It is not life-changing money, but if you are joining Spintel anyway, you may as well take the easy five bucks.

How do you use the Spintel referral code?

Use FAYB27965 during the Spintel signup process when the site asks for a referral or promo code. If the current offer is active, the discount should apply automatically.

spintel.net.au

Below is a script that will create a winpe iso that modifies the value, note: your value may have different filters to keep. It also injects a CSV for bitlocker codes in the format ComputerName, Password.

If machines are stuck in a loop this will get them out.

# Build-UWF-WinPE.ps1
# Creates C:\UWF_WinPE.iso
# Copies D:\Temp\bitlocker.csv into WinPE
# On boot: auto-unlocks C: from CSV, prints Bitlocker Unlocked or Computer Not In Sheet, then runs UWF LowerFilters fix using ControlSet001

#requires -RunAsAdministrator

$ErrorActionPreference = "Stop"

$Arch  = "amd64"
$Work  = "C:\UWF_WinPE"
$Iso   = "C:\UWF_WinPE.iso"
$Mount = "$Work\mount"

$BitLockerCsvSource = "D:\Temp\bitlocker.csv"
$BitLockerCsvName   = "bitlocker.csv"

$AdkRoot   = "${env:ProgramFiles(x86)}\Windows Kits\10\Assessment and Deployment Kit"
$Deploy    = Join-Path $AdkRoot "Deployment Tools"
$WinPeRoot = Join-Path $AdkRoot "Windows Preinstallation Environment"
$OcRoot    = Join-Path $WinPeRoot "$Arch\WinPE_OCs"
$DandI     = Join-Path $Deploy "DandISetEnv.bat"

if (-not (Test-Path $BitLockerCsvSource)) {
    throw "BitLocker CSV not found: $BitLockerCsvSource"
}

if (-not (Test-Path $AdkRoot)) {
    throw "ADK root not found: $AdkRoot"
}

if (-not (Test-Path $DandI)) {
    throw "DandISetEnv.bat not found. Install ADK with Deployment Tools."
}

if (-not (Test-Path $WinPeRoot)) {
    throw "WinPE folder not found. Install the Windows PE Add-on for the ADK."
}

if (-not (Test-Path $OcRoot)) {
    throw "WinPE optional components not found: $OcRoot"
}

$Copype = Get-ChildItem $AdkRoot -Recurse -Filter "copype.cmd" -ErrorAction SilentlyContinue | Select-Object -First 1
$MakePE = Get-ChildItem $AdkRoot -Recurse -Filter "MakeWinPEMedia.cmd" -ErrorAction SilentlyContinue | Select-Object -First 1

if (-not $Copype) {
    throw "copype.cmd not found. This usually means the WinPE Add-on is missing or broken."
}

if (-not $MakePE) {
    throw "MakeWinPEMedia.cmd not found. This usually means the WinPE Add-on is missing or broken."
}

$Dism = Join-Path $Deploy "$Arch\DISM\dism.exe"
if (-not (Test-Path $Dism)) {
    $Dism = "dism.exe"
}

function Invoke-CmdChecked {
    param(
        [Parameter(Mandatory)]
        [string]$Command,

        [Parameter(Mandatory)]
        [string]$FailMessage
    )

    Write-Host ""
    Write-Host "Running: $Command"

    $OutFile = Join-Path $env:TEMP "uwf_winpe_stdout.txt"
    $ErrFile = Join-Path $env:TEMP "uwf_winpe_stderr.txt"

    Remove-Item $OutFile, $ErrFile -Force -ErrorAction SilentlyContinue

    $p = Start-Process `
        -FilePath "cmd.exe" `
        -ArgumentList "/d", "/c", $Command `
        -Wait `
        -PassThru `
        -NoNewWindow `
        -RedirectStandardOutput $OutFile `
        -RedirectStandardError $ErrFile

    if (Test-Path $OutFile) {
        Get-Content $OutFile | ForEach-Object { Write-Host $_ }
    }

    if (Test-Path $ErrFile) {
        Get-Content $ErrFile | ForEach-Object { Write-Host $_ }
    }

    if ($p.ExitCode -ne 0) {
        throw "$FailMessage Exit code: $($p.ExitCode)"
    }
}

function Invoke-DismChecked {
    param(
        [Parameter(Mandatory)]
        [string[]]$Args,

