($inf in $matchedInfs) {
        $i++
        $rel = $inf.FullName.Substring($DriverRoot.Length + 1)
        if ($rel -in $processed) { continue }
        $drvResult = Install-SingleDriver -InfPath $inf.FullName -DriverName $rel -CurrentNumber $i -TotalCount $matchedCount
        $result.TotalTime += $drvResult.Duration; $result.TotalKilled += $drvResult.ProcessesKilled
        if ($drvResult.TimedOut) { $result.TotalTimedOut++ } elseif ($drvResult.Added) { $result.TotalAdded++ }
        if ($drvResult.Installed) { $result.TotalInstalled++ }
        if ($drvResult.AlreadyExists) { $result.TotalAlreadyExist++ }
        if ((-not $drvResult.Success) -and (-not $drvResult.TimedOut)) { $result.TotalFailed++ }
        if ($drvResult.NeedsReboot) { $globalReboot = $true }
        $processed += $rel; $result.ProcessedDrivers = @($processed)
    }
    $overallSw.Stop()
    $failColor = if ($result.TotalFailed -gt 0) { 'Red' } else { 'Green' }
    $timeoutColor = if ($result.TotalTimedOut -gt 0) { 'Yellow' } else { 'Green' }
    $killColor = if ($result.TotalKilled -gt 0) { 'Yellow' } else { 'Green' }
    $rebootColor = if ($globalReboot) { 'Yellow' } else { 'Green' }
    Write-LoggedHost
    Write-LoggedHost "======================================================================" -ForegroundColor Green
    Write-LoggedHost "              $Label DRIVER SUMMARY" -ForegroundColor Green
    Write-LoggedHost "======================================================================" -ForegroundColor Green
    Write-LoggedHost "  Found:      $($result.TotalFound)" -ForegroundColor White
    Write-LoggedHost "  Matched:    $($result.TotalMatched)" -ForegroundColor Green
    Write-LoggedHost "  Skipped:    $($result.TotalSkippedNoMatch)" -ForegroundColor Yellow
    Write-LoggedHost "  Added:      $($result.TotalAdded)" -ForegroundColor Green
    Write-LoggedHost "  Installed:  $($result.TotalInstalled)" -ForegroundColor Green
    Write-LoggedHost "  Up-to-date: $($result.TotalAlreadyExist)" -ForegroundColor Cyan
    Write-LoggedHost "  Failed:     $($result.TotalFailed)" -ForegroundColor $failColor
    Write-LoggedHost "  Timed out:  $($result.TotalTimedOut)" -ForegroundColor $timeoutColor
    Write-LoggedHost "  Killed:     $($result.TotalKilled)" -ForegroundColor $killColor
    Write-LoggedHost "  Time:       $(Format-Duration $overallSw.Elapsed.TotalSeconds)" -ForegroundColor Magenta
    Write-LoggedHost "  Reboot:     $globalReboot" -ForegroundColor $rebootColor
    Write-LoggedHost "======================================================================" -ForegroundColor Green
    Write-LoggedHost
    $result.Success = $true; $result.NeedsReboot = $globalReboot
    return $result
}

