The script nobody understands

Every Windows estate has one: the provisioning script only one person ever really understood. This page is about what that costs, and what automation with provenance looks like instead.

Every estate has one

Somewhere in your build process there is a script that only one person ever understood — and there is a fair chance that person no longer works for you. It runs on every device. It has a variable called $temp2. There is a commented-out block nobody dares delete, a hard-coded GUID with no explanation, and a line near the top that reads # DO NOT REMOVE — breaks laptops.

It works. Mostly. And when it doesn't, the troubleshooting method is archaeology: reading through the strata of years of quick fixes, trying to reconstruct the intent of an author who isn't around to ask. Nothing about it is documented, because the documentation was the person.

Why it never gets fixed

If you own the risk, you already know it's there. It may even be on the risk register. It stays anyway, for reasons that are entirely rational:

• Rewriting it is unfunded work. It competes with everything that has a deadline, and it never wins.
• Touching it can break builds that currently pass. The safest-looking move, day to day, is to leave it alone.
• Documenting it belongs to a quieter month that hasn't arrived in six years.

So every successful build quietly strengthens the case for not touching it, and the exposure compounds. That isn't negligence. It's a sensible response to bad options. The real problem is not the script — it's that the script is the only place the knowledge lives.

Automation with provenance

Decolla is a product of The Cloud Platform Ltd, a UK IT consultancy that has spent years doing this work for real customers. Its core is the Library: pre-built, industry-tested policies, scripts and fixes — including the recurring, mundane helpdesk fixes and the hardening steps that should be part of every build — assembled into a curated catalogue of 260+ build items across 21 sections.

Every item in the Library is documented (it says what it does and how it is delivered) and industry-tested (it has been exercised before it reaches your estate). Each one also carries a reversibility class — automatic, reversible, or explicitly flagged as irreversible — so the risk of every line is stated up front rather than discovered later.

The weeks you would spend writing, borrowing and debugging that automation yourself collapse into picking items from a catalogue. Not because the work is trivial — because it has already been done, and done in a form someone else can read.

A plan you can actually read

Decolla runs over your own Microsoft Intune and Autopilot tenant — your infrastructure, your policies, your data. A guided wizard walks through Discover (platform, chassis, scenario, make), then Configure, then item selection. The catalogue is relevance-filtered and intelligently defaulted by a conditional engine: OEM tooling matched to the make, power settings to the chassis, drive strategy, locale, the HVCI gate, existing versus new devices.

The output is not a black box. It is an itemised written plan that you read and approve before anything runs, with every item showing its delivery method and its reversibility class. Deployment then runs unattended in your tenant, and you can roll back per item or the whole build — covering Decolla's own changes only. It cannot unwind a failed Microsoft install or a stuck Enrolment Status Page, and it won't pretend otherwise.

For the person who owns the risk, that plan is the point. Nothing lives in one colleague's head. The plan is the documentation: named, documented items with stated behaviour, delivery method and reversibility class, instead of $temp2 and a comment begging you not to remove line 14.

Where this stands

Some honest boundaries, because you would find them anyway. Decolla does not make Windows installs, Autopilot enrolment or policy sync any faster — those run at Microsoft's pace. The time it removes is the assembly time: the research, the scripting, the forum trawling. It manages your tenant, not a fleet of tenants. And the Microsoft Graph permission scopes it needs are published in full before you connect anything.

Decolla is currently in private build, and the early-access waitlist is the only way in. If somewhere in your estate there is a script nobody understands — and you would rather retire it deliberately than discover its limits at 8am on a Monday — the waitlist is below.