        [Parameter(Mandatory)]
        [string]$FailMessage
    )

    Write-Host ""
    Write-Host "Running: $Dism $($Args -join ' ')"
    & $Dism @Args

    if ($LASTEXITCODE -ne 0) {
        throw "$FailMessage Exit code: $LASTEXITCODE"
    }
}

function Add-WinPePackageChecked {
    param(
        [Parameter(Mandatory)]
        [string]$PackageRelativePath
    )

    $PkgPath = Join-Path $OcRoot $PackageRelativePath
    if (-not (Test-Path $PkgPath)) {
        throw "Required WinPE package missing: $PkgPath"
    }

    Invoke-DismChecked `
        -Args @("/Image:$Mount", "/Add-Package", "/PackagePath:$PkgPath") `
        -FailMessage "Failed adding package: $PkgPath"
}

if (Test-Path $Mount) {
    Write-Host "Cleaning up any previous mount..."
    & $Dism /Unmount-Image /MountDir:"$Mount" /Discard 2>$null | Out-Null
}

if (Test-Path $Work) {
    Write-Host "Removing old working folder: $Work"
    Remove-Item $Work -Recurse -Force
}

if (Test-Path $Iso) {
    Write-Host "Removing old ISO: $Iso"
    Remove-Item $Iso -Force
}

Write-Host ""
Write-Host "Creating WinPE working files..."
Invoke-CmdChecked `
    -Command "call `"$DandI`" && call `"$($Copype.FullName)`" $Arch `"$Work`"" `
    -FailMessage "copype failed."

if (-not (Test-Path "$Work\media\sources\boot.wim")) {
    throw "boot.wim was not created at $Work\media\sources\boot.wim"
}

Write-Host ""
Write-Host "Mounting boot.wim..."
Invoke-DismChecked `
    -Args @("/Mount-Image", "/ImageFile:$Work\media\sources\boot.wim", "/Index:1", "/MountDir:$Mount") `
    -FailMessage "DISM mount failed."

try {
    Write-Host ""
    Write-Host "Adding WinPE packages..."

    $Packages = @(
        "WinPE-WMI.cab",
        "en-us\WinPE-WMI_en-us.cab",
        "WinPE-NetFX.cab",
        "en-us\WinPE-NetFX_en-us.cab",
        "WinPE-Scripting.cab",
        "en-us\WinPE-Scripting_en-us.cab",
        "WinPE-PowerShell.cab",
        "en-us\WinPE-PowerShell_en-us.cab",
        "WinPE-StorageWMI.cab",
        "en-us\WinPE-StorageWMI_en-us.cab",
        "WinPE-SecureStartup.cab",
        "en-us\WinPE-SecureStartup_en-us.cab"
    )

    foreach ($Pkg in $Packages) {
        Add-WinPePackageChecked -PackageRelativePath $Pkg
    }

    Write-Host ""
    Write-Host "Copying BitLocker CSV into WinPE..."
    Copy-Item -Path $BitLockerCsvSource -Destination "$Mount\Windows\System32\$BitLockerCsvName" -Force
    Copy-Item -Path $BitLockerCsvSource -Destination "$Mount\$BitLockerCsvName" -Force

    Write-Host ""
    Write-Host "Writing UWF automatic startup script..."

    $StartNet = @'
wpeinit
powershell.exe -NoProfile -ExecutionPolicy Bypass -File %SystemRoot%\System32\UWFAuto.ps1
cmd.exe
'@

    Set-Content -Path "$Mount\Windows\System32\startnet.cmd" -Value $StartNet -Encoding ASCII -Force

    $UwfAuto = @'
$ErrorActionPreference = "Continue"

