Windows 11 SEZOY - Automated Windows 10/11 Installs over LAN / VPN / WiFi: No USB, Pristine ISOs, SecureBoot ON, 100% Offline

tekdt · Tuesday at 12:20 PM

Turn any Windows PC into a network install station: open the web dashboard, load pristine ISOs, press Start - every other machine just network-boots into a fully automatic install with its own name, apps and cleanup. Quick view: the SEZOY Quick View video below | Home: the TekDT homepage | Download: the English Download page on the homepage | Installers + VPN profile: the SEZOYBIN repo under the tekdt account on GitHub Local dashboard: opened on the server machine itself (localhost, port 5893) | Internet once, fully offline afterwards.

⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
TABLE OF CONTENTS

What is SEZOY? Who is it for?
Traditional installs vs the SEZOY install
The SEZOY clean install: pick an edition, Win11 bypasses, auto apps + cleanup
Linux live boot + hardware check over the network
Requirements
TEST SEZOY from the Internet WITHOUT installing SEZOY (import .vpn + VMware)
Run your own SEZOY in 5 minutes (USB + Boot Server)
Quick FAQ
Notes for shared stress-testing

⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
1. What is SEZOY? Who is it for?

SEZOY is closed-source software for Windows 10/11 that turns your PC into a network deployment server. You work 100% in a web UI (English / Vietnamese / Chinese / Japanese); the machine to install - physical or virtual - just enables Network Boot (Legacy/UEFI PXE, wired + wireless HTTP Boot).

For you if you ever:

Hate re-flashing USBs: every new Windows build means another USB round, dying sticks, cross-infection.
Want a clean install the lazy way: ISOs stay pristine from Microsoft; computer name, language/timezone, accounts, OOBE, privacy, apps, drivers arrive at install time over the network.
Are annoyed by Win11 24H2+: forced online account, forced WiFi, BitLocker auto-encryption, ads/OneDrive - SEZOY skips them cleanly without patching the ISO.
Fear disabling SecureBoot: signed boot files mean SecureBoot-ON installs just work.
Like to tinker: live-boot Ubuntu, Mint, Debian, Kali, Arch, Fedora, Rocky… over the network, no flashing. Built-in hardware-check ISO for testing used PCs before installing.

Distributed as installers (Beta and Stable builds on the Releases page inside the TekDT installer repo on GitHub). Per-user install, then run as administrator so the app handles networking and boot services itself. FREE license built in - open and go. No telemetry, no activation-crack tools. Bring your own genuine ISOs + valid keys.

2. Traditional installs vs the SEZOY install

Traditional: USB sticks, one per machine - re-flash per build, sticks die, slow for many machines. SEZOY: network boot, no USB needed; for hands-on installs build a USB inside the same app.
Traditional: multi-ISO USB boot - still needs the physical stick, limited post-boot automation. SEZOY: same style of boot menu over the network, plus full unattended + shared driver/app catalog.
Traditional: remastering the installer per Windows build - every build means rework, error-prone, space-hungry. SEZOY: ISO stays 100% pristine, a new build is just one new ISO file.
Traditional: manual installs, next-next each step - missing drivers, missing apps, leftover junk, every box different. SEZOY: one template with auto names, auto drivers, auto apps, auto cleanup, reports back.

One rule: never touch the original ISO. Clean ISO on disk; everything else arrives at boot over HTTP.

3. The SEZOY clean install: pick an edition, Win11 bypasses, auto apps + cleanup

Reusable presets: computer name (random or PC-*), key (empty = digital license), language/keyboard/timezone, accounts + auto-logon, 4-stage scripts (CMD/PowerShell/VBScript in-browser), app picks from the app catalog, junk removal with system-app protection, drivers/updates. Preview + pre-flight checks, 1-click duplicate.
Two styles: fully automatic (zero clicks - whole house/lab) and stock Setup screens (familiar screens - odd machines/quick tests, with Win11 check skips).
Dynamic drivers: the store holds network/chipset/touchpad drivers; each machine pulls what it needs. Skipped (saves 5–10s) when unneeded.
Slim OOBE + privacy: telemetry, ads, web suggestions, OneDrive sync off; online-account/WiFi force hidden; BitLocker auto-encryption blocked.
Watch in the browser: per-machine Full-HD screens, progress %, screenshots, continue / shutdown / reboot, per-machine logs.
Offline-first + 1-click backup: everything stored on your PC; manual or daily/weekly/monthly auto backup. Move PCs without rework.

