Differences

This shows you the differences between two versions of the page.

--- referenceimage [2020/06/22 15:23] – thekojukinator
+++ referenceimage [2020/06/22 16:13] (current) – old revision restored (2019/05/06 14:42) thekojukinator
@@ Line 45: / Line 45: @@
   - Create a VM to host the reference build, perform vanilla Windows setup from an ISO, and get in to //Audit Mode//.
   - Perform a variety of configuration changes, cleanup, software/utility additions, and Windows Updates to establish a desirable baseline.
+  - Sysprep and capture the disk image.
   - Take snapshots at critical points throughout the process for convenient roll-back.
-  - Sysprep and capture the disk image.
 ===== Software Used =====
@@ Line 54: / Line 54: @@
-===== The Build (Windows 10 1909.4) =====
+===== The Build (Windows 10 1809) =====
-This document is currently a work in progress as it is being updated for my approach to deploying build 1909.4.
 ==== Creating a New Virtual Machine in Hyper-V ====
@@ Line 170: / Line 168: @@
 <code powershell>
-$packages = @(
+# To get deployed packages across all user profiles:
-    "Microsoft.BingWeather",
+Get-AppxPackage -AllUsers | select PackageFullName| sort PackageFullName
-    "Microsoft.DesktopAppInstaller",
-    "Microsoft.GetHelp",
+# To get provisioned packages which are ready to deploy:
-    "Microsoft.Getstarted",
+Get-AppxProvisionedPackage -Online | select PackageName | sort PackageName
-    "Microsoft.Messaging",
-    "Microsoft.Microsoft3DViewer",
+# To remove deployed packages via partial name matching:
-    "Microsoft.MicrosoftOfficeHub",
+Get-AppxPackage -AllUsers | ?{$_.PackageFullName -like "*name*"} | Remove-AppxPackage
-    "Microsoft.MicrosoftSolitaireCollection",
-    "Microsoft.MixedReality.Portal",
+# To remove provisioned packages via partial name matching:
-    "Microsoft.MSPaint",
+Get-AppxProvisionedPackage -Online | ?{$_.PackageName -like "*name*"} | Remove-AppxProvisionedPackage -online
-    "Microsoft.Office.OneNote",
-    "Microsoft.OneConnect",
+# Here is a full dump of Get-AppxPackage and Get-AppxProvisionedPackage from build 1809,
-    "Microsoft.People",
+# and packages that are not to be removed are commented out:
-    "Microsoft.Print3D",
+$appx = @(
-    "Microsoft.Wallet",
+    #"1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.17763.1_neutral_neutral_cw5n1h2txyewy"
-    "microsoft.windowscommunicationsapps",
+    #"c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.17763.1_neutral_neutral_cw5n1h2txyewy"
-    "Microsoft.WindowsFeedbackHub",
+    #"E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.17763.1_neutral_neutral_cw5n1h2txyewy"
-    "Microsoft.WindowsMaps",
+    #"F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.17763.1_neutral_neutral_cw5n1h2txyewy"
-    "Microsoft.Xbox.TCUI",
+    #"InputApp_1000.17763.1.0_neutral_neutral_cw5n1h2txyewy"
-    "Microsoft.XboxApp",
+    #"Microsoft.AAD.BrokerPlugin_1000.17763.1.0_neutral_neutral_cw5n1h2txyewy"
-    "Microsoft.XboxGameOverlay",
+    #"Microsoft.AccountsControl_10.0.17763.1_neutral__cw5n1h2txyewy"
-    "Microsoft.XboxGamingOverlay",
+    #"Microsoft.Advertising.Xaml_10.1804.2.0_x64__8wekyb3d8bbwe"
-    "Microsoft.XboxIdentityProvider",
+    #"Microsoft.Advertising.Xaml_10.1804.2.0_x86__8wekyb3d8bbwe"
-    "Microsoft.XboxSpeechToTextOverlay",
+    #"Microsoft.AsyncTextService_10.0.17763.1_neutral__8wekyb3d8bbwe"
-    "Microsoft.YourPhone",
+    "Microsoft.BingWeather_4.25.12127.0_x64__8wekyb3d8bbwe"
-    "Microsoft.ZuneMusic",
+    #"Microsoft.BioEnrollment_10.0.17763.1_neutral__cw5n1h2txyewy"
-    "Microsoft.ZuneVideo"
+    #"Microsoft.CredDialogHost_10.0.17763.1_neutral__cw5n1h2txyewy"