$Drive = "C:"
$Hive = "C:\Windows\System32\Config\SYSTEM"
$MountName = "HKLM\OFFSYS"
$ClassKey = "HKLM\OFFSYS\ControlSet001\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}"
$LogPath = "X:\UWF-Auto.log"

function Log {
    param([string]$Message)
    $line = "{0} {1}" -f (Get-Date -Format "yyyy-MM-dd HH:mm:ss"), $Message
    Write-Host $Message
    try { Add-Content -Path $LogPath -Value $line -Encoding ASCII -ErrorAction SilentlyContinue } catch {}
}

function Get-CsvPath {
    $paths = @(
        "X:\bitlocker.csv",
        "X:\Windows\System32\bitlocker.csv",
        (Join-Path $env:WINDIR "System32\bitlocker.csv")
    ) | Select-Object -Unique

    foreach ($p in $paths) {
        if (Test-Path $p) { return $p }
    }
    return $null
}

function Test-OfflineWindowsAvailable {
    return (Test-Path $Hive)
}

function Test-BitLockerUnlocked {
    if (Test-OfflineWindowsAvailable) { return $true }

    $status = & manage-bde.exe -status $Drive 2>$null | Out-String
    if ($status -match "Lock Status:\s+Unlocked") { return $true }

    return $false
}

function Normalize-Name {
    param([string]$Name)
    if ($null -eq $Name) { return "" }
    return (($Name -replace '[^a-zA-Z0-9]', '').ToLowerInvariant())
}

function Get-ColumnName {
    param(
        [string[]]$Headers,
        [string[]]$Wanted
    )

    foreach ($h in $Headers) {
        $n = Normalize-Name $h
        foreach ($w in $Wanted) {
            if ($n -eq $w -or $n -like "*$w*") { return $h }
        }
    }
    return $null
}

function Get-RecoveryPasswordsFromText {
    param([string]$Text)
    if ([string]::IsNullOrWhiteSpace($Text)) { return @() }

    $matches = [regex]::Matches($Text, '(?<!\d)(?:\d{6}-){7}\d{6}(?!\d)')
    return @($matches | ForEach-Object { $_.Value } | Select-Object -Unique)
}

function Try-UnlockWithPassword {
    param([string]$RecoveryPassword)

    if ([string]::IsNullOrWhiteSpace($RecoveryPassword)) { return $false }

    $RecoveryPassword = $RecoveryPassword.Trim()
    if ($RecoveryPassword -notmatch '^(?:\d{6}-){7}\d{6}$') { return $false }

    & manage-bde.exe -unlock $Drive -RecoveryPassword $RecoveryPassword | Out-Null
    Start-Sleep -Milliseconds 300
    return (Test-BitLockerUnlocked)
}

function Unlock-BitLockerFromCsv {
    if (Test-BitLockerUnlocked) {
        Log "Bitlocker Unlocked"
        return $true
    }

    $csvPath = Get-CsvPath
    if (-not $csvPath) {
        Log "Computer Not In Sheet"
        Log "CSV not found. Expected X:\bitlocker.csv or X:\Windows\System32\bitlocker.csv"
        return $false
    }

    Log "Using CSV: $csvPath"
    Log "WinPE computer name: $env:COMPUTERNAME"

    $raw = ""
    try { $raw = Get-Content -Path $csvPath -Raw -ErrorAction Stop } catch {}

    $rows = @()
    try { $rows = @(Import-Csv -Path $csvPath -ErrorAction Stop) } catch {}

    $passwordsToTry = New-Object System.Collections.Generic.List[string]

    if ($rows.Count -gt 0) {
        $first = $rows | Select-Object -First 1
        $headers = @($first.PSObject.Properties.Name)

        $computerColumn = Get-ColumnName -Headers $headers -Wanted @("computer", "computername", "devicename", "hostname", "name")
        $passwordColumn = Get-ColumnName -Headers $headers -Wanted @("password", "recoverypassword", "bitlockerrecoverypassword", "recoverykey", "key")

        if ($passwordColumn) {
            if ($computerColumn) {
                $matchedRows = @($rows | Where-Object {
                    $value = [string]($_.$computerColumn)
                    $value.Trim() -ieq $env:COMPUTERNAME
                })

                foreach ($row in $matchedRows) {
                    $pw = [string]($row.$passwordColumn)
                    if ($pw) { [void]$passwordsToTry.Add($pw.Trim()) }
                }
            }

            foreach ($row in $rows) {
                $pw = [string]($row.$passwordColumn)
                if ($pw) { [void]$passwordsToTry.Add($pw.Trim()) }
            }
        }
    }

    foreach ($pw in (Get-RecoveryPasswordsFromText -Text $raw)) {
        [void]$passwordsToTry.Add($pw)
    }

