diff --git a/.gitignore b/.gitignore
index 8cd7e13a..8aa60aad 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@ __pycache__
 */__pycache__
 data.py
 vm_data.py
+/scripts/guests/windows/id_rsa.pub
diff --git a/scripts/guests/windows/install-autotest.ps1 b/scripts/guests/windows/install-autotest.ps1
new file mode 100644
index 00000000..cc985def
--- /dev/null
+++ b/scripts/guests/windows/install-autotest.ps1
@@ -0,0 +1,53 @@
+[CmdletBinding()]
+param (
+    [Parameter()]
+    [switch]$NoNetReporting
+)
+
+$ErrorActionPreference = "Stop"
+
+if (!(Test-Path "$PSScriptRoot\id_rsa.pub")) {
+    throw "Cannot find id_rsa.pub for SSH configuration"
+}
+
+# Sometimes enabling updates will disrupt installation and rebooting.
+# This is a temporary measure at most, but Microsoft makes disabling updates really difficult...
+Write-Output "Disabling updates"
+Set-ItemProperty -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU -Name AUOptions -Type DWord -Value 2 -Force
+Stop-Service wuauserv
+Set-Service wuauserv -StartupType Disabled
+
+Write-Output "Installing SSH"
+Invoke-WebRequest -UseBasicParsing -Uri "https://github.com/PowerShell/Win32-OpenSSH/releases/download/v9.8.1.0p1-Preview/OpenSSH-Win64-v9.8.1.0.msi" -OutFile "$env:TEMP\OpenSSH-Win64-v9.8.1.0.msi"
+$exitCode = (Start-Process -Wait msiexec.exe -ArgumentList "/i `"$env:TEMP\OpenSSH-Win64-v9.8.1.0.msi`" /passive /norestart" -PassThru).ExitCode
+if ($exitCode -ne 0) {
+    throw
+}
+Copy-Item "$PSScriptRoot\id_rsa.pub" "$env:ProgramData\ssh\administrators_authorized_keys" -Force
+icacls.exe "$env:ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"
+if ($LASTEXITCODE -ne 0) {
+    throw
+}
+New-NetFirewallRule -Action Allow -Program "$env:ProgramFiles\OpenSSH\sshd.exe" -Direction Inbound -Protocol TCP -LocalPort 22 -DisplayName sshd
+
+Write-Output "Installing Git Bash"
+Invoke-WebRequest -UseBasicParsing -Uri "https://github.com/git-for-windows/git/releases/download/v2.47.1.windows.1/Git-2.47.1-64-bit.exe" -OutFile "$env:TEMP\Git-2.47.1-64-bit.exe"
+$exitCode = (Start-Process -Wait "$env:TEMP\Git-2.47.1-64-bit.exe" -ArgumentList "/silent" -PassThru).ExitCode
+if ($exitCode -ne 0) {
+    throw
+}
+Set-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Type String -Value "$env:ProgramFiles\Git\bin\bash.exe" -Force
+
+if (!$NoNetReporting) {
+    Write-Output "Installing network reporting script"
+    Copy-Item "$PSScriptRoot\netreport.ps1" "$env:SystemDrive\" -Force
+    $action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-executionpolicy bypass $env:SystemDrive\netreport.ps1"
+    $trigger = New-ScheduledTaskTrigger -AtStartup
+    $principal = New-ScheduledTaskPrincipal -UserId "NT AUTHORITY\SYSTEM" -RunLevel Highest
+    $task = New-ScheduledTask -Action $action -Trigger $trigger -Principal $principal
+    Register-ScheduledTask -InputObject $task -TaskName "XCP-ng Test Network Report"
+}
+
+Write-Output "Resealing"
+Stop-Process -Name sysprep -ErrorAction SilentlyContinue
+& "$env:windir\System32\Sysprep\sysprep.exe" "/generalize" "/oobe" "/shutdown" "/unattend:$PSScriptRoot\unattend.xml"
diff --git a/scripts/guests/windows/netreport.ps1 b/scripts/guests/windows/netreport.ps1
new file mode 100644
index 00000000..1be11682
--- /dev/null
+++ b/scripts/guests/windows/netreport.ps1
@@ -0,0 +1,21 @@
+do {
+    Start-Sleep -Seconds 2
+    $Adapter = Get-NetAdapter -Physical | Where-Object Status -eq Up | Select-Object -First 1
+} while (!$Adapter)
+
+$Address = Get-NetIPAddress -AddressFamily IPv4 -InterfaceIndex $Adapter.InterfaceIndex
+# write the full `r`n sequence so that grep could catch it as a full line
+$ReportString = "~xcp-ng-tests~$($Adapter.MacAddress)=$($Address.IPv4Address)~end~`r`n"
+
+$Port = [System.IO.Ports.SerialPort]::new("COM1")
+try {
+    $Port.Open()
+    for ($i = 0; $i -lt 300; $i++) {
+        $Port.Write($ReportString)
+        Start-Sleep -Seconds 1
+    }
+    $Port.Close()
+}
+finally {
+    $Port.Dispose()
+}
diff --git a/scripts/guests/windows/unattend.xml b/scripts/guests/windows/unattend.xml
new file mode 100644
index 00000000..d9380124
--- /dev/null
+++ b/scripts/guests/windows/unattend.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<unattend xmlns="urn:schemas-microsoft-com:unattend">
+    <settings pass="oobeSystem">
+        <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+            <InputLocale>0409:00000409</InputLocale>
+            <SystemLocale>en-US</SystemLocale>
+            <UILanguage>en-US</UILanguage>
+            <UserLocale>en-US</UserLocale>
+        </component>
+        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+            <UserAccounts>
+                <LocalAccounts>
+                    <LocalAccount wcm:action="add">
+                        <Group>Administrators</Group>
+                        <Name>root</Name>
+                    </LocalAccount>
+                </LocalAccounts>
+            </UserAccounts>
+            <OOBE>
+                <HideEULAPage>true</HideEULAPage>
+                <HideLocalAccountScreen>true</HideLocalAccountScreen>
+                <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
+                <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
+                <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
+                <ProtectYourPC>3</ProtectYourPC>
+            </OOBE>
+        </component>
+    </settings>
+</unattend>