+    #"Microsoft.DesktopAppInstaller_1.0.22011.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.ECApp_10.0.17763.1_neutral__8wekyb3d8bbwe"
+    "Microsoft.GetHelp_10.1706.10441.0_x64__8wekyb3d8bbwe"
+    "Microsoft.Getstarted_6.13.11581.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.HEIFImageExtension_1.0.11792.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.LockApp_10.0.17763.1_neutral__cw5n1h2txyewy"
+    "Microsoft.Messaging_3.43.27001.0_x64__8wekyb3d8bbwe"
+    "Microsoft.Microsoft3DViewer_4.1808.15012.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.MicrosoftEdge_44.17763.1.0_neutral__8wekyb3d8bbwe"
+    #"Microsoft.MicrosoftEdgeDevToolsClient_1000.17763.1.0_neutral_neutral_8wekyb3d8bbwe"
+    "Microsoft.MicrosoftOfficeHub_17.8918.5926.0_x64__8wekyb3d8bbwe"
+    "Microsoft.MicrosoftSolitaireCollection_4.1.5252.0_x86__8wekyb3d8bbwe"
+    #"Microsoft.MicrosoftStickyNotes_2.0.13.0_x64__8wekyb3d8bbwe"
+    "Microsoft.MixedReality.Portal_2000.18081.1242.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.MSPaint_4.1807.12027.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe"
+    #"Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x86__8wekyb3d8bbwe"
+    #"Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe"
+    #"Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x86__8wekyb3d8bbwe"
+    "Microsoft.Office.OneNote_16001.10228.20003.0_x64__8wekyb3d8bbwe"
+    "Microsoft.OneConnect_5.1807.1991.0_x64__8wekyb3d8bbwe"
+    "Microsoft.People_10.1805.1361.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.PPIProjection_10.0.17763.1_neutral_neutral_cw5n1h2txyewy"
+    #"Microsoft.Print3D_3.0.1521.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.ScreenSketch_10.1806.2112.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.Services.Store.Engagement_10.0.1610.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.Services.Store.Engagement_10.0.1610.0_x86__8wekyb3d8bbwe"
+    #"Microsoft.SkypeApp_14.26.95.0_x64__kzf8qxf38zg5c"
+    #"Microsoft.StorePurchaseApp_11805.1001.8.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.VCLibs.140.00_14.0.25426.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.VCLibs.140.00_14.0.25426.0_x86__8wekyb3d8bbwe"
+    #"Microsoft.VP9VideoExtensions_1.0.12342.0_x64__8wekyb3d8bbwe"
+    "Microsoft.Wallet_2.2.18179.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.WebMediaExtensions_1.0.12341.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.WebpImageExtension_1.0.11551.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.Win32WebViewHost_10.0.17763.1_neutral_neutral_cw5n1h2txyewy"
+    #"Microsoft.Windows.Apprep.ChxApp_1000.17763.1.0_neutral_neutral_cw5n1h2txyewy"
+    #"Microsoft.Windows.AssignedAccessLockApp_1000.17763.1.0_neutral_neutral_cw5n1h2txyewy"
+    #"Microsoft.Windows.CapturePicker_10.0.17763.1_neutral__cw5n1h2txyewy"
+    #"Microsoft.Windows.CloudExperienceHost_10.0.17763.1_neutral_neutral_cw5n1h2txyewy"
+    #"Microsoft.Windows.ContentDeliveryManager_10.0.17763.1_neutral_neutral_cw5n1h2txyewy"
+    #"Microsoft.Windows.Cortana_1.11.5.17763_neutral_neutral_cw5n1h2txyewy"
+    #"Microsoft.Windows.NarratorQuickStart_10.0.17763.1_neutral_neutral_8wekyb3d8bbwe"
+    #"Microsoft.Windows.OOBENetworkCaptivePortal_10.0.17763.1_neutral__cw5n1h2txyewy"
+    #"Microsoft.Windows.OOBENetworkConnectionFlow_10.0.17763.1_neutral__cw5n1h2txyewy"
+    #"Microsoft.Windows.ParentalControls_1000.17763.1.0_neutral_neutral_cw5n1h2txyewy"
+    #"Microsoft.Windows.PeopleExperienceHost_10.0.17763.1_neutral_neutral_cw5n1h2txyewy"
+    #"Microsoft.Windows.Photos_2018.18051.21218.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.Windows.PinningConfirmationDialog_1000.17763.1.0_neutral__cw5n1h2txyewy"