    $passwords = @($passwordsToTry | Where-Object { $_ -match '^(?:\d{6}-){7}\d{6}$' } | Select-Object -Unique)

    if ($passwords.Count -eq 0) {
        Log "Computer Not In Sheet"
        Log "No valid 48-digit recovery passwords found in CSV. Check the CSV format."
        return $false
    }

    Log "Trying $($passwords.Count) recovery password candidate(s)."

    foreach ($pw in $passwords) {
        if (Try-UnlockWithPassword -RecoveryPassword $pw) {
            Log "Bitlocker Unlocked"
            return $true
        }
    }

    Log "Computer Not In Sheet"
    Log "No CSV recovery password unlocked $Drive."
    return $false
}

function Run-UwfFix {
    Log ""
    Log "Running UWF LowerFilters fix..."

    if (-not (Test-Path $Hive)) {
        Log "ERROR: $Hive not found. C: is still locked, or Windows is not C:."
        return $false
    }

    try {
        Copy-Item -Path $Hive -Destination "$Hive.bak" -Force
        Log "Backed up SYSTEM hive to $Hive.bak"
    }
    catch {
        Log "ERROR: Backup failed: $($_.Exception.Message)"
        return $false
    }

    & reg.exe unload $MountName 1>$null 2>$null

    & reg.exe load $MountName $Hive 1>$null
    if ($LASTEXITCODE -ne 0) {
        Log "ERROR: Failed to load offline SYSTEM hive."
        return $false
    }

    & reg.exe add $ClassKey /v LowerFilters /t REG_MULTI_SZ /d "fvevol\0iorate\0rdyboost" /f 1>$null
    if ($LASTEXITCODE -ne 0) {
        Log "ERROR: Failed to set LowerFilters."
        & reg.exe unload $MountName | Out-Null
        return $false
    }

    & reg.exe query $ClassKey /v LowerFilters

    & reg.exe unload $MountName 1>$null
    if ($LASTEXITCODE -ne 0) {
        Log "WARNING: Failed to unload hive. Run manually: reg unload $MountName"
        return $false
    }

    Log "UWF Fix Complete"
    return $true
}

Clear-Host
Log "========================================"
Log "          UWF WinPE Auto Repair"
Log "========================================"
Log ""

Unlock-BitLockerFromCsv | Out-Null
Run-UwfFix | Out-Null

Log ""
Log "Finished. Log: $LogPath"
Log "Command prompt will remain open."
'@

    Set-Content -Path "$Mount\Windows\System32\UWFAuto.ps1" -Value $UwfAuto -Encoding ASCII -Force

    Write-Host ""
    Write-Host "Committing boot.wim..."
    Invoke-DismChecked `
        -Args @("/Unmount-Image", "/MountDir:$Mount", "/Commit") `
        -FailMessage "DISM commit failed."
}
catch {
    Write-Warning "Build failed. Discarding mounted image..."
    & $Dism /Unmount-Image /MountDir:"$Mount" /Discard 2>$null | Out-Null
    throw
}

Write-Host ""
Write-Host "Creating ISO..."
$DandI = 'C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\DandISetEnv.bat'
$Make  = 'C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\MakeWinPEMedia.cmd'
$Out   = "$env:TEMP\UWF_WinPE_out.txt"
$Err   = "$env:TEMP\UWF_WinPE_err.txt"

Remove-Item $Iso -Force -ErrorAction SilentlyContinue
Remove-Item $Out,$Err -Force -ErrorAction SilentlyContinue

$p = Start-Process `
  -FilePath "cmd.exe" `
  -ArgumentList "/d", "/c", "call `"$DandI`" && call `"$Make`" /ISO /F `"C:\UWF_WinPE`" `"C:\UWF_WinPE.iso`"" `
  -Wait `
  -PassThru `
  -NoNewWindow `
  -RedirectStandardOutput $Out `
  -RedirectStandardError $Err

