From 57d6b19c058ebcf2226a84bbf5843fefe203762f Mon Sep 17 00:00:00 2001 From: LusineStar <234928548+LusineStar@users.noreply.github.com> Date: Sun, 26 Jul 2026 21:42:06 +0800 Subject: [PATCH] fix(kvm): correct Windows FirstLogon drive-scan batch syntax The unattend FirstLogonCommands runs via 'cmd.exe /c' (command-line context), where a FOR loop variable must be %d, not the batch-file form %%d. The %%d form raised '%%d was unexpected at this time', so the else branch that locates and runs FirstLogon.ps1 from the unattend ISO never executed. Combined with $OEM$ not being processed from a separate ISO (so C:\CLICD\FirstLogon.ps1 is never staged), the entire Windows post-install init was skipped: RDP was never enabled, the firewall was never opened, and the network profile stayed Public, so the guest dropped all inbound traffic. The host NAT DNAT for 3389 was correct, but the guest silently dropped it, making the mapping appear to have no effect. --- backend/internal/kvm/kvm.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/internal/kvm/kvm.go b/backend/internal/kvm/kvm.go index 4599676..64fc005 100644 --- a/backend/internal/kvm/kvm.go +++ b/backend/internal/kvm/kvm.go @@ -1906,7 +1906,7 @@ func windowsAutounattendXML(hostname, adminPassword string, windows11 bool) stri hostname = "clicd-win" } hostname = sanitizeWindowsComputerName(hostname) - setupCommand := `cmd.exe /c if exist C:\CLICD\FirstLogon.ps1 (powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\CLICD\FirstLogon.ps1) else (for %%d in (D E F G H I J K L M N O P Q R S T U V W X Y Z) do @if exist %%d:\FirstLogon.ps1 powershell.exe -NoProfile -ExecutionPolicy Bypass -File %%d:\FirstLogon.ps1)` + setupCommand := `cmd.exe /c if exist C:\CLICD\FirstLogon.ps1 (powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\CLICD\FirstLogon.ps1) else (for %d in (D E F G H I J K L M N O P Q R S T U V W X Y Z) do @if exist %d:\FirstLogon.ps1 powershell.exe -NoProfile -ExecutionPolicy Bypass -File %d:\FirstLogon.ps1)` compatibilityCommands := "" if windows11 { compatibilityCommands = `