refactor: reduce to one command and show checksums before applying - #32
Merged
Merged
Conversation
The project documented four ways to run this (iex one-liner, CMD wrapper,
script block with -Force, script block with -NoReboot) plus a separate
autounattend.xml-on-USB path. Only the one-liner is needed:
iex(irm bypassnro.thectic.nl/bypass.ps1)
bypass.ps1:
- drop all parameters (-UnattendUrl, -Destination, -Force, -NoReboot) and the
Start-BitsTransfer fallback, backup-existing-answer-file and exit-code paths
that only existed to support them
- print the SHA256 of unattend.xml and bypass.ps1 and ask the reader to compare
them with the checksums on https://bypassnro.thectic.nl/ before continuing
- spell out in the prompt what is about to happen: the account names Admin
(Administrators, no password, auto sign-in once) and User (Users, no
password), the restart into OOBE, and setting passwords afterwards
- nothing is written until the confirmation is answered, so a mismatched
checksum can still be backed out of
- separate the download failure and the "this is not an answer file" messages
unattend.xml: drop the five empty <settings> passes and trim the header.
README and site: one command, no flags, no USB path. Record that the method was
last tested on 19 September 2026 on build 26200.9457 (Windows 11 25H2) and
looks unaffected on 26H2, and republish both checksums.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BqTk2sxf7NP6DRHe91T3iq
Windows setup runs OOBE under a temporary account called defaultuser0, so that is who you are in the console Shift+F10 opens. Any other account means the computer is most likely already set up, where Sysprep /oobe sends the whole machine back through setup instead of just skipping an account screen. The script now names the account it found, says what continuing would do, and requires the word CONTINUE before it downloads anything. A plain y is not enough, so answering the later confirmation out of habit cannot reset a working computer. defaultuser0 goes straight through as before. Documented on both language versions and in the README, and republished the bypass.ps1 checksum. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BqTk2sxf7NP6DRHe91T3iq
Nothing calls Get-Help on a script that is fetched and executed in one go, so the 35-line help block only added weight. A nine-line header says what it does and what it costs; the details it repeated are already in the README and on the site. Puts bypass.ps1 back at 188 lines, the size it was before the checksum display and the defaultuser0 warning were added. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BqTk2sxf7NP6DRHe91T3iq
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Fix checksum verification to hash the executed payload and remove the obsolete USB-path instruction.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (1)
What changed in this PR
Refactors BypassNRO to a single interactive PowerShell command with checksum confirmation and refreshed documentation.
Changes:
- Simplifies
bypass.ps1and removes legacy options. - Trims
unattend.xml. - Updates English/Dutch documentation, README, and contribution guidance.
| File | Summary |
|---|---|
src/static/unattend.xml |
Removes empty settings passes; retains an outdated USB-path instruction (nit). |
src/static/bypass.ps1 |
Simplifies download and confirmation flow; checksum verification hashes a separate fetch (critical). |
src/content/_index.nl.md |
Updates Dutch usage guidance and checksums. |
src/content/_index.md |
Updates English usage guidance and checksums. |
README.md |
Documents the single-command workflow. |
CONTRIBUTING.md |
Updates the commit-message example. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+84
to
+87
| # bypass.ps1 is downloaded a second time purely so its checksum can be shown | ||
| # below; only unattend.xml is used for anything. | ||
| Invoke-WebRequest -Uri $unattendUrl -OutFile $answerFile -UseBasicParsing | ||
| Invoke-WebRequest -Uri $scriptUrl -OutFile $scriptCopy -UseBasicParsing |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
bypass.ps1:
Start-BitsTransfer fallback, backup-existing-answer-file and exit-code paths
that only existed to support them
them with the checksums on https://bypassnro.thectic.nl/ before continuing