Get-Content $Out -ErrorAction SilentlyContinue
Get-Content $Err -ErrorAction SilentlyContinue

if ($p.ExitCode -ne 0) {
    throw "MakeWinPEMedia ISO creation failed. Exit code: $($p.ExitCode)"
}

if (-not (Test-Path $Iso)) {
    throw "ISO was not created: $Iso"
}

Write-Host ""
Write-Host "DONE"
Write-Host "ISO: $Iso"
Write-Host ""
Write-Host "To write to USB later:"
Write-Host "MakeWinPEMedia /UFD /F $Work E:"
Write-Host ""
Write-Host "Replace E: with the USB drive letter. It will wipe the USB."

SCCM functions slowing down such as collection update, run scripts? Probably some SQL/Options that needs tuning.
I dont think Config Manager was designed to handle some of the newer inventory data at least at the frequency we get it. Having large tables of unneeded history will slow you down. If you are getting history like daily it will take up a lot of space

Get the History size

SELECT 
    t.name,
    SUM(p.rows) AS row_count,
    SUM(a.total_pages) * 8 / 1024 AS size_mb
FROM sys.tables t
JOIN sys.partitions p ON p.object_id = t.object_id AND p.index_id IN (0,1)
JOIN sys.allocation_units a ON a.container_id = p.partition_id
WHERE t.name LIKE '%HIST%'
GROUP BY t.name
ORDER BY row_count DESC

Clear older than 60 days example script

SET NOCOUNT ON

DECLARE @tables TABLE (name SYSNAME, priority INT)
INSERT @tables VALUES
    ('OPTIONAL_FEATURE_HIST',              1),
    ('SYSTEM_CONSOLE_USAGE_HIST',          1),
    ('SYSTEM_CONSOLE_USER_HIST',           1),
    ('UPGRADE_EXPERIENCE_INDICATORS_HIST', 1),
    ('BROWSER_USAGE_HIST',                 1),
    ('Services_HIST',                      1),
    ('WINDOWS8_APPLICATION_USER_INFO_HIST',1),
    ('WINDOWS8_APPLICATION_HIST',          1),
    ('PNP_SIGNED_DRIVER_CUSTOM_HIST',      2),
    ('INSTALLED_SOFTWARE_HIST',            2),
    ('Network_HIST',                       2),
    ('Netcard_HIST',                       2),
    ('Logical_Disk_HIST',                  2),
    ('ClientEvents_HIST',                  2),
    ('Add_Remove_Programs_HIST',           2),
    ('Add_Remove_Programs_64_HIST',        2),
    ('Operating_System_HIST',              2),
    ('QUICK_FIX_ENGINEERING_HIST',         2),
    ('Office365ProPlusConfigurations_HIST',2),
    ('Video_Controller_HIST',              2),
    ('Computer_System_HIST',               2),
    ('Desktop_Monitor_HIST',               2),
    ('OFFICE_ADDIN_HIST',                  2),
    ('ENCRYPTABLE_VOLUME_HIST',            2),
    ('Sound_Devices_HIST',                 2),
    ('Disk_HIST',                          2),
    ('MDM_DEVDETAIL_EXT01_HIST',           2)

DECLARE @tbl SYSNAME, @sql NVARCHAR(MAX), @deleted INT, @total BIGINT, @start DATETIME, @msg NVARCHAR(500)

DECLARE c CURSOR LOCAL FAST_FORWARD FOR 
    SELECT name FROM @tables ORDER BY priority, name

OPEN c
FETCH NEXT FROM c INTO @tbl

WHILE @@FETCH_STATUS = 0
BEGIN
    SET @deleted = 1
    SET @total = 0
    SET @start = GETDATE()
    
    SET @msg = CONCAT('--- Starting ', @tbl, ' at ', CONVERT(VARCHAR, GETDATE(), 108), ' ---')
    RAISERROR(@msg, 0, 1) WITH NOWAIT
    