#===================================================================
#  PHASE-0A: USB DRIVERS (TARGETED)
#===================================================================
function Install-USBNetworkDrivers {
    param([pscustomobject]$State)
    Write-Banner "PHASE-0A: USB DRIVER INSTALLATION (TARGETED)"
    Write-Status STEP "Installing ONLY drivers matching this PC's devices from USB."
    Clear-DriverInstallEnvironment
    $root = $null
    if ($State.USBDriverRoot -and (Test-Path $State.USBDriverRoot)) {
        $root = $State.USBDriverRoot
    }
    else {
        foreach ($drive in @('D','E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z')) {
            foreach ($folder in $Script:USBDriverFolders) {
                $candidate = "${drive}:\$folder"
                if (Test-Path $candidate) { $root = $candidate; Write-Status OK "Found USB driver folder: $root"; break }
            }
            if ($null -ne $root) { break }
        }
    }
    if ($null -eq $root) {
        Write-Status INFO "No USB driver folder found - skipping USB phase."
        return [PSCustomObject]@{ Success = $true; NeedsReboot = $false; NotFound = $true }
    }
    $State.USBDriverRoot = $root; Set-ScriptState -State $State
    Write-SubBanner "Scanning System Devices for USB Driver Matching"
    $systemIds = Get-SystemDeviceIds
    Write-Status INFO "Will match USB INF files against $($systemIds.Count) hardware ID(s)."
    $processed = @(); if ($State.USBProcessedDrivers) { $processed = @($State.USBProcessedDrivers) }
    $usbResult = Install-DriversFromFolder -DriverRoot $root -Label "USB" -ProcessedList $processed -SystemIds $systemIds
    $State.USBProcessedDrivers     = $usbResult.ProcessedDrivers
    $State.TotalDriversAdded      += $usbResult.TotalAdded
    $State.TotalDriversInstalled  += $usbResult.TotalInstalled
    $State.TotalDriversFailed     += $usbResult.TotalFailed
    $State.TotalDriversSkipped    += $usbResult.TotalSkippedNoMatch
    $State.TotalDriversTimedOut   += $usbResult.TotalTimedOut
    $State.TotalTimeSpent         += $usbResult.TotalTime
    $State.TotalProcessesKilled   += $usbResult.TotalKilled
    Set-ScriptState -State $State
    return $usbResult
}

#===================================================================
#  PHASE-0B: NETWORK SHARE DRIVERS
#===================================================================
function Install-NetworkShareDrivers {
    param([pscustomobject]$State)
    Write-Banner "PHASE-0B: NETWORK SHARE DRIVER INSTALLATION"
    if (-not $State.GuestAuthConfigured) {
        Enable-GuestNetworkAccess | Out-Null
        $State.GuestAuthConfigured = $true; Set-ScriptState -State $State
    }
    else { Write-Status OK "SMB guest access already configured." }
    Write-SubBanner "Identifying System Model"
    $sysInfo = Get-SystemInfo
    $State.SystemManufacturer = $sysInfo.RawManufacturer
    $State.SystemModel = $sysInfo.RawModel
    $State.CleanModel = $sysInfo.CleanModel
    Set-ScriptState -State $State
    Write-Status INFO "Manufacturer: $($sysInfo.RawManufacturer)"
    Write-Status INFO "Model:        $($sysInfo.RawModel)"
    Write-Status INFO "Clean model:  $($sysInfo.CleanModel)"
    $mfgFolder = Get-ManufacturerShareFolder -Manufacturer $sysInfo.RawManufacturer
    $sharePath = ""
    if ($State.NetworkSharePath -and (Test-Path $State.NetworkSharePath -ErrorAction SilentlyContinue)) {
        $sharePath = $State.NetworkSharePath
    }
    else { $sharePath = Build-NetworkDriverPath -ManufacturerFolder $mfgFolder -CleanModel $sysInfo.CleanModel }
    Write-LoggedHost
    Write-LoggedHost "  ======================================================================" -ForegroundColor DarkCyan
    Write-LoggedHost "              NETWORK SHARE PATH" -ForegroundColor Cyan
    Write-LoggedHost "  ======================================================================" -ForegroundColor DarkCyan
    Write-LoggedHost "  Base:    $($Script:NetworkShareBase)" -ForegroundColor White
    Write-LoggedHost "  Mfg:     $mfgFolder" -ForegroundColor White
    Write-LoggedHost "  Model:   $($sysInfo.CleanModel)" -ForegroundColor White
    Write-LoggedHost "  Path:    $sharePath" -ForegroundColor Green
    Write-LoggedHost "  ======================================================================" -ForegroundColor DarkCyan
    Write-LoggedHost
    Write-SubBanner "Testing Network Share Access"
    $shareOk = Test-NetworkShareAccess -SharePath $sharePath -MaxRetries 10 -RetryDelaySec 10
    if (-not $shareOk) {
        $alternatives = @(($sysInfo.RawModel -replace '\s', '-').ToLower(), ($sysInfo.RawModel -replace '\s', '_').ToLower(), $sysInfo.RawModel.ToLower())
        $altFound = $false
        foreach ($alt in $alternatives) {
            $altPath = Build-NetworkDriverPath -ManufacturerFolder $mfgFolder -CleanModel $alt
            Write-Status INFO "Trying: $altPath"
            if (Test-Path $altPath -ErrorAction SilentlyContinue) {
                $sharePath = $altPath; Write-Status OK "Found: $sharePath"; $altFound = $true; break
            }
        }
        if (-not $altFound) {
            Write-Status ERROR "No share folder found. Expected: $sharePath"
            return [PSCustomObject]@{ Success = $true; NeedsReboot = $false; NotFound = $true }
        }
    }
    $State.NetworkSharePath = $sharePath; Set-ScriptState -State $State
    $processed = @(); if ($State.NetworkShareProcessedDrivers) { $processed = @($State.NetworkShareProcessedDrivers) }
    Write-SubBanner "Scanning Devices"
    $systemIds = Get-SystemDeviceIds
    $netResult = Install-DriversFromFolder -DriverRoot $sharePath -Label "NETWORK SHARE" -ProcessedList $processed -SystemIds $systemIds
    $State.NetworkShareProcessedDrivers = $netResult.ProcessedDrivers
    $State.TotalDriversAdded      += $netResult.TotalAdded
    $State.TotalDriversInstalled  += $netResult.TotalInstalled
    $State.TotalDriversFailed     += $netResult.TotalFailed
    $State.TotalDriversSkipped    += $netResult.TotalSkippedNoMatch
    $State.TotalDriversTimedOut   += $netResult.TotalTimedOut
    $State.TotalTimeSpent         += $netResult.TotalTime
    $State.TotalProcessesKilled   += $netResult.TotalKilled
    Set-ScriptState -State $State
    return $netResult
}

