Install Windows 21H1 without Internet - set up local user only?

[timeshifter]

now that cheap box isn't worth it.

I've lectured and berated this customer several times over the years about this. They still will run to Sam's club or Best Buy and pick up a machine. Maybe this will be the last. Ugh.

 

[sapphirescales]

You're talking about Windows 11?

Sorry, yes.

 

[NviGate Systems]

I was just testing my VM with Windows 11, (22000) and if the VM doesn't have LAN connectivity, it won't let you go forward. However, if I temporary connect the LAN, it continues. The trick is to disconnect the LAN while it's trying to check for updates. It now prompts me for a username, and not a MS account. We'll see what happens later once OOBE finishes.

 

[timeshifter]

USB installer on a different laptop, a Dell 8th generation that came with Windows Pro, I get the "I don't have Internet" and "Continue with Limited Setup" choices.

 

[NviGate Systems]

Pro has a different policy on account setup. From what I recall. Home is going to be the nasty one.

 

[timeshifter]

Ran the USB installer on the same laptop again, wiped the drive, same result.

Ran a 20H2 installer, wiped drive (i.e. deleted all partitions and picked Drive 0 unallocated space as my destination, like I always do on a clean install). Same result.

So, must be something about this laptop. Or may be something about my hacked installer AND this laptop. But the hacked installer doesn't behave that way on other machines.

Going to use the Media Creation Tool and create a new USB installer without any funny business.

 

[Sky-Knight]

@timeshifter

This is my ei.cfg

[Channel]
_Default
[VL]
0

This doesn't enforce a channel change, it just lets you feed it a key, or pick an edition and feed the key later.

You shouldn't need the file at all if all you're trying to do is install what the unit was licensed with, as it will pull the key from the BIOS and install the appropriate version for you.

 

[timeshifter]

Going to use the Media Creation Tool and create a new USB installer without any funny business.

Don't get to pick OS flavor at install, but it goes smoothly and I can even skip using a MS account. It installs Windows 10 Home in S mode just as God intended.

I tried @Sky-Knight 's ei.cfg and it behaved the same.

Sigh. Don't know what to do now.

My plan was to install Pro then have them pick up an OEM Windows 10 Pro on Amazon and activate it. I'm tired of fooling with the MS upgrade process where you buy the upgrade from within Windows.

Maybe that way will be easier still.

I guess I could go ahead and sign in with a MS account, but that feels dirty.

 

[NviGate Systems]

I think in weird situations like this you can roll your own DVD ISO that only has the Pro index. You will need to use dism for this, and only works if your media uses WIM image, not that other type, can't recall the extension. Then you can burn that ISO to a USB. Since only the pro index is available, that should be all that will install. In theory.

 

[britechguy]

I guess I could go ahead and sign in with a MS account, but that feels dirty.

Why? And that's a serious question?

I can't imagine why any tech would not have a Microsoft Account that's dedicated strictly to testing and setup uses. As soon as you've set up the machine, you can simply create a local account with admin privilege, then use it to nuke the MS-Account-linked Win10 user account.

I just really, really don't get the resistance to the Microsoft Account. It's directly analogous to Apple, Google, and any of a number of other accounts. But if a given user doesn't want one, they don't have to have it. But you, as a technician, certainly do, if for no other purpose than making your own life easier.

 

[Sky-Knight]

I can't imagine why any tech would not have a Microsoft Account that's dedicated strictly to testing and setup uses. As soon as you've set up the machine, you can simply create a local account with admin privilege, then use it to nuke the MS-Account-linked Win10 user account.

One last step, log into said account at Microsoft.com, hit the devices section, and remove the errant device from the list. Otherwise your customer will have an issue claiming it and ensuring the bitlocker key is backed up to their account, instead of yours.

 

[timeshifter]

And MS makes the machine "owned" by whomever signs up with it first.

One last step, log into said account at Microsoft.com, hit the devices section, and remove the errant device from the list. Otherwise your customer will have an issue claiming it and ensuring the bitlocker key is backed up to their account, instead of yours.

Could you clarify what you mean by "owned"? Bitlocker key? Activation? Does removing it from the devices list in the account reset and release all these little things?

 

[britechguy]

Better yet, ask your client if they have a Microsoft Account and use it when setting up the machine. They can temporarily change their password on that account "for the duration" if they don't want you to have "the master password" and it takes mere moments for them to do at Microsoft.com.

I seldom do "out of the box" setups for anyone unless I'm doing them on site, and if that's the case they get a Microsoft Account created if they did not have one. If they wish to use a local account then I'll set one up, but at least then everything "is owned by them" from the outset and they have a Microsoft Account.

The days of not having a Microsoft Account, whether you use it with Windows 10 or 11 with a linked user account or not, are over as far as I am concerned. You've got to have one and I'm not going through gyrations of using a "fake account" except on those very rare occasions where I have a very recalcitrant client. And in most cases, after a few minutes discussion, they don't insist on using a local account. There are lots of advantages to the whole linking and syncing that comes with using a Windows account that is linked to your Microsoft Account.

 

[Sky-Knight]

If our customers have their accounts properly secured, that's flat not an option @britechguy.

MFA is all but mandated now, at least SMS based. We cannot login as our customers. And that's the point!

@timeshifter I'm not sure why this is confusing. You need an MS account to setup a machine, the MS account then OWNS it, as in it's in the device list. You need to remove it because it's not yours. The next person that logs in with an MS account will then "own" the machine. Or the owner can manually add it to their device list. Devices listed in an account will get a copy of the bitlocker recovery key when it's generated.

 

[NviGate Systems]

It's almost like Microsoft is saying if you can't secure your accounts or figure it out, you don't deserve to have a machine. (The point about needing an account)

 

[Sky-Knight]

It's almost like Microsoft is saying if you can't secure your accounts or figure it out, you don't deserve to have a machine. (The point about needing an account)

Why not? Apple and Google make us all have accounts on our mobile devices, and no one bats an eye at it. There are some things we cannot fix, and shouldn't be plastering over.

 

[NviGate Systems]

I don't disagree though.

 

[britechguy]

MFA is all but mandated now, at least SMS based. We cannot login as our customers. And that's the point!

There is this thing called the telephone, or text. I have had people call me with verification codes or text them to me on rare occasion.

The fact is that where there is a will there is a way, and particularly when you, and the client, are "in cahoots" with each other.

MFA keeps "the random stranger" from having unauthorized access. It certainly doesn't, of necessity, prevent a tech legitimately working in consort with the actual account owner from having authorized access. It just requires coordination.

 

[Sky-Knight]

There is this thing called the telephone, or text. I have had people call me with verification codes or text them to me on rare occasion.

The fact is that where there is a will there is a way, and particularly when you, and the client, are "in cahoots" with each other.

MFA keeps "the random stranger" from having unauthorized access. It certainly doesn't, of necessity, prevent a tech legitimately working in consort with the actual account owner from having authorized access. It just requires coordination.

This does work, and is even more easily done with proper MFA via MS Authenticator. But... it takes time. I find my customers do not respect my time or availability on this. So I just don't go there.

 

[timeshifter]

the MS account then OWNS it, as in it's in the device list. You need to remove it because it's not yours. The next person that logs in with an MS account will then "own" the machine. Or the owner can manually add it to their device list. Devices listed in an account will get a copy of the bitlocker recovery key when it's generated.

Besides storing a copy of the Bitlocker key, what's the benefit of having the Microsoft account "owning" the system?