ConX Setup fails unattended install on multi-edition business media: "Setup has failed to validate the product key" (0x8007000D)

[DevSecNinja]

Summary

Building an ISO from Windows 11 business/volume multi-edition media (e.g. en-us_windows_11_business_editions_version_26h1_...x64...iso) produces an ISO that cannot complete an unattended install. In the Hyper-V boot test (and on the target VM generally) Windows Setup aborts almost immediately with:

Setup has failed to validate the product key

The consumer/Home ISO (downloaded via Fido) installs fine with the same tooling. The difference is that the business media boots the redesigned "ConX" (Connected Experience) Setup, while the older consumer media runs legacy Setup.

This tracks the investigation so far and the candidate fixes, since active troubleshooting is paused.

Environment

• Media: Windows 11 business editions, 26H1 (multi-edition install.wim, ~6.85 GB), build reported in logs as 10.0.28000.2179 / 10.0.28000.2269.
• install.wim contains 10 indices: Education, Education N, Enterprise, Enterprise N, Pro (index 5), Pro N, Pro Education, Pro Education N, Pro for Workstations, Pro N for Workstations. No Home.
• sources\EI.CFG = [Channel] Volume, [VL] 1 → genuine volume/business channel media (the tool does not write EI.CFG).
• Boot test host: Wi-Fi-only laptop, Hyper-V "Default Switch" (NAT). WinPE-phase DNS via the Default Switch ICS proxy is unreliable (can ping 8.8.8.8 but name resolution fails).
• Boot test VM: Gen2 (UEFI), boots the built ISO from a synthetic SCSI DVD.

Symptom / observed behaviour

• Fails immediately at a "Setup has failed to validate the product key" dialog — no edition or key prompt is shown.
• Reproduces regardless of the product key supplied:
  • Pro retail-generic install key
  • Pro GVLK / KMS client key
  • Pro MAK key
  • No key at all (keyless)
• Reproduces both with the VM online (Default Switch, broken WinPE DNS) and fully offline (NIC disconnected).

Root-cause evidence (from harvested WinPE logs)

Setup runs in three stages; the useful log is written by SetupHost.exe, not the empty X:\Windows\setuperr.log.

X:\Windows\Logs\MoSetup\BlueBox.log (SetupPrep /boot):

Determining whether we should run ConX or legacy setup
Will launch ConX setup experience
Launching X:\Sources\SetupPrep.exe /boot
CBootScenarioCtrl::PopulateWorkingDir: Install.wim/swm/esd was not found!   <- benign /boot prep line
Launching process: [X:\Sources\SetupHost.exe] with command-line [/Install /Boot ]

Also a warning (appears on working media too, likely benign):

UnattendSearchSetupSourceDrive: Unable to convert ARC path [MULTI(0)DISK(0)CDROM(0)] to NT path; status = 0x80070002

The autounattend IS found and applied for windowsPE: Found usable unattend file for pass [windowsPE] at [D:\autounattend.xml].

X:\$WINDOWS.~BT\Sources\Panther\setuperr.log (SetupHost — the real failure):

12:27:31  MOUPG  CMoSetupOneSettingsHelperT::InitializeSettings: Result = 0x80072EE7   (WININET name-not-resolved; offline)
12:27:31  MOUPG  CSetupHost::InitializeOneSettings: Result = 0x80072EE7
12:27:31  MOUPG  SetupHost: OneSettings initialization failed: [0x80072EE7]
12:27:31  MOUPG  CSetupManager::GetWuIdFromRegistry: Result = 0x80070002
12:27:31  MOUPG  CDlpActionProductKeyValidate::ReportDownlevelInstallChannel: Result = 0x80070490
12:27:31  MOUPG  ProductKey: Failed to report Host OS channel to telemetry.
   ... ~15 second gap ...
12:27:46  MOUPG  CDlpActionProductKeyValidate::SelectImageFromResponse: Result = 0x8007000D   <-- FATAL
12:27:46  MOUPG  CDlpActionProductKeyValidate::SelectImageIndex:        Result = 0x8007000D
12:27:46  MOUPG  CDlpActionProductKeyValidate::ExecuteRoutinePkeyValidate: Result = 0x8007000D
12:27:47  MOUPG  CSetupHost::Execute: Result = 0x8007000D

Interpretation:

• 0x80072EE7, 0x80070002, 0x80070490 are offline telemetry/OneSettings failures and are non-fatal (Setup continued ~15s later).
• The fatal error is CDlpActionProductKeyValidate::SelectImageFromResponse / SelectImageIndex returning 0x8007000D (ERROR_INVALID_DATA) — ConX could not map the product key → an image index in the multi-edition install.wim.
• The ~15s gap between the OneSettings failure and SelectImageFromResponse looks like a network timeout, suggesting the "response" ConX selects the image from may be service/online-sourced.