#===================================================================
#  INTERNET & MANUFACTURER
#===================================================================
function Test-InternetConnectivity {
    param([int]$MaxRetries = 15, [int]$RetryDelay = 10)
    Write-Banner "CHECKING INTERNET CONNECTIVITY"
    $w = Get-ConsoleWidth; $totalFrames = $Script:SpinnerFrames.Length
    for ($i = 1; $i -le $MaxRetries; $i++) {
        Write-Status PROGRESS "Attempt $i of $MaxRetries..."
        try {
            $r = Invoke-WebRequest -Uri "https://www.google.com" -Method Head -UseBasicParsing -TimeoutSec 10 -ErrorAction Stop
            if ($r.StatusCode -eq 200) { Write-Status OK "Internet reachable."; return $true }
        }
        catch {
            Write-Status WARN "Attempt $i failed: $($_.Exception.Message)"
            if ($i -lt $MaxRetries) {
                for ($s = $RetryDelay; $s -ge 1; $s--) {
                    $spinner = $Script:SpinnerFrames[($RetryDelay - $s) % $totalFrames]
                    $pad = "  $spinner Waiting $s sec...".PadRight($w)
                    try { [Console]::SetCursorPosition(0, [Console]::CursorTop); [Console]::ForegroundColor = [ConsoleColor]::DarkGray; [Console]::Write($pad); [Console]::ResetColor() }
                    catch { Write-Host "`r$pad" -NoNewline -ForegroundColor DarkGray }
                    Start-Sleep -Seconds 1
                }
            }
        }
    }
    Write-Status ERROR "No internet after $MaxRetries attempts."
    return $false
}

function Get-SystemManufacturer {
    Write-SubBanner "Detecting System Manufacturer"
    $cs = Get-CimInstance Win32_ComputerSystem
    Write-Status INFO "Manufacturer: $($cs.Manufacturer.Trim())"
    Write-Status INFO "Model:        $($cs.Model.Trim())"
    return $cs.Manufacturer.Trim()
}

