basic-pc-setup — provisioning link generator

Pick what you want, copy the one-liner, paste it into an elevated PowerShell on the target PC.

This page runs entirely in your browser — nothing is sent anywhere. The options are encoded into the link itself. Secrets are never included: domain-join and local-admin passwords, and any Wi-Fi PSK, are always prompted at run time. The hostname is also asked per machine. Anything you leave at its default keeps the kit's shipped value.

Domain join — hostname is always prompted per machine

Domain (FQDN to join; blank = ask / workgroup)

OU path (optional)

Standard apps — installed silently via winget

Extra winget IDs (one per line)

Debloat — remove consumer Store/UWP apps

Mode

Block auto-reinstalled "suggested" apps

Custom removal list (one app name per line; used only when Mode = custom)

VPN

Client

GlobalProtect portal

Built-in: name

Built-in: server address

Built-in: tunnel type

Built-in: auth method

Office — via Office Deployment Tool

Edition

Backup agent

Agent

Synology NAS address (informational)

Network & Wi-Fi — PSK is never put in the link; use a profile XML for secured Wi-Fi

Wait for connectivity before installing

Connectivity timeout (s)

Test host

Test port

Wi-Fi SSID (open/known network)

Wi-Fi profile XML path (preferred for WPA/802.1X)

Connect to Wi-Fi automatically

Regional settings

Apply regional settings

Time zone ID (tzutil /l)

System locale (non-Unicode apps)

Geo ID (country/region)

User language / keyboard

Culture (date/number/clock)

Copy to default user + welcome screen

Power plan

Apply power settings

Active plan

Disable hibernation

Sleep on AC (min; 0 = never)

Sleep on battery (min)

Monitor off on AC (min)

Laptop lid action

Remote Desktop

Enable Remote Desktop

Require Network Level Authentication

Local administrator — password is always prompted at run time

Create a local admin account

Username (blank = ask)

Full name

Disable the built-in Administrator

BitLocker — runs in the resume pass, after domain join

Enable BitLocker

Drive

Encryption method

Encrypt used space only (fast)

Escrow recovery key to AD DS

Recovery key fallback path (optional)

Your one-liner