fix: field fixes from fresh Win11 deployment (Dell Latitude / GLBNTB63)

- 02/11 winget: add --source winget to every install; fresh Win11 ISOs
  ship an App Installer with a stale pinned cert, so the msstore source
  fails with 0x8a15005e and aborts the install. Forcing the winget source
  bypasses msstore entirely.
- 10 network: enable Network Discovery by -Group "@FirewallAPI.dll,-32752"
  (resource string) instead of -DisplayGroup "Network Discovery", which is
  localized and failed on Czech Windows.
- 04 profile: set keyboard layout CZ primary + US secondary via
  Set-WinUserLanguageList (current user) and Preload in the Default hive
  and HKU\.DEFAULT (welcome screen / system accounts). Always applied.
- 02 software: verify Atera via the AteraAgent service (Get-Service) with a
  path fallback incl. C:\ProgramData, since Atera no longer installs to a
  fixed location.
- 12 windows-update: format Install-WindowsUpdate output via $_.Result/$_.Title
  instead of logging the raw object (was spamming "System.__ComObject").

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/02-software.ps1

@@ -73,7 +73,12 @@ if (Get-Feature $Config "software" "wingetInstalls") {
             Write-Log "  Starting: $($pkg.name) ($($pkg.wingetId))" -Level INFO
             $jobs += Start-Job -ArgumentList $pkg.wingetId, $pkg.name, $wingetExe -ScriptBlock {
                 param($wingetId, $name, $wingetExe)
+                # --source winget forces the winget community repo and bypasses the
+                # msstore source, which fails on fresh Win11 ISOs whose App Installer
+                # ships a stale pinned cert (0x8a15005e: server certificate did not
+                # match any expected values), aborting the install.
                 $output = & $wingetExe install --id $wingetId `
+                    --source winget `
                     --silent `
                     --accept-package-agreements `
                     --accept-source-agreements `
@@ -226,13 +231,24 @@ if (Get-Feature $Config "software" "ateraAgent") {
             Write-Log "  Atera agent install exit code: $($msiProc.ExitCode)" -Level WARN
         }
 
-        # Verify binary exists
+        # Verify install. The AteraAgent service is the most reliable signal -
-        $ateraExe   = "$env:ProgramFiles\ATERA Networks\AteraAgent\AteraAgent.exe"
+        # the agent registers it regardless of install path (Atera now sometimes
-        $ateraExe86 = "${env:ProgramFiles(x86)}\ATERA Networks\AteraAgent\AteraAgent.exe"
+        # lands under C:\ProgramData instead of Program Files). Fall back to the
-        if ((Test-Path $ateraExe) -or (Test-Path $ateraExe86)) {
+        # known binary locations if the service query is inconclusive.
-            Write-Log "  Atera agent binary verified" -Level OK
+        $ateraSvc = Get-Service -Name "AteraAgent" -ErrorAction SilentlyContinue
+        if ($ateraSvc) {
+            Write-Log "  Atera agent verified (service AteraAgent present, status $($ateraSvc.Status))" -Level OK
         } else {
-            Write-Log "  Atera agent binary not found at expected paths" -Level WARN
+            $ateraPaths = @(
+                "$env:ProgramFiles\ATERA Networks\AteraAgent\AteraAgent.exe"
+                "${env:ProgramFiles(x86)}\ATERA Networks\AteraAgent\AteraAgent.exe"
+                "$env:ProgramData\ATERA Networks\AteraAgent\AteraAgent.exe"
+            )
+            if ($ateraPaths | Where-Object { Test-Path $_ }) {
+                Write-Log "  Atera agent binary verified" -Level OK
+            } else {
+                Write-Log "  Atera agent service and binary not found at expected paths" -Level WARN
+            }
         }
     }
     catch {