#===================================================================
#  CHOCOLATEY
#===================================================================
function Set-ChocolateySource {
    Write-SubBanner "Configuring Chocolatey Sources"
    $chocoExe = Get-ChocoExePath; if (-not $chocoExe) { return }
    $null = Invoke-CommandVerbose -FilePath $chocoExe -Arguments "source add -n `"$($Script:ChocoSourceName)`" -s `"$($Script:ChocoSourceUrl)`" --priority=1 --allow-self-service" -Label "CHOCO"
    $null = Invoke-CommandVerbose -FilePath $chocoExe -Arguments "source disable -n `"chocolatey`"" -Label "CHOCO"
    $null = Invoke-CommandVerbose -FilePath $chocoExe -Arguments "source list" -Label "CHOCO"
}

function Install-ChocolateyIfNeeded {
    Write-SubBanner "Ensuring Chocolatey"
    if (-not (Get-Command choco -ErrorAction SilentlyContinue)) {
        Write-Status INFO "Installing Chocolatey..."
        Write-Host "[CHOCO] Installing Chocolatey from community.chocolatey.org..." -ForegroundColor Cyan
        Set-ExecutionPolicy Bypass -Scope Process -Force
        [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor 3072
        Invoke-Expression (Invoke-RestMethod https://community.chocolatey.org/install.ps1)
        $env:Path = [System.Environment]::GetEnvironmentVariable('Path', 'Machine') + ';' + [System.Environment]::GetEnvironmentVariable('Path', 'User')
        Write-Status OK "Chocolatey installed."
    }
    else { Write-Status OK "Chocolatey present." }
    Set-ChocolateySource
}

function Install-ChocoPackage {
    param([Parameter(Mandatory)][string]$PackageName, [string]$DisplayName)
    if (-not $DisplayName) { $DisplayName = $PackageName }
    $chocoExe = Get-ChocoExePath; if (-not $chocoExe) { return $false }
    Write-SubBanner "Installing $DisplayName via Chocolatey"
    $exitCode = Invoke-CommandVerbose -FilePath $chocoExe -Arguments "install $PackageName -y --source=`"$($Script:ChocoSourceName)`"" -Label "CHOCO"
    if ($exitCode -ne 0) {
        Write-Status WARN "Custom source failed - trying default..."
        $exitCode = Invoke-CommandVerbose -FilePath $chocoExe -Arguments "install $PackageName -y" -Label "CHOCO"
    }
    if ($exitCode -eq 0) { Write-Status OK "$DisplayName installed."; return $true }
    else { Write-Status ERROR "$DisplayName failed."; return $false }
}

#===================================================================
#  DELL UPDATES
#===================================================================
function Find-DellCLI {
    $knownPaths = @(
        'C:\Program Files\Dell\CommandUpdate\dcu-cli.exe'
        'C:\Program Files (x86)\Dell\CommandUpdate\dcu-cli.exe'
        'C:\Program Files\Dell\Dell Command Update\dcu-cli.exe'
        'C:\Program Files (x86)\Dell\Dell Command Update\dcu-cli.exe'
    )
    return Find-Executable -FileName 'dcu-cli.exe' -KnownPaths $knownPaths -SearchRoots @('C:\Dell') -Label "Dell Command Update CLI"
}

function Invoke-DellUpdates {
    param([pscustomobject]$State)
    Write-Banner "DELL SYSTEM UPDATE"

    $cli = Find-DellCLI
    if (-not $cli) {
        Install-ChocoPackage -PackageName "dellcommandupdate" -DisplayName "Dell Command Update" | Out-Null
        Start-Sleep -Seconds 5
        $cli = Find-DellCLI
    }
    if (-not $cli) { Write-Status ERROR "Dell CLI not found anywhere."; return $false }
    Write-Status OK "Dell CLI: $cli"

