woot! got it working. HKCU Run & RunOnce were being obliterated before first logon (even when I locked down permissions on them beforehand), but HKLM RunOnce stays intact. so I used HKLM RunOnce to run a script that adds a key to HKCU RunOnce and then reboots. I needed to use both because certain pesky registry tweaks will only "stick" if run from HKCU, while others only "stick" when run from HKLM. Had to combine setupcomplete.cmd with the RunOnce keys to finally set all the keys I wanted. specialize, oobeSystem, and even auditUser passes were all (mostly) worthless. (this was all with SP1 RTM btw) P.S. - Another thing I noticed early on, you can't use regedit to import the Run\RunOnce keys, they won't be written. Instead I used reg add or regini. I never tried reg import.