+    #"Microsoft.Windows.SecHealthUI_10.0.17763.1_neutral__cw5n1h2txyewy"
+    #"Microsoft.Windows.SecureAssessmentBrowser_10.0.17763.1_neutral_neutral_cw5n1h2txyewy"
+    #"Microsoft.Windows.ShellExperienceHost_10.0.17763.1_neutral_neutral_cw5n1h2txyewy"
+    #"Microsoft.Windows.XGpuEjectDialog_10.0.17763.1_neutral_neutral_cw5n1h2txyewy"
+    #"Microsoft.WindowsAlarms_10.1805.1361.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.WindowsCalculator_10.1805.1201.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.WindowsCamera_2018.425.120.0_x64__8wekyb3d8bbwe"
+    "microsoft.windowscommunicationsapps_17.9330.21365.0_x64__8wekyb3d8bbwe"
+    "Microsoft.WindowsFeedbackHub_1.1805.2331.0_x64__8wekyb3d8bbwe"
+    "Microsoft.WindowsMaps_5.1805.1431.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.WindowsSoundRecorder_10.1805.1941.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.WindowsStore_11805.1001.49.0_x64__8wekyb3d8bbwe"
+    "Microsoft.Xbox.TCUI_1.11.28003.0_x64__8wekyb3d8bbwe"
+    "Microsoft.XboxApp_41.41.18001.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.XboxGameCallableUI_1000.17763.1.0_neutral_neutral_cw5n1h2txyewy"
+    "Microsoft.XboxGameOverlay_1.32.17005.0_x64__8wekyb3d8bbwe"
+    "Microsoft.XboxGamingOverlay_2.20.22001.0_x64__8wekyb3d8bbwe"
+    "Microsoft.XboxIdentityProvider_12.44.20001.0_x64__8wekyb3d8bbwe"
+    "Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe"
+    "Microsoft.YourPhone_0.0.12084.0_x64__8wekyb3d8bbwe"
+    "Microsoft.ZuneMusic_10.18052.20211.0_x64__8wekyb3d8bbwe"
+    "Microsoft.ZuneVideo_10.18052.20211.0_x64__8wekyb3d8bbwe"
+    #"Windows.CBSPreview_10.0.17763.1_neutral_neutral_cw5n1h2txyewy"
+    #"windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy"
+    #"Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy"
 )
-Get-AppxProvisionedPackage -Online | Where-Object { $packages -contains $_.DisplayName } | Remove-AppxProvisionedPackage -Online
+$appxpp = @(
-Get-AppxPackage -AllUsers | Where-Object { $packages -contains $_.Name } | Remove-AppxPackage -AllUsers
+    "Microsoft.BingWeather_4.25.12127.0_neutral_~_8wekyb3d8bbwe"
+    #"Microsoft.DesktopAppInstaller_2018.720.2137.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.GetHelp_10.1706.10441.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.Getstarted_6.13.11581.0_neutral_~_8wekyb3d8bbwe"
+    #"Microsoft.HEIFImageExtension_1.0.11792.0_x64__8wekyb3d8bbwe"
+    "Microsoft.Messaging_2018.727.1430.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.Microsoft3DViewer_4.1808.15012.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.MicrosoftOfficeHub_2017.1219.520.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.MicrosoftSolitaireCollection_4.1.5252.0_neutral_~_8wekyb3d8bbwe"
+    #"Microsoft.MicrosoftStickyNotes_2.0.13.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.MixedReality.Portal_2000.18081.1242.0_neutral_~_8wekyb3d8bbwe"
+    #"Microsoft.MSPaint_4.1807.12027.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.Office.OneNote_16001.10228.20003.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.OneConnect_5.1807.1991.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.People_2018.516.2011.0_neutral_~_8wekyb3d8bbwe"
+    #"Microsoft.Print3D_3.0.1521.0_neutral_~_8wekyb3d8bbwe"
+    #"Microsoft.ScreenSketch_2018.731.48.0_neutral_~_8wekyb3d8bbwe"
+    #"Microsoft.SkypeApp_14.26.95.0_neutral_~_kzf8qxf38zg5c"
+    #"Microsoft.StorePurchaseApp_11805.1001.813.0_neutral_~_8wekyb3d8bbwe"
+    #"Microsoft.VP9VideoExtensions_1.0.12342.0_x64__8wekyb3d8bbwe"
+    "Microsoft.Wallet_2.2.18179.0_neutral_~_8wekyb3d8bbwe"