    switch ($State.ManufacturerPhase) {
        0 {
            if ($State.DellADRFailed) { $State.ManufacturerPhase = 2; Set-ScriptState -State $State; return (Invoke-DellUpdates -State $State) }
            Write-SubBanner "Dell Phase-0: Configure ADR"
            $null = Invoke-CommandVerbose -FilePath $cli -Arguments "/configure -advancedDriverRestore=enable" -Label "DCU-CFG"
            Write-SubBanner "Dell Phase-0: ADR Driver Install"
            Write-Status STEP "All driver names and progress will appear below."
            $dellExit = Invoke-CommandVerbose -FilePath $cli -Arguments "/driverinstall" -Label "DCU"
            switch ($dellExit) {
                0 { $State.ManufacturerPhase = 2; Set-ScriptState -State $State; return (Invoke-DellUpdates -State $State) }
                1 { $State.ManufacturerPhase = 1; Schedule-RebootAndContinue -State $State -Reason "Dell ADR (exit 1)" }
                5 { $State.ManufacturerPhase = 1; Schedule-RebootAndContinue -State $State -Reason "Dell ADR (exit 5)" }
                2 { $State.DellADRFailed = $true; $State.ManufacturerPhase = 2; Set-ScriptState -State $State; return (Invoke-DellUpdates -State $State) }
                3 { $State.ManufacturerPhase = 2; Set-ScriptState -State $State; return (Invoke-DellUpdates -State $State) }
                default { $State.DellADRFailed = $true; $State.ManufacturerPhase = 2; Set-ScriptState -State $State; return (Invoke-DellUpdates -State $State) }
            }
        }
        1 {
            Write-SubBanner "Dell Phase-1: Post-Reboot Scan"
            $null = Invoke-CommandVerbose -FilePath $cli -Arguments "/scan" -Label "DCU"
            $State.ManufacturerPhase = 2; Set-ScriptState -State $State; return (Invoke-DellUpdates -State $State)
        }
        2 {
            Write-SubBanner "Dell Phase-2: Apply All Updates"
            Write-Status STEP "Each update name, download, and install status shown below."
            $dellExit = Invoke-CommandVerbose -FilePath $cli -Arguments "/applyupdates -forceUpdate=enable -autoSuspendBitLocker=enable" -Label "DCU"
            switch ($dellExit) {
                0 { Write-Status OK "All updates applied."; $State.ManufacturerPhase = 3; Set-ScriptState -State $State; return $true }
                1 { $State.ManufacturerPhase = 3; Schedule-RebootAndContinue -State $State -Reason "Dell updates (exit 1)" }
                5 { $State.ManufacturerPhase = 3; Schedule-RebootAndContinue -State $State -Reason "Dell updates (exit 5)" }
                3 { Write-Status OK "Already up to date."; $State.ManufacturerPhase = 3; Set-ScriptState -State $State; return $true }
                default { Write-Status WARN "Exit $dellExit - continuing."; $State.ManufacturerPhase = 3; Set-ScriptState -State $State; return $true }
            }
        }
        default { Write-Status OK "Dell updates done."; return $true }
    }
    return $true
}

#===================================================================
#  HP UPDATES (FIXED - robust exe discovery)
#===================================================================
function Find-HPIA {
    $knownPaths = @(
        # Chocolatey install location (priority - most common after choco install)
        "$env:ProgramData\chocolatey\lib\hpimageassistant\tools\HPImageAssistant.exe"
        # Standard HP install locations
        'C:\HP\HPIA\HPImageAssistant.exe'
        'C:\Program Files\HP\HPIA\HPImageAssistant.exe'
        'C:\Program Files (x86)\HP\HPIA\HPImageAssistant.exe'
        'C:\SWSetup\HPIA\HPImageAssistant.exe'
        'C:\Program Files\HPImageAssistant\HPImageAssistant.exe'
        'C:\Program Files (x86)\HPImageAssistant\HPImageAssistant.exe'
        "$env:ProgramData\HP\HPIA\HPImageAssistant.exe"
        'C:\HP\HPImageAssistant\HPImageAssistant.exe'
    )
    return Find-Executable -FileName 'HPImageAssistant.exe' -KnownPaths $knownPaths -SearchRoots @('C:\HP', 'C:\SWSetup') -Label "HP Image Assistant"
}

function Invoke-HPUpdates {
    param([pscustomobject]$State)
    Write-Banner "HP SYSTEM UPDATE"

    # ── Find HPIA before Chocolatey ──
    Write-SubBanner "Locating HP Image Assistant"
    $hpia = Find-HPIA

    # ── Try Chocolatey install if not found ──
    if (-not $hpia) {
        Write-Status WARN "HPIA not found - attempting Chocolatey install..."