4. Linux live boot + hardware check over the network

Live-boot Ubuntu / Mint, Debian, Kali, Arch, CentOS / Rocky / Alma / Fedora, antiX, Deepin… SecureBoot ON fine.
Built-in live hardware-check ISO: machine info, CPU/RAM/disk tests, temps, risk score, report export - great before buying used or before installing Windows.
Shared add-on packs across distros (drivers, WiFi, diagnostics). Build once, faster next boots.

5. Requirements

SEZOY must run as administrator, so it handles network ports and boot services itself - you only prepare:

Server PC: Windows 10/11 x64 or Server 2022/2025, ≥8GB RAM, disk for ISOs (Windows ~5–7GB each, Linux ~2–4GB each).
Machines to install: physical machines or VMs with network boot, ≥4GB RAM.
Network: same local network, or remote over VPN. Internet once for first-run tools + activation; fully offline after.

6. TEST SEZOY from the Internet WITHOUT installing SEZOY (import .vpn + VMware)

The public test server already runs SEZOY (IP 192.168.138.1) with an open VPN Hub for testers. Your machine just joins the same Layer-2 over VPN and bridges its test VM straight into the VPN adapter - the VM PXE-boots from the remote server as if on the same switch. Shared dashboard: IP 192.168.138.1 port 5893 (if given access).

For a first look, search YouTube for the SEZOY Quick View video (video ID mX2LCXPz0PI).

6.1. Step 1 - SoftEther VPN Client + import the ready-made profile (recommended)

Install SoftEther VPN Client (tick SoftEther VPN Client).
Client Manager => New Virtual Network Adapter => memorable name (SEZOY-VPN) => Enable.
Import instead of typing: New VPN Connection Setting => Import VPN Connection Setting => pick SEZOY-VPN-Connection.vpnfrom the TekDT installer repo on GitHub. Everything fills in:
- Host: sezoyhost.vpnazure.net - Port: 443
- Hub: SEZOY.HUB
- User: tester00 (password embedded in the import; for manual entry see the current password in release notes / topic).
Double-click => Connected. Errors 1/2/691 => recheck hub/user/pass, port 443 firewall.

6.2. Step 2 - HARD-bridge the VM to the VPN NIC

⚠️ Never leave bridging on Automatic - the VM grabs your home-router IP.

Install VMware Workstation Pro (17 / 25H2).
Edit => Virtual Network Editor (Admin): free VMnet (e.g. VMnet2, Bridged) => Bridged to = exactly the SoftEther NIC => Apply.
New VM => Network Adapter => Custom: VMnet2. Tune: UEFI (Legacy after UEFI passes), ≥4GB RAM, ≥65GB disk, Network Boot / PXE first.

6.3. Step 3 - Boot and record

Power on => PXE => IP like 192.168.138.x => SEZOY menu (allow 5–15s over Internet).
Pick the shared ISO + tester template => deploy.
Record: build / distro booted, UEFI/Legacy, SecureBoot ON/OFF, boot time, errors + MAC + screenshots.
Done: clean shutdown => Disconnect VPN to free the slot.

6.4. Common issues

Straight to BIOS: wrong bridge - re-pin it.
Has IP but timeout: weak VPN or firewall - retry, test with firewall off.
Menu up but slow: normal long-distance slowness, don't reboot in loops.
VM gets a home IP (like 192.168.1.x): VMnet still Automatic - pin it and reboot the VM.

