Can't get LGPO.exe to work in SetupComplete.cmd

[clarkg888]

I am working on my first custom ISO with NTLite. Using Windows 11 LTSE IoT 2024 as the basis.

I have added some logging to the SetupComplete.cmd that NTLite creates as follows:

CD "%TEMP%"&CLS&@TITLE Post-Setup tasks
set logfile=SetupComplete.log
:: Load policy
%~dp0LGPO.exe /r %~dp0regpol_machine.txt /w "%SystemRoot%\System32\GroupPolicy\Machine\Registry.pol" /v 2>&1 >>%logfile%
%~dp0LGPO.exe /r %~dp0regpol_user.txt /w "%SystemRoot%\System32\GroupPolicy\User\Registry.pol" /v 2>&1 >>%logfile%
:: Turn sharing and network discovery on
netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes 2>&1 >>%logfile%
netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes 2>&1 >>%logfile%
:: del /q /f "%WINDIR%\Setup\Scripts\NTLCompName.vbs"
:: del /q /f "%0"

The files LGPO.exe regpol_machine.txt and regpol_user.txt are in the sources\$OEM$\$$\Setup\Scripts folder on the ISO.

After installation and logging in with the admin account, it seems that LGPO.exe did not run. The .pol files are not created. SetupComplete.log only has the output from the netsh commands, nothing from LGPO.exe.
If I run SetupComplete.cmd from an elevated command prompt of the admin user after login, it works as expected.

Using NTLite version 2025.12.10723 with home license.
What am I doing wrong?

 

[clarkg888]

I got this to work by:
1. using LGPO.exe /t option instead:

LGPO.exe /t "%Src%\regpol_machine.txt" /v
LGPO.exe /t "%Src%\regpol_user.txt" /v

2. Moved to the Post Setup - After Logon section.
This was necessary because I used a .reg file integrated in the registry section to block Windows Updates. then re-enable with the controlled Windows update settings I wanted with the LGPO.exe policy import. If I put in Before Login section it re-enabled update too soon and got updates during install.

My approach to Windows Update is to enable, but set to notify only. I wait 2 or 3 weeks after patch Tuesday to ensure there are no updates that break things I care about, then I install them from the Windows update control panel manually. This setup in NTLite allows me to not worry if I am installing a new computer during the waiting period after patch Tuesday