+    #"Microsoft.WebMediaExtensions_1.0.12341.0_neutral_~_8wekyb3d8bbwe"
+    #"Microsoft.WebpImageExtension_1.0.11551.0_x64__8wekyb3d8bbwe"
+    #"Microsoft.Windows.Photos_2018.18051.21218.0_neutral_~_8wekyb3d8bbwe"
+    #"Microsoft.WindowsAlarms_2018.516.2059.0_neutral_~_8wekyb3d8bbwe"
+    #"Microsoft.WindowsCalculator_2018.501.612.0_neutral_~_8wekyb3d8bbwe"
+    #"Microsoft.WindowsCamera_2018.425.120.0_neutral_~_8wekyb3d8bbwe"
+    "microsoft.windowscommunicationsapps_2015.9330.21365.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.WindowsFeedbackHub_2018.822.2.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.WindowsMaps_2018.523.2143.0_neutral_~_8wekyb3d8bbwe"
+    #"Microsoft.WindowsSoundRecorder_2018.713.2154.0_neutral_~_8wekyb3d8bbwe"
+    #"Microsoft.WindowsStore_11805.1001.4913.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.Xbox.TCUI_1.11.28003.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.XboxApp_41.41.18001.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.XboxGameOverlay_1.32.17005.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.XboxGamingOverlay_2.20.22001.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.XboxIdentityProvider_12.44.20001.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.YourPhone_2018.727.2137.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.ZuneMusic_2019.18052.20211.0_neutral_~_8wekyb3d8bbwe"
+    "Microsoft.ZuneVideo_2019.18052.20211.0_neutral_~_8wekyb3d8bbwe"
+)
+# This will use the above lists to remove the packages:
+Get-AppxPackage -AllUsers | Where-Object { $appx -contains $PSItem.PackageFullName } | Remove-AppxPackage -AllUsers
+Get-AppxProvisionedPackage -Online | Where-Object { $appxpp -contains $PSItem.PackageName } | Remove-AppxProvisionedPackage -Online -AllUsers
 </code>
@@ Line 580: / Line 701: @@
   - Boot the VM into ''WinPE'', I use a mountable ISO from our MDT environment
     - Mount the ISO and update the ''Firmware -> Boot Order'' of the VM so the ''DVD Drive'' is at the top
-  - Perform the following in the shell:<code powershell>
+  - Perform the following in the shell:<code dos>
-# Launch PowerShell
+rmdir /s /q "C:\Users\Administrator\AppData\Local\Microsoft\WindowsApps\"
-powershell
+rmdir /s /q "C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\"
-# Cleanup necessary for proper function
+rmdir /s /q "C:\Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\"
-foreach ($item in @(
+rmdir /s /q "C:\Users\Administrator\AppData\Local\MicrosoftEdge\"
-        "C:\Users\Administrator\.cisco\",
+rmdir /s /q "C:\Users\Administrator\MicrosoftEdgeBackups\"
-        "C:\Users\Administrator\3D Objects\",
+rmdir /s /q "C:\Users\Administrator\Favorites\"
-        "C:\Users\Administrator\AppData\Local\Microsoft\WindowsApps\",
+rmdir /s /q "C:\Users\Administrator\.cisco\"
-        "C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\",
+rmdir /s /q "C:\Users\Default\AppData\Local\Microsoft\WindowsApps\"
-        "C:\Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\",
+rmdir /s /q "C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache\"
-        "C:\Users\Administrator\AppData\Local\Microsoft\Windows\WebCacheLock.dat",
+rmdir /s /q "C:\Users\Default\AppData\Local\Microsoft\Windows\WebCache\"
-        "C:\Users\Administrator\AppData\Local\MicrosoftEdge\",
+rmdir /s /q "C:\Users\Default\AppData\Local\MicrosoftEdge\"
-        "C:\Users\Administrator\Favorites\*",
+rmdir /s /q "C:\Users\Default\MicrosoftEdgeBackups\"
-        "C:\Users\Administrator\Contacts\",
+rmdir /s /q "C:\Users\Default\Favorites\"
-        "C:\Users\Administrator\OneDrive\",
+rmdir /s /q "C:\Users\Default\.cisco\"