    WHILE @deleted > 0
    BEGIN
        SET @sql = 'DELETE TOP (5000) FROM ' + QUOTENAME(@tbl) 
                 + ' WHERE TimeKey < DATEADD(day, -60, GETDATE())'
        EXEC sp_executesql @sql
        SET @deleted = @@ROWCOUNT
        SET @total = @total + @deleted
        
        WAITFOR DELAY '00:00:01'
    END
    
    SET @msg = CONCAT('Done ', @tbl, ': ', @total, ' rows in ', 
                     DATEDIFF(second, @start, GETDATE()), ' seconds')
    RAISERROR(@msg, 0, 1) WITH NOWAIT
    
    FETCH NEXT FROM c INTO @tbl
END

CLOSE c
DEALLOCATE c

    <settings pass="specialize">
        <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <RunSynchronous>
                <RunSynchronousCommand wcm:action="add">
                    <Order>1</Order>
                    <Path>cmd /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy" /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f</Path>
                    <Description>Disable Smart App Control before OOBE</Description>
                </RunSynchronousCommand>
            </RunSynchronous>
        </component>
    </settings>

Once you deploy that, Secure boot requires the file or newer to be on the EFI partition.

It's there now, forever, or until you reset secure boot. During re-imaging you can copy the latest version after apply OS with a script like this

$tsenv = New-Object -ComObject Microsoft.SMS.TSEnvironment
$osdisk = $tsenv.Value("OSDisk")

$PolicyBinary = $OSDisk+"\Windows\System32\SecureBootUpdates\SkuSiPolicy.p7b"
$MountPoint = 's:'

$EFIDestinationFolder = "$MountPoint\EFI\Microsoft\Boot"

if (-Not (Test-Path $EFIDestinationFolder)) { New-Item -Path $EFIDestinationFolder -Type Directory -Force }

Copy-Item -Path $PolicyBinary -Destination $EFIDestinationFolder -Force

Just a quick post to hopefully save someone some time. Ask me anything, I may have skipped over something.

Setup

Download Scripts

Create a base policy (base.xml), and supplemental policies, ideally 2 (SOE.xml and ThirdParty.xml) for the current setup, you can hack at the scripts to do your own thing.
Copy the XMLs to Policies\Base, Policies\SOE, Policies\ThirdParty.

Create Policy

To add a new app to wdac you use the createPolicy.ps1

.\CreatePolicy.ps1 -scanpath "C:\temp\Citrix" -WDACFolder "C:\Users\happysccm\Documents\GitHub\WDAC\" -ParentPolicy ThirdParty -policyName "Citrix" -version "1.0.0.1"

This would create a new policy scanning the folder and making a policy for the ThirdParty policy.

Merge Policy

.\MergePolicy.ps1 -WDACFolder "C:\Users\happysccm\Documents\GitHub\WDAC\" -PolicyName ThirdParty

This will merge all the Third Party XMLs and compile the binary.

Create App

.\CreateApp.ps1 -wdacFolder "C:\Users\happysccm\Documents\GitHub\WDAC\" -appVersion "3.0.0.2"

This will copy the binaries to the AppBuild folder and spit out a folder ready to be deployed by SCCM.

Deploy

Create an App in sccm

Use the AppDetection.ps1 it generated, this verifies the hash of all files in the code integrity policies folder, ignoring built in ones, thiscan be altered in the createapp.ps1.

Folder Structure

AppBuild: Appbuild Contains exe's and scripts to create the SCCM app.

Appbuild\Source: Default script to deploy WDAC and make SCCM a managed installer.

Appbuild\Source\Binary: Compiled policies are moved here.

Appbuild\Builds: Script will create source files for an SCCM deployment including app detection script.

Policies\Base: Base policy xml goes here. Kind of the default policy you want before customizations

Policies\SOE: All apps that go on every machine

Policies\ThirdParty: Supplemental apps that need to be added.

It's best to deploy it via a script, also enable the managed installer reg for sccm or managed installer just doesn't work

reg.exe add HKLM\SOFTWARE\Microsoft\CCM /v EnableManagedInstaller /t REG_DWORD /d "1" /f