The heart of BypassNRO is at a certain point in the OOBE Setup, Windows checks for a specific reg key. How that key gets populated is up to you.
1. You can run the oobe\BypassNRO.cmd script. What it does is set a reg key, and then reboots.
Why does it need to reboot? By the time you get the first opportunity to enter Shift-F10 to open CMD, OOBE has gone
past the point where it checks for a BypassNRO key. Oops.
So the script restarts Windows, interrupting OOBE. But at this stage, Windows is designed to resume from the last install checkpoint -- which is OOBE again. Now in your 2nd pass through OOBE, BypassNRO is already enabled.
2. You can mount an offline install image, load a registry hive and insert the key. Now the install image has BypassNRO's key hard-coded from the start. Mounting images is too much for most average users to follow. But it's an option for technical users.
3. You can create an unattended file, or autounattend.xml in the USB device's root folder. An unattended file can automate as much, or as little, as you need. There's the option to directly create a named Local Account, which then skips the whole MS Account screen. But many users want the option to pick an account name while running OOBE, so not everyone does this trick.
Inside the unattended file, you can run Windows commands like "reg add". The bare bones autounattend.xml which does the BypassNRO (but nothing else) would be:
Code:
<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
<settings pass="specialize">
<component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<RunSynchronous>
<RunSynchronousCommand wcm:action="add">
<Order>1</Order>
<Path>reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v BypassNRO /t REG_DWORD /d 1 /f</Path>
</RunSynchronousCommand>
</RunSynchronous>
</component>
</settings>
<settings pass="windowsPE">
<component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<UserData>
<ProductKey>
<Key></Key>
</ProductKey>
</UserData>
</component>
</settings>
</unattend>
Copy this file to the USB as \autounattend.xml.
Specialize pass runs before OOBE, so your reg add is done in time. The blank <ProductKey> gets around having to provide any license key, including a generic install key. If you use a Pro generic install key, this file can't be used on Home. So leaving it blank works, since Windows install doesn't care other than having a <ProductKey> field to get the unattended file to work.
4. If you use Rufus, it does essentially the same work but it "hides" the unattended file under \Windows\Panther. This is an alternate folder which is scanned by Setup, and it takes precedence over \autounattend.xml.
Rufus creates a new folder "\sources\$OEM$\$$\Panther" on the USB drive to place its unattended file. Just a different way of doing it.