What we've ruled out (already tried)

• ❌ Product key value / class — retail-generic, GVLK, MAK, and keyless all fail identically. So it is NOT simply "wrong key".
• ❌ Key/media channel mismatch — a volume GVLK on volume media (correct channel) still fails, so this is not (only) a retail-key-on-volume-media issue.
• ❌ DNS / network — fails fully offline too; the OneSettings/DNS errors are non-fatal. Confirmed the Default Switch DNS proxy actually resolves for a booted guest, but WinPE-phase resolution is unreliable.
• ❌ Media authenticity — genuine volume media; EI.CFG = Volume/VL; dism /Get-WimInfo shows the expected editions; Pro image name matches /IMAGE/NAME.
• ❌ ISO integrity — oscdimg builds with -u2 -udfver102 -m (proper UDF), so the >4 GB install.wim is intact in the ISO (verified sizes: install.wim 6.85 GB, Pro ISO 7.63 GB).
• ❌ Answer-file DNS override — Microsoft-Windows-DNS-Client only runs in specialize, so it cannot affect windowsPE-phase validation.
• ⚠️ install.wim not found in BlueBox.log — this is the benign /boot prep phase; SetupHost then launches and finds the image.

Leading hypothesis

ConX's product-key/image-selection step (SelectImageFromResponse) behaves differently from legacy Setup on multi-edition media:

1. It may require an online response to select the edition/image (offline → 0x8007000D), and/or
2. It struggles to auto-select an edition from a 10-index install.wim in an unattended, offline windowsPE context, where legacy Setup handled the same /IMAGE/NAME + key just fine.

The consumer/Home ISO works only because it runs legacy Setup.

Candidate next steps / fixes to evaluate

1. Export install.wim to the single target edition (strong candidate).
   Today the tool services only the target index (e.g. Pro = 5) but ships all 10 editions. Add a dism /Export-Image (or Export-WindowsImage) step so the shipped install.wim contains only the serviced target edition. A single-image WIM should remove the "select image" ambiguity for ConX — and it also fixes the current side effect that the other 9 editions ship un-debloated.

2. Select the edition by numeric /IMAGE/INDEX (and consider deferring the key).
   Switch the answer file from /IMAGE/NAME to a numeric /IMAGE/INDEX, and test applying the product key in the specialize pass (offline, on the installed image) instead of windowsPE — so ConX's windowsPE ProductKeyValidate action is not the gate.

3. Confirm the online dependency (decisive diagnostic).
   Capture the verbose X:\$WINDOWS.~BT\Sources\Panther\setupact.log around SelectImageFromResponse to see whether ConX is waiting on a URL/service (→ genuinely online-dependent) or enumerating the WIM editions (→ fixable offline). Command used at the failing dialog:

   findstr /i /n /c:"SelectImage" /c:"Pkey" /c:"ProductKey" /c:"Response" /c:"OneSettings" /c:"http" /c:"Channel" /c:"Edition" /c:"IMAGE/" /c:"install.wim" /c:"index" "X:\$WINDOWS.~BT\Sources\Panther\setupact.log" > X:\pk.txt & notepad X:\pk.txt

4. Test with genuine working internet in the VM (External switch with real DNS, or Internal switch + ICS from Wi-Fi) to determine whether the deliverable ISO installs fine on a connected machine (in which case the boot test is a false negative offline).

5. Force legacy Setup (fallback, fragile).
   Undocumented/unreliable on RTM builds; only pursue if the above fail. Not preferred.

Related tooling changes already made

• Boot-test log harvesting extended to collect the ConX/MoSetup logs (Windows\Logs\MoSetup\BlueBox.log, DISM, NetSetup) and an operator-dropped pe-logs tree; Shift+F10 guidance updated (copy/robocopy X:\Windows\Logs). Commit 8b3f0d9.
• Boot-test VM now runs offline by default with an opt-in -ConnectNetwork switch (Test-ImageIntegrity / Invoke-VmBootTest / New-BootTestVm / Invoke-QuickBootTest). Commit 8b3f0d9.
• Earlier: warn that MAK/retail keys validate online. Commit 40c631e.

Relevant code

• src/WindowsIsoMaker/Public/Mount-WindowsBuildImage.ps1 — resolves/mounts a single edition index; does not export the WIM down to one edition.
• src/WindowsIsoMaker/Public/New-AutounattendXml.ps1 — renders windowsPE UserData/ProductKey + ImageInstall/OSImage (/IMAGE/NAME, WillShowUI=Never).
• src/WindowsIsoMaker/Private/Get-GenericSetupProductKey.ps1 — generic-key table (Home = retail generic; non-Home = GVLK).
• src/WindowsIsoMaker/Public/New-BootableIso.ps1 — oscdimg -u2 -udfver102 -m.
• src/WindowsIsoMaker/Public/Test-ImageIntegrity.ps1 — boot test + log harvesting.

Workaround (interim)

No confirmed workaround yet for a fully-offline unattended install from multi-edition business media. Consumer/Home media (legacy Setup) is unaffected.