-        "C:\Users\Administrator\Searches\",
+rmdir /s /q "C:\Users\Public\"
-        "C:\Users\Default\AppData\Local\Microsoft\WindowsApps\",
+del /q "C:\Users\Administrator\AppData\Local\Microsoft\Windows\WebCacheLock.dat"
-        "C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache\",
+del /q "C:\Users\Default\AppData\Local\Microsoft\Windows\WebCacheLock.dat"
-        "C:\Users\Default\Favorites\*",
-        "C:\Users\Default\*.log",
-        "C:\Users\Default\*.blf",
-        "C:\Users\Default\*.REGTRANS-MS",
-        "C:\Users\Public\"
-    )) {
-    if ($item -match "^.*\*$") {
-        Get-ChildItem $item -Force | Remove-Item -Force -Recurse -Verbose
-    } else {
-        Remove-Item $item -Force -Recurse -Verbose
-    }
-}
-# Registry cleanup per Important block documented here: https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/customize-the-default-user-profile-by-using-copyprofile
-REG LOAD HKU\DefaultUser "C:\Users\Default\NTUSER.DAT"
-REG LOAD HKU\AdminUser "C:\Users\Administrator\NTUSER.DAT"
-REG DELETE "HKU\DefaultUser\Software\Microsoft\Windows\Shell\Associations" /v "FileAssociationsUpdateVersion" /f
-REG DELETE "HKU\DefaultUser\Software\Microsoft\Windows\Shell\Associations\UrlAssociations" /f
-REG DELETE "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" /f
-REG DELETE "HKU\AdminUser\Software\Microsoft\Windows\Shell\Associations" /v "FileAssociationsUpdateVersion" /f
-REG DELETE "HKU\AdminUser\Software\Microsoft\Windows\Shell\Associations\UrlAssociations" /f
-REG DELETE "HKU\AdminUser\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" /f
-REG UNLOAD HKU\DefaultUser
-REG UNLOAD HKU\AdminUser
-# Remove OneDrive File Explorer pin
-REG LOAD HKLM\TempSoftware "C:\Windows\System32\config\SOFTWARE"
-REG ADD "HKLM\TempSoftware\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /f /v "System.IsPinnedToNameSpaceTree" /t REG_DWORD /d 0
-REG ADD "HKLM\TempSoftware\Wow6432Node\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /f /v "System.IsPinnedToNameSpaceTree" /t REG_DWORD /d 0
-REG UNLOAD HKLM\TempSoftware
-# OPTIONAL cleanup for slimmer profiles - WILL REMOVE POTENTIALLY DESIREABLE PER-USER APPLICATION CUSTOMIZATION/DATA
-@(
-    $(Get-ChildItem "C:\Users\Administrator\AppData\LocalLow" -Force),
-    $(Get-ChildItem "C:\Users\Administrator\AppData\Local\Microsoft\Windows" -Force -Exclude "Shell", "WinX"),
-    $(Get-ChildItem "C:\Users\Administrator\AppData\Local\Microsoft" -Force -Exclude "Windows"),
-    $(Get-ChildItem "C:\Users\Administrator\AppData\Local" -Force -Exclude "Microsoft" ),
-    $(Get-ChildItem "C:\Users\Administrator\AppData\Roaming\Microsoft\Windows" -Force -Exclude "Start Menu", "SendTo"),
-    $(Get-ChildItem "C:\Users\Administrator\AppData\Roaming\Microsoft" -Force -Exclude "Windows"),
-    $(Get-ChildItem "C:\Users\Administrator\AppData\Roaming" -Force -Exclude "Microsoft" )
-    $(Get-ChildItem "C:\Users\Default\AppData\LocalLow" -Force),
-    $(Get-ChildItem "C:\Users\Default\AppData\Local\Microsoft\Windows" -Force -Exclude "Shell", "WinX"),
-    $(Get-ChildItem "C:\Users\Default\AppData\Local\Microsoft" -Force -Exclude "Windows"),
-    $(Get-ChildItem "C:\Users\Default\AppData\Local" -Force -Exclude "Microsoft" ),
-    $(Get-ChildItem "C:\Users\Default\AppData\Roaming\Microsoft\Windows" -Force -Exclude "Start Menu", "SendTo"),
-    $(Get-ChildItem "C:\Users\Default\AppData\Roaming\Microsoft" -Force -Exclude "Windows"),
-    $(Get-ChildItem "C:\Users\Default\AppData\Roaming" -Force -Exclude "Microsoft" )
-) | ForEach-Object { Remove-Item $PSItem.fullname -Force -Recurse -Verbose }
 </code>
   - Stay in ''WinPE'' for [[#capture_phase_3_-_capture_the_wim|Capture Phase 3]]