# narcarsiss/aegis-win11 architecture

> Architecture diagram of the GitHub repository narcarsiss/aegis-win11, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/narcarsiss/aegis-win11
- Repository: https://github.com/narcarsiss/aegis-win11

## Overview

Aegis Win11 is a Windows 11 unattended deployment toolkit: installation media starts Windows Setup, which uses `autounattend.xml` to coordinate staging and execution of `AegisWin11_Deploy.ps1`. The script establishes the configured workstation baseline, spanning security, identity, performance compatibility, and optional software deployment. The README documents these capability areas and parameters, but no source excerpts were provided; internal call structure is therefore not inferred. Dashed links mark optional integrations described in the README.

Main entry points: [`AegisWin11_Deploy.ps1`](https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1) (Deployment Script), [`autounattend.xml`](https://github.com/narcarsiss/aegis-win11/blob/main/autounattend.xml) (Unattended Configuration)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_deployment["Deployment"]
  node_media["Install Media"]
  node_setup["Windows Setup"]
  node_answer["Unattended Configuration<br/>[autounattend.xml]"]
  node_deploy["Deployment Script"]
  node_partition["Disk Partitioning<br/>[autounattend.xml]"]
end

subgraph group_security["Security Baseline"]
  node_hardening["Security Policies"]
  node_telemetry["Telemetry Controls"]
  node_forensics["Anti-Forensic Mode"]
  node_encryption["Device Encryption"]
  node_identity["Identity Anchor"]
  node_network["Network Boundaries"]
end

subgraph group_workstation["Workstation Setup"]
  node_performance["Workload Compatibility"]
  node_browser["Browser Policies"]
  node_shell["Shell Cleanup"]
  node_legacy["Legacy Removal"]
  node_packages["Package Installation"]
end

subgraph group_integrations["External Integrations"]
  node_winget["Winget"]
  node_entra["Microsoft Entra ID"]
end

node_operator(("Deployment Operator"))
node_machine["Configured Workstation"]

node_operator -->|"prepares"| node_media
node_media -->|"boots"| node_setup
node_setup -->|"reads"| node_answer
node_answer -->|"configures"| node_partition
node_answer -->|"stages"| node_deploy
node_setup -->|"runs"| node_deploy
node_deploy -->|"applies"| node_hardening
node_deploy -->|"configures"| node_telemetry
node_deploy -->|"configures"| node_forensics
node_deploy -->|"provisions"| node_encryption
node_deploy -->|"generates"| node_identity
node_deploy -->|"configures"| node_network
node_deploy -->|"tunes"| node_performance
node_deploy -->|"applies"| node_browser
node_deploy -->|"purges"| node_shell
node_deploy -->|"removes"| node_legacy
node_deploy -->|"installs"| node_packages
node_packages -.->|"invokes"| node_winget
node_identity -.->|"escrows keys"| node_entra
node_partition -->|"partitions"| node_machine
node_hardening -->|"secures"| node_machine
node_telemetry -->|"configures"| node_machine
node_forensics -->|"alters logs"| node_machine
node_encryption -->|"encrypts"| node_machine
node_identity -->|"establishes"| node_machine
node_network -->|"configures"| node_machine
node_performance -->|"tunes"| node_machine
node_browser -->|"configures"| node_machine
node_shell -->|"cleans"| node_machine
node_legacy -->|"removes"| node_machine
node_packages -->|"installs"| node_machine

click node_answer "https://github.com/narcarsiss/aegis-win11/blob/main/autounattend.xml"
click node_deploy "https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1"
click node_partition "https://github.com/narcarsiss/aegis-win11/blob/main/autounattend.xml"
click node_hardening "https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1"
click node_telemetry "https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1"
click node_forensics "https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1"
click node_encryption "https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1"
click node_identity "https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1"
click node_network "https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1"
click node_performance "https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1"
click node_browser "https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1"
click node_shell "https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1"
click node_legacy "https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1"
click node_packages "https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_media,node_setup,node_answer,node_deploy,node_partition toneBlue
class node_hardening,node_telemetry,node_forensics,node_encryption,node_identity,node_network toneAmber
class node_performance,node_browser,node_shell,node_legacy,node_packages toneMint
class node_winget,node_entra toneRose
class node_operator,node_machine toneIndigo
```

## Components

### Deployment

- **Install Media**
- **Windows Setup**
- [Unattended Configuration](https://github.com/narcarsiss/aegis-win11/blob/main/autounattend.xml): `autounattend.xml`
- [Deployment Script](https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1): `AegisWin11_Deploy.ps1`
- [Disk Partitioning](https://github.com/narcarsiss/aegis-win11/blob/main/autounattend.xml): `autounattend.xml`

### Security Baseline

- [Security Policies](https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1): `AegisWin11_Deploy.ps1`
- [Telemetry Controls](https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1): `AegisWin11_Deploy.ps1`
- [Anti-Forensic Mode](https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1): `AegisWin11_Deploy.ps1`
- [Device Encryption](https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1): `AegisWin11_Deploy.ps1`
- [Identity Anchor](https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1): `AegisWin11_Deploy.ps1`
- [Network Boundaries](https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1): `AegisWin11_Deploy.ps1`

### Workstation Setup

- [Workload Compatibility](https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1): `AegisWin11_Deploy.ps1`
- [Browser Policies](https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1): `AegisWin11_Deploy.ps1`
- [Shell Cleanup](https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1): `AegisWin11_Deploy.ps1`
- [Legacy Removal](https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1): `AegisWin11_Deploy.ps1`
- [Package Installation](https://github.com/narcarsiss/aegis-win11/blob/main/AegisWin11_Deploy.ps1): `AegisWin11_Deploy.ps1`

### External Integrations

- **Winget**
- **Microsoft Entra ID**

### Other components

- **Deployment Operator**
- **Configured Workstation**

## Connections

- Deployment Operator → Install Media: prepares
- Install Media → Windows Setup: boots
- Windows Setup → Unattended Configuration: reads
- Unattended Configuration → Disk Partitioning: configures
- Unattended Configuration → Deployment Script: stages
- Windows Setup → Deployment Script: runs
- Deployment Script → Security Policies: applies
- Deployment Script → Telemetry Controls: configures
- Deployment Script → Anti-Forensic Mode: configures
- Deployment Script → Device Encryption: provisions
- Deployment Script → Identity Anchor: generates
- Deployment Script → Network Boundaries: configures
- Deployment Script → Workload Compatibility: tunes
- Deployment Script → Browser Policies: applies
- Deployment Script → Shell Cleanup: purges
- Deployment Script → Legacy Removal: removes
- Deployment Script → Package Installation: installs
- Package Installation → Winget: invokes
- Identity Anchor → Microsoft Entra ID: escrows keys
- Disk Partitioning → Configured Workstation: partitions
- Security Policies → Configured Workstation: secures
- Telemetry Controls → Configured Workstation: configures
- Anti-Forensic Mode → Configured Workstation: alters logs
- Device Encryption → Configured Workstation: encrypts
- Identity Anchor → Configured Workstation: establishes
- Network Boundaries → Configured Workstation: configures
- Workload Compatibility → Configured Workstation: tunes
- Browser Policies → Configured Workstation: configures
- Shell Cleanup → Configured Workstation: cleans
- Legacy Removal → Configured Workstation: removes
- Package Installation → Configured Workstation: installs