        # Try multiple known package names
        $chocoPackages = @('hpimageassistant', 'hp-hpia', 'hp-image-assistant')
        $installed = $false
        foreach ($pkg in $chocoPackages) {
            Write-Status INFO "Trying Chocolatey package: $pkg"
            $result = Install-ChocoPackage -PackageName $pkg -DisplayName "HP Image Assistant ($pkg)"
            if ($result) { $installed = $true; break }
        }

        if ($installed) {
            Start-Sleep -Seconds 5
            # Refresh PATH
            $env:Path = [System.Environment]::GetEnvironmentVariable('Path', 'Machine') + ';' + [System.Environment]::GetEnvironmentVariable('Path', 'User')
            $hpia = Find-HPIA
        }
    }

    # ── Final validation ──
    if (-not $hpia) {
        Write-Status ERROR "HP Image Assistant (HPImageAssistant.exe) could not be found anywhere."
        Write-Status INFO "Searched: known paths, Chocolatey lib, Program Files, C:\HP, C:\SWSetup"
        Write-Status INFO "Please install HPIA manually and re-run the script."
        return $false
    }

    # Verify it is a file, not a directory
    $hpiaItem = Get-Item $hpia -ErrorAction SilentlyContinue
    if ($null -eq $hpiaItem -or $hpiaItem.PSIsContainer) {
        Write-Status ERROR "Path is a directory, not an executable: $hpia"
        return $false
    }

    Write-Status OK  "HPIA executable: $hpia"
    Write-Status DEBUG "HPIA size: $([math]::Round($hpiaItem.Length / 1MB, 1)) MB"
    Write-Status DEBUG "HPIA version: $($hpiaItem.VersionInfo.FileVersion)"

    # ── Create report folder ──
    $hpiaReport = 'C:\Temp\HPIA'
    if (-not (Test-Path $hpiaReport)) {
        New-Item -Path $hpiaReport -ItemType Directory -Force | Out-Null
    }

    # ── Run HPIA ──
    Write-SubBanner "HP Image Assistant: Analyze & Install"
    Write-Status STEP "All update names and progress will appear below."

    $hpArgs = "/Operation:Analyze /Action:Install /Selection:All /Silent /Noninteractive /ReportFolder:`"$hpiaReport`""
    $hpExit = Invoke-CommandVerbose -FilePath $hpia -Arguments $hpArgs -Label "HPIA"

    # ── Report results ──
    Write-LoggedHost
    Write-LoggedHost "  ======================================================================" -ForegroundColor DarkCyan
    Write-LoggedHost "              HP IMAGE ASSISTANT RESULTS" -ForegroundColor Cyan
    Write-LoggedHost "  ======================================================================" -ForegroundColor DarkCyan
    Write-LoggedHost "  Executable:  $hpia" -ForegroundColor White
    Write-LoggedHost "  Exit code:   $hpExit" -ForegroundColor White
    Write-LoggedHost "  Report:      $hpiaReport" -ForegroundColor White

    # Parse report if available
    $jsonReport = Get-ChildItem -Path $hpiaReport -Filter '*.json' -File -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending | Select-Object -First 1
    if ($jsonReport) {
        Write-LoggedHost "  Report file: $($jsonReport.FullName)" -ForegroundColor Green
        try {
            $reportData = Get-Content $jsonReport.FullName -Raw -ErrorAction SilentlyContinue | ConvertFrom-Json -ErrorAction SilentlyContinue
            if ($null -ne $reportData -and $null -ne $reportData.HPIA -and $null -ne $reportData.HPIA.Recommendations) {
                $recs = @($reportData.HPIA.Recommendations)
                $recCount = ($recs | Measure-Object).Count
                Write-LoggedHost "  Updates:     $recCount recommendation(s)" -ForegroundColor White
                foreach ($rec in $recs) {
                    $name = if ($rec.Name) { $rec.Name } else { $rec.SoftPaqId }
                    $status = if ($rec.RecommendationValue) { $rec.RecommendationValue } else { 'Unknown' }
                    Write-LoggedHost "    - $name ($status)" -ForegroundColor DarkGray
                }
            }
        }
        catch { Write-Status DEBUG "Could not parse HPIA report: $($_.Exception.Message)" }
    }
    else {
        Write-LoggedHost "  Report file: (none found)" -ForegroundColor Yellow
    }
    Write-LoggedHost "  ======================================================================" -ForegroundColor DarkCyan
    Write-LoggedHost