7. Run your own SEZOY in 5 minutes (USB + Boot Server)

Get the installer from the Releases page in the TekDT installer repo on GitHub (take the Beta first), background reading on the English Download page of the homepage. Install, run as administrator, open the dashboard on the server machine (localhost port 5893).
Serving NIC: the LAN/VPN NIC to serve (not the Internet-facing WAN).
Add ISOs: use your existing ISOs, or fetch genuine Microsoft ISOs right in the dashboard. Click an ISO for live editions; tick apps for post-setup.
Templates + groups: build presets (HOME-WIN11), attach catalog, OOBE/scripts/cleanup; group rules (simulator first).
Run: USB Drive tab for hands-on USBs, or BOOT Server => Start (share-the-network vs self-serve) => PXE-boot clients => auto install => watch dashboard. Enable auto backup.

8. Quick FAQ

Internet on first run? Yes - one-time activation + tools. Offline 100% after.
ISO modified? No - always pristine.
Disable SecureBoot? No.
Disk not seen during install? Load the mass-storage driver pack from the SEZOY driver catalog first.
Post-setup apps? Tick the app catalog before Create/Start.
Move servers? Per-PC fingerprint at Settings => About upgrades tiers; backup/restore moves cleanly.

Tested via the VPN above? Reply with: VM config (UEFI/Legacy, RAM), build / distro booted, SecureBoot ON/OFF, boot time, menu screenshot - so SEZOY can improve. Thanks WindowsForum folks!

9. Notes for shared stress-testing

Modest box on WiFi over the Internet - not a fiber rack.

NEVER stop the host Boot Server / quit the server app (if given dashboard access). If stopped: dashboard => Start Boot Server => VPN card (192.168.138.1) => self-serve mode. Report sudden menu loss with the time.
Only ~50 test IPs (.200–.250). Golden rule: clean shutdown => Disconnect VPN.
One VM per person. Light boot first (diagnostics, Linux live), then full Windows (gigabytes over VPN - slowness normal).
Sessions expire after ~5 idle minutes - reboot fresh.
Report properly: VM config, SecureBoot, screenshot + MAC, test time (VN time).
Maintenance: skim the topic for downtime notices before testing.

WindowsForum AI · Tuesday at 12:21 PM

Thanks for the detailed walkthrough, tekdt. A few clarifications would make the public test instructions safer and easier to reproduce:

Windows 11 VM disk size: Please change the suggested 40 GB disk to 64 GB or larger to match Microsoft’s minimum requirement.
Public VPN isolation: Are tester sessions isolated from one another, and are client-originated DHCP server packets blocked? SoftEther offers security policies for both; please confirm what is enabled on the shared hub.
Firewall troubleshooting: Please replace “firewall-off test” with instructions to collect the exact timeout/error and check the required application rules. I would not recommend disabling the host firewall for this public test.
Unattended disk selection: What prevents a template from targeting the wrong disk? Please document the selection rule and recommend disposable VMs with no physical-disk passthrough for initial testing.
Compatibility claims: A tested matrix of Windows/Linux releases, firmware, and Secure Boot state would help qualify the broad “SecureBoot ON fine” claim. Please also distinguish completely offline local deployment from testing through the Internet VPN.

Attachment check: The archive processor found SEZOY VPN Connection.vpn, but returned its contents as an unparsed binary. I therefore have not verified its endpoint, credentials, certificate-validation settings, or safety, and I have not run SEZOY or connected to the test server.
Could you clarify tester isolation and unattended disk-selection safeguards first? Those are the most important details before members try the shared deployment environment.

tekdt · 2026-09-18T02:38:43-0400

WindowsForum AI said:
Thanks for the detailed walkthrough, tekdt. A few clarifications would make the public test instructions safer and easier to reproduce:

Windows 11 VM disk size: Please change the suggested 40 GB disk to 64 GB or larger to match Microsoft’s minimum requirement.

Public VPN isolation: Are tester sessions isolated from one another, and are client-originated DHCP server packets blocked? SoftEther offers security policies for both; please confirm what is enabled on the shared hub.

Firewall troubleshooting: Please replace “firewall-off test” with instructions to collect the exact timeout/error and check the required application rules. I would not recommend disabling the host firewall for this public test.

Unattended disk selection: What prevents a template from targeting the wrong disk? Please document the selection rule and recommend disposable VMs with no physical-disk passthrough for initial testing.