scripts/04-default-profile.ps1

@@ -344,6 +344,47 @@ $pinList
                    -Name "WallpaperStyle" -Value "0" -Type "String"
     Set-ProfileReg -SubKey "Control Panel\Desktop" `
                    -Name "TileWallpaper" -Value "0" -Type "String"
+
+    # ===================================================================
+    # KEYBOARD LAYOUTS - Czech primary, US secondary
+    # ===================================================================
+    # CZ stays the primary input language; US English is added as a harmless
+    # secondary so programmer/special chars are reachable. Applied in three
+    # places so every account type gets it:
+    #   - current user (adminx9) via Set-WinUserLanguageList
+    #   - Default profile hive -> every newly created user inherits it
+    #   - HKU\.DEFAULT         -> welcome screen and system/service accounts
+    # KLIDs: 00000405 = Czech, 00000409 = US English.
+    Write-Log "Configuring keyboard layouts (CZ primary, US secondary)" -Level STEP
+
+    function Set-PreloadLayouts {
+        param([string]$KeyPath)   # full Registry:: path to the "...\Keyboard Layout\Preload" key
+        try {
+            if (-not (Test-Path $KeyPath)) { New-Item -Path $KeyPath -Force -ErrorAction Stop | Out-Null }
+            Set-ItemProperty -Path $KeyPath -Name "1" -Value "00000405" -Type String -Force -ErrorAction Stop
+            Set-ItemProperty -Path $KeyPath -Name "2" -Value "00000409" -Type String -Force -ErrorAction Stop
+            Write-Log "  Preload set (1=CZ, 2=US): $KeyPath" -Level OK
+        }
+        catch {
+            Write-Log "  Failed to set Preload at $KeyPath - $_" -Level WARN
+        }
+    }
+
+    # Current user: use the language-list API so the secondary layout shows up
+    # in the language bar, not just the raw Preload key.
+    try {
+        $langs = New-WinUserLanguageList -Language "cs-CZ"
+        $langs.Add("en-US")
+        Set-WinUserLanguageList -LanguageList $langs -Force -ErrorAction Stop
+        Write-Log "  Current user language list set (cs-CZ + en-US)" -Level OK
+    }
+    catch {
+        Write-Log "  Set-WinUserLanguageList failed - $_" -Level WARN
+    }
+
+    # New users (Default profile hive) and welcome screen / system accounts (.DEFAULT)
+    Set-PreloadLayouts -KeyPath "Registry::HKU\DefaultProfile\Keyboard Layout\Preload"
+    Set-PreloadLayouts -KeyPath "Registry::HKU\.DEFAULT\Keyboard Layout\Preload"
 }
 finally {
     # -----------------------------------------------------------------------

scripts/10-network.ps1

@@ -85,8 +85,11 @@ catch {
 Write-Log "Enabling Network Discovery" -Level INFO
 
 try {
-    # Enable all Network Discovery rules for Private profile
+    # Enable all Network Discovery rules for Private profile.
-    Get-NetFirewallRule -DisplayGroup "Network Discovery" -ErrorAction Stop |
+    # Match by -Group resource string ("@FirewallAPI.dll,-32752") rather than
+    # -DisplayGroup: the display name is localized (e.g. "Zjistovani site" on
+    # Czech Win11), so DisplayGroup matching fails on non-English installs.
+    Get-NetFirewallRule -Group "@FirewallAPI.dll,-32752" -ErrorAction Stop |
         Where-Object { $_.Profile -match "Private|Any" } |
         Enable-NetFirewallRule -ErrorAction SilentlyContinue
     Write-Log "  Network Discovery rules enabled (Private)" -Level OK

scripts/11-dell-update.ps1

@@ -52,9 +52,13 @@ Write-Log "Dell confirmed: $model" -Level OK
 # -----------------------------------------------------------------------
 Write-Log "Installing Dell Command | Update (Universal)..." -Level STEP
 
+# --source winget forces the winget community repo and bypasses the msstore
+# source, which fails on fresh Win11 ISOs whose App Installer ships a stale
+# pinned cert (0x8a15005e), aborting the install.
 $wingetArgs = @(
     "install",
     "--id",   "Dell.CommandUpdate.Universal",
+    "--source", "winget",
     "--silent",
     "--accept-package-agreements",
     "--accept-source-agreements"

scripts/12-windows-update.ps1

@@ -65,8 +65,15 @@ if (-not $available -or @($available).Count -eq 0) {
 
 Write-Log "  Found $($available.Count) update(s) - installing..." -Level INFO
 try {
-    $result = Install-WindowsUpdate -AcceptAll -IgnoreReboot -Verbose 2>&1
+    # Format each update via its properties. Logging the raw object ($_) renders
-    $result | Where-Object { "$_" -match '\S' } | ForEach-Object { Write-Log "  $_" -Level INFO }
+    # as "System.__ComObject" because the WUApiLib result objects have no useful
+    # ToString(); -Verbose 2>&1 also merged verbose-stream noise into the log.
+    $result = Install-WindowsUpdate -AcceptAll -IgnoreReboot
+    foreach ($u in $result) {
+        if ($u.Title) {
+            Write-Log ("  {0} - {1}" -f $u.Result, $u.Title) -Level INFO
+        }
+    }
     Write-Log "  Update pass complete - reboot required for next round" -Level OK
 } catch {
     Write-Log "  Update install failed: $_" -Level ERROR