    switch ($hpExit) {
        0    { Write-Status OK "HP updates completed successfully."; return $true }
        256  { Write-Status WARN "HP: reboot needed for some updates."; return $true }
        3010 { Write-Status WARN "HP: reboot needed (exit 3010)."; return $true }
        1    { Write-Status WARN "HP: completed with warnings."; return $true }
        default { Write-Status WARN "HP exit $hpExit - check report at $hpiaReport"; return $true }
    }
}

#===================================================================
#  MAIN EXECUTION
#===================================================================
try {
    if (-not (Initialize-PersistentScript)) { throw "Failed to initialise." }

    Start-Transcript -Path $Script:LogFile -Append -Force

    $sysInfoHeader = Get-SystemInfo
    $mfg = Get-ManufacturerShareFolder -Manufacturer $sysInfoHeader.RawManufacturer
    $expectedPath = Build-NetworkDriverPath -ManufacturerFolder $mfg -CleanModel $sysInfoHeader.CleanModel

    $headerLines = @(
        "======================================================================"
        "       DRIVER UPDATE SCRIPT - PowerShell $($PSVersionTable.PSVersion)"
        "======================================================================"
        "  User:          $env:USERNAME"
        "  Computer:      $env:COMPUTERNAME"
        "  Manufacturer:  $($sysInfoHeader.RawManufacturer)"
        "  Model:         $($sysInfoHeader.RawModel)"
        "  Clean model:   $($sysInfoHeader.CleanModel)"
        "  Driver share:  $expectedPath"
        "  Timeout:       $Script:DriverTimeout sec/driver"
        "  Choco source:  $Script:ChocoSourceName"
        "  Flow:          USB(targeted) -> GuestAuth -> Share(targeted) -> OEM(online)"
        "======================================================================"
    )
    Write-LoggedHost
    foreach ($hl in $headerLines) {
        Write-LoggedHost $hl -ForegroundColor Cyan
    }
    Write-LoggedHost

    Write-Status INFO "Checking for orphan processes..."
    $orphanKilled = Stop-DriverInstallProcesses -Silent
    if ($orphanKilled -gt 0) { Write-Status WARN "Terminated $orphanKilled."; Start-Sleep -Seconds 2 }

    $state = Get-ScriptState
    Write-Host "--- Current State ---" -ForegroundColor DarkGray
    foreach ($prop in $state.PSObject.Properties) {
        $stLine = "  {0,-35}: {1}" -f $prop.Name, $prop.Value
        Write-Host $stLine -ForegroundColor DarkGray
    }
    Write-Host "--- End State ---" -ForegroundColor DarkGray
    Write-Host ""