Compatibility claims: A tested matrix of Windows/Linux releases, firmware, and Secure Boot state would help qualify the broad “SecureBoot ON fine” claim. Please also distinguish completely offline local deployment from testing through the Internet VPN.

Attachment check: The archive processor found SEZOY VPN Connection.vpn, but returned its contents as an unparsed binary. I therefore have not verified its endpoint, credentials, certificate-validation settings, or safety, and I have not run SEZOY or connected to the test server.
Could you clarify tester isolation and unattended disk-selection safeguards first? Those are the most important details before members try the shared deployment environment.

Hi Bot,
As you recommended, I am replying to your requirements/questions below
- When accessing this virtual intranet, everyone is equal within the LAN, and the server running the virtual intranet is a virtual machine isolated from the physical machine, so there is absolutely no problem.
- The instructions to turn off the Firewall are only troubleshooting guidance for when errors occur, and disabling the firewall is only a test for when firewall rules are too strict; with the default Windows firewall behavior, there is no problem.
- It does not affect physical drives at all; all instructions apply only to virtual machines, and the article encourages creating a new virtual machine instead of using an existing one. The automatic drive selection part is configured by the user through Windows' own unattend answer file, meaning the preset configuration is chosen by the user. In WinPE, there is no automatic execution mechanism unless the user configures it in advance through the Preset configuration on the dashboard.
- Because the project uses the iPXE bootloader from the ipxe.org project, it provides 100% SecureBoot support for Linux distros and official Windows ISOs. For distros that are not officially signed, there is still an interface to add MOK to the virtual machine. So a virtual machine with Secure Boot enabled can still be used normally, but the user needs to follow the instructions to add the MOK.
- With connecting to the VPN for testing, an internet connection is of course required to join the virtual intranet; a fully offline setup is when the user uses SEZOY to run on their own physical intranet.
- Because the forum policy does not allow attaching the plain SEZOY VPN Connection.vpn file, I compressed SEZOY VPN Connection.vpn into the file SEZOY VPN Connection.zip, so its format is binary. After extracting it, you will see the plain SEZOY VPN Connection.vpn file.

WindowsForum AI · 2026-09-18T07:31:38-0400

Thanks, tekdt—that clarifies the intended new-VM test workflow, user-configured installation presets, and the distinction between Internet testing and offline local deployment. My earlier points were suggestions, not forum requirements.
A few distinctions remain important:

Server isolation versus tester isolation: Hosting the server in a VM does not establish isolation between VPN participants. Your “everyone is equal within the LAN” description leaves that question open. Are SoftEther’s Privacy Filter and restrictions on client-originated DHCP server traffic enabled? Those are separate hub controls.
Disk selection: Understood: according to your explanation, the user explicitly configures unattended behavior through the preset and answer file. Please make “new disposable VM, virtual disks only, no physical-disk passthrough” explicit in the testing section.
Firewall: I understand that disabling it was intended only as a diagnostic test. I would still recommend collecting the exact error and checking scoped rules instead of advising a blanket firewall-off test.
Secure Boot: iPXE documents Secure Boot support for Windows through wimboot, and Linux support subject to a signed UEFI shim. That supports a conditional compatibility claim, not a universal guarantee for every ISO. Your MOK-enrollment requirement should appear alongside the headline claim rather than only in follow-up instructions.

Regarding the ZIP: you’re right to distinguish the archive from its contents. The previous processor did extract an entry named SEZOY VPN Connection.vpn, but classified that extracted entry as binary and provided no readable settings. That was a tooling limitation—not evidence that your profile was invalid or unsafe. No re-upload is necessary just to explain the packaging.
I haven’t independently tested SEZOY; your clarifications help establish what the intended test involves.

Search

Windows 11 SEZOY - Automated Windows 10/11 Installs over LAN / VPN / WiFi: No USB, Pristine ISOs, SecureBoot ON, 100% Offline

tekdt

Member

Attachments

WindowsForum AI

AI

tekdt

Member

WindowsForum AI

AI