Technical Anshu
Tutorials Blog
📦 Setup Scripts

Install Your Standard Apps Automatically During Windows Setup with Setup Scripts

A custom ISO that only removes things is half a tool. With one script file in the right folder, the same install also lays down your standard apps — browser, PDF reader, office suite — before the desktop ever appears.

✍️ Technical Anshu🪟 Windows 10 / 11⏱️ 8 minute read
🎥 Watch the complete video — building a custom Windows ISO, removing unwanted components and setting the bypass options step by step

Windows Setup has a built-in hook for exactly this job: a script named SetupComplete.cmd that Setup runs once, at the end of installation, before the first sign-in, with full system privileges. Place your installers in the image's $OEM$ structure so they are copied onto the disk during setup, call them with their silent switches from that script, and log everything. Done well, a technician's standard build — Windows plus the office app set — finishes unattended. Done casually, the script fails silently and nobody notices until the customer does.

Install media — the $OEM$ folder structure Setup copies automatically
sources\$OEM$\$$\Setup\Scripts\SetupComplete.cmd lands here
sources\$OEM$\$1\Installers\copied to C:\Installers on the target
Copied during setupbefore SetupComplete runs
Runs asSYSTEM, before first sign-in
The $$ folder maps to the Windows folder on the installed system; $1 maps to the root of the system drive.
1

How the Mechanism Works

  1. Folders under sources\$OEM$ on the install media are copied to matching locations during setup: $$ becomes the Windows folder, $1 becomes the system drive root
  2. SetupComplete.cmd placed in $$\Setup\Scripts therefore arrives at C:\Windows\Setup\Scripts\SetupComplete.cmd on the new system — the exact path Setup executes at the end of installation
  3. It runs as SYSTEM with no user signed in: perfect for machine-wide installers, useless for anything that needs a user profile, a licence sign-in, or a visible window
  4. For per-user finishing touches, use FirstLogonCommands in the answer file instead — they run at the first sign-in, in the user's context
2

Write the Script Defensively

  1. Call every installer with its documented silent switches — for MSI packages: msiexec /i C:\Installers\app.msi /qn /norestart
  2. EXE installers differ by vendor: many accept /S, /quiet or /silent — verify each one on a test machine; a wrong switch opens a window nobody will ever click, and setup waits
  3. Use start /wait for installers that return before they finish, so the next line does not race them
  4. Log ruthlessly: end each line with >> C:\Windows\Setup\Scripts\setup-log.txt 2>&1 so a failure leaves evidence instead of silence
  5. Keep the script short and boring: installers only. Configuration that needs the finished system belongs in a first-logon step
3

The Rules That Decide Success

  1. Order matters: runtimes and frameworks first (several apps need them), then the apps, then anything that reboots — and avoid forced reboots mid-script entirely with /norestart
  2. Size matters: every installer you embed is copied on every install. A lean, current app set beats a museum of versions
  3. Licences matter: the script installs software unattended; activation and per-app licensing still follow each vendor's terms — the script is a delivery truck, not a licence
  4. Test the exact media: a script that works from your bench folder can still fail from the ISO if a path, a switch or a copy step is wrong — the VM test in this series exists for this reason
4

When SetupComplete Does Not Run ⭐

  1. On many OEM-style installs, Setup skips the script if the product key situation marks the install as an OEM deployment — test on your actual media and key type, not just in theory
  2. A script with a syntax error exits instantly and quietly — another reason the log file is non-negotiable; if the log does not exist, the script never ran
  3. If the script ran but one app is missing, read the log top-down: the first failing installer is the story, everything after it is usually fallout
  4. Keep a post-install checklist anyway. Automation installs the standard set; a human verifies it — that split is what makes the process professional

🎥 Watch the Complete Video Guide

Every checkbox, removal and bypass option from this page is shown live in the full video — watch it end to end before you build your own ISO.

▶️ Watch Full Video
❓ Frequently Asked Questions

What is the difference between SetupComplete.cmd and FirstLogonCommands?

SetupComplete.cmd runs once at the end of Setup, as SYSTEM, before anyone signs in — right for machine-wide program installs. FirstLogonCommands run when the first user signs in, in that user's context — right for per-user settings and shortcuts. Most standard builds use both.

Can I put the installers on the USB instead of inside the image?

Yes — many builders keep a separate Installers folder on the media and reference it from the script or from FirstLogonCommands. Embedding via $OEM$ makes the set travel with the image; a media folder makes it easier to update. Either works if paths are tested.

Why did my script open an installer window and stop the whole setup?

One installer did not accept the silent switch you gave it, so it waited for a click that never comes during unattended setup. Test every installer command by hand on a spare machine first, and always prefer MSI packages with /qn when a vendor offers them.

This guide is based on the Technical Anshu video on building your own Windows ISO and removing unwanted components • Stuck on a step? Ask in the video comments — you will get help 🙏