    # PHASE-0A: USB drivers (TARGETED)
    if ($state.Phase -eq 0) {
        if (-not $state.USBCompleted) {
            $usbResult = Install-USBNetworkDrivers -State $state
            if ($usbResult.NeedsReboot) {
                $state.USBCompleted = $true; $state.USBRebootDone = $false; Set-ScriptState -State $state
                Schedule-RebootAndContinue -State $state -Reason "USB drivers - reboot"
            }
            else { $state.USBCompleted = $true; $state.USBRebootDone = $true; Set-ScriptState -State $state }
        }
        else {
            if (-not $state.USBRebootDone) {
                Write-Status OK "Post-reboot: USB drivers finalized."
                $state.USBRebootDone = $true; Set-ScriptState -State $state
            }
        }
        # PHASE-0B: Network share drivers (TARGETED)
        if (-not $state.NetworkShareCompleted) {
            $netResult = Install-NetworkShareDrivers -State $state
            if ($netResult.NeedsReboot) {
                $state.NetworkShareCompleted = $true; $state.NetworkShareRebootDone = $false; Set-ScriptState -State $state
                Schedule-RebootAndContinue -State $state -Reason "Network share drivers - reboot"
            }
            else { $state.NetworkShareCompleted = $true; $state.NetworkShareRebootDone = $true; $state.Phase = 1; Set-ScriptState -State $state }
        }
        else {
            if (-not $state.NetworkShareRebootDone) {
                Write-Status OK "Post-reboot: Share drivers finalized."
                $state.NetworkShareRebootDone = $true
            }
            $state.Phase = 1; Set-ScriptState -State $state
        }
    }

    # PHASE-1: Online OEM updates
    if ($state.Phase -ge 1) {
        Write-Banner "PHASE 1: ONLINE OEM UPDATES"
        if (-not (Test-InternetConnectivity -MaxRetries 15 -RetryDelay 10)) {
            Write-Status ERROR "No internet."; try { Stop-Transcript } catch { }; exit 1
        }
        Install-ChocolateyIfNeeded
        $manufacturer = Get-SystemManufacturer
        if ($manufacturer -like '*Dell*') { Invoke-DellUpdates -State $state | Out-Null }
        elseif ($manufacturer -match 'HP|Hewlett[-\s]?Packard') { Invoke-HPUpdates -State $state | Out-Null }
        else { Write-Status WARN "Unsupported: $manufacturer" }
    }

    # FINAL SUMMARY
    Stop-DriverInstallProcesses -Silent | Out-Null
    $summaryLines = @(
        "======================================================================"
        "      DRIVER UPDATE SCRIPT COMPLETED SUCCESSFULLY!"
        "======================================================================"
        "  System:          $($state.SystemManufacturer) $($state.SystemModel)"
        "  Clean model:     $($state.CleanModel)"
        "  Share path:      $($state.NetworkSharePath)"
        "  Guest auth:      $($state.GuestAuthConfigured)"
        "  Reboots:         $($state.RebootCount)"
        "  Drivers added:   $($state.TotalDriversAdded)"
        "  Installed:       $($state.TotalDriversInstalled)"
        "  Skipped:         $($state.TotalDriversSkipped)"
        "  Failed:          $($state.TotalDriversFailed)"
        "  Timed out:       $($state.TotalDriversTimedOut)"
        "  Killed:          $($state.TotalProcessesKilled)"
        "  Total time:      $(Format-Duration $state.TotalTimeSpent)"
        "======================================================================"
    )
    Write-LoggedHost
    foreach ($sl in $summaryLines) {
        Write-LoggedHost $sl -ForegroundColor Green
    }
    Write-LoggedHost
    Remove-ScriptState
}
catch {
    Write-LoggedHost
    Write-LoggedHost "======================================================================" -ForegroundColor Red
    Write-LoggedHost "  SCRIPT ERROR" -ForegroundColor Red
    Write-LoggedHost "======================================================================" -ForegroundColor Red
    Write-Status ERROR "Message: $($_.Exception.Message)"
    Write-Status ERROR "Line:    $($_.InvocationInfo.ScriptLineNumber)"
    $stackStr = $_.ScriptStackTrace
    Write-Host $stackStr -ForegroundColor Red
    Write-LoggedHost
    Write-Status INFO "Emergency clean-up..."
    try {
        $saveEA = $ErrorActionPreference; $ErrorActionPreference = 'SilentlyContinue'
        Stop-DriverInstallProcesses -Silent | Out-Null
        $ErrorActionPreference = $saveEA
    }
    catch { try { $ErrorActionPreference = $saveEA } catch { } }
    Write-Status INFO "State file kept - re-run to continue."
}
finally {
    try { Stop-Transcript } catch { }
}