Deployment profiles

A machine that comes out of the oven finished: named, localized, joined.

A profile is a bundle of identity settings the technician picks at deploy time. The same golden image plus a different profile produces an accounting workstation, a lab machine, or a kiosk — no per-machine fiddling afterward.

Computer name templates

The template builds each machine's name at deploy time. Plain text passes through; tokens are replaced per machine:

Examples: ACCT-{SEQ:03} → ACCT-001, ACCT-002, …  |  LAB-{SERIAL} → LAB-9XJ4L83.

Names are sanitized to NetBIOS rules: uppercased, letters/digits/hyphens only, trimmed to 15 characters. The rename is applied offline to the deployed image's registry, so it works on any image — sysprepped or not.

Locale and time zone

Locales are BCP-47 codes (en-US, de-DE, pt-BR…). Time zones are Windows time-zone names — run tzutil /l on any Windows machine for the full list (Eastern Standard Time, W. Europe Standard Time, UTC…). The console suggests common values as you type; anything valid is accepted. Both apply via unattend answers, which fire on generalized (sysprepped) images.

Local admin account

When set, the deploy ensures a local administrator with that name and password exists on the machine at first boot — your bench/support account, present everywhere.

The password (and the domain-join account password below) are encrypted at rest on the Forge with a key that lives only on that machine's local disk — not in the image store, so a store relocated to a NAS/UNC share never carries the key with it. A disaster-recovery backup includes the key (so a restore onto a replacement Forge still works); anyone with filesystem access to just the store, without the Forge box itself, sees ciphertext.

Domain identity

Whenever a profile with any settings below is applied, the deployed machine's first-boot script always checks whether it's currently domain-joined and, if so, leaves that domain — even if you leave every field on this page blank. This matters because a captured golden image is very often domain-joined itself: cloning it duplicates the source machine's Active Directory computer-account identity onto every deployment, which shows up later as "the trust relationship between this workstation and the primary domain failed" and used to mean unjoining and rejoining by hand on every deployed machine. The client now fixes this automatically, the same way an administrator would by hand: Remove-Computer -Force (works even when the machine can't reach a domain controller to leave cleanly), then, only if you fill in a domain below, Add-Computer with the account you provide.

First-boot script

Runs once, as SYSTEM, after Windows setup completes on the deployed machine (SetupComplete.cmd). Use it for agent installs, config pulls, domain joins at scale — anything you'd otherwise do by hand on first login. Keep it idempotent; there is no retry UI on a machine that's already in a user's hands.

What applies when?