Deployment profiles

A machine that comes out of the oven finished: named, localized, joined.

A profile is a bundle of identity settings the technician picks at deploy time. The same golden image plus a different profile produces an accounting workstation, a lab machine, or a kiosk — no per-machine fiddling afterward.

Computer name templates

The template builds each machine's name at deploy time. Plain text passes through; tokens are replaced per machine:

Examples: ACCT-{SEQ:03} → ACCT-001, ACCT-002, …  |  LAB-{SERIAL} → LAB-9XJ4L83.

Names are sanitized to NetBIOS rules: uppercased, letters/digits/hyphens only, trimmed to 15 characters. The rename is applied offline to the deployed image's registry, so it works on any image — sysprepped or not.

Locale and time zone

Locales are BCP-47 codes (en-US, de-DE, pt-BR…). Time zones are Windows time-zone names — run tzutil /l on any Windows machine for the full list (Eastern Standard Time, W. Europe Standard Time, UTC…). The console suggests common values as you type; anything valid is accepted. Both apply via unattend answers, which fire on generalized (sysprepped) images.

Local admin account

When set, the deploy ensures a local administrator with that name and password exists on the machine at first boot — your bench/support account, present everywhere.

The password (and the domain-join account password below) are encrypted at rest on the Forge with a key that lives only on that machine's local disk — not in the image store, so a store relocated to a NAS/UNC share never carries the key with it. A disaster-recovery backup includes the key (so a restore onto a replacement Forge still works); anyone with filesystem access to just the store, without the Forge box itself, sees ciphertext.

Skipping the out-of-box experience

A generalized (Sysprep) image normally comes up in Windows Setup's out-of-box experience, and recent Windows builds push hard for a Microsoft account there — on a machine with a network connection there may be no visible way past it. Deploying a deployment image now answers those screens automatically, so the PC reaches a desktop without a technician clicking through setup.

Set a local admin account and a locale on the profile to skip OOBE entirely. The deploy screen tells you which of the two is missing:

The account you set becomes a local administrator on the deployed machine, and it is the same account described under local admin account above — one setting, not two.

Domain identity

Whenever a profile is applied, the deployed machine's first-boot script checks whether it's carrying an inherited domain identity and removes that identity before any new join. This matters because a captured golden image is very often domain-joined itself: cloning it duplicates the source machine's Active Directory computer-account identity onto every deployment, which shows up later as "the trust relationship between this workstation and the primary domain failed" and used to mean unjoining and rejoining by hand on every deployed machine. ImageForge performs that sequence in explicit phases: authenticated domain leave, restart into WORKGROUP, activate the selected computer name, restart if required, join with the active name, then restart once more before running the profile's custom first-boot script.

First-boot script

Runs once, as SYSTEM, after Windows setup and managed identity work complete on the deployed machine (SetupComplete.cmd). Use it for agent installs, config pulls, domain joins at scale — anything you'd otherwise do by hand on first login. ImageForge's local-admin and domain work runs before this custom command. The custom command runs in an isolated child process and its start and exit code are written to ImageForge-firstboot.log, so an exit or restart inside it cannot skip or repeat managed identity setup. Keep custom work idempotent.

What applies when?