Introduction

Windows Configuration Designer (WCD) lets you create a provisioning package — a .ppkg file — that runs automatically when inserted on a new Windows device during the out-of-box experience (OOBE). You can use it to name the device, create a local admin account, join a wireless network, and install the Level agent, all before the end user ever touches the keyboard.

This article walks through creating a provisioning package that installs the Level agent as part of new device setup.

⚙️ PREREQUISITES

Windows Configuration Designer installed (download free from the Microsoft Store)
A Level account with permission to add devices
A USB drive to deploy the package

🎬 VIDEO

How It Works

WCD produces a .ppkg file. Windows recognizes this file format during OOBE — when a new device boots for the first time and reaches the language/setup screen, inserting a USB stick with the .ppkg file causes Windows to exit OOBE and run the provisioning package instead.

In the package, a PowerShell script joins a wireless network and installs the Level agent. The whole provisioning step takes a few seconds. Once it completes, the device appears in Level and is ready for further automation.

Install with Windows Configuration Designer

Step 1: Create a New Project

Open Windows Configuration Designer.
Click Provision Desktop Devices.
Enter a project name and choose a save location.
Click Finish to open the wizard.

Step 2: Configure the Wizard

The wizard has six steps. Here's what to do at each.

1 — Set up device

Enter a computer name template. A common convention is CompanyName-%Serial%, which prepends your company name to the device's serial number.

2 — Set up network

You can configure a wireless network here, but the wireless connection may not be established by the time the Level install script runs. Leave this blank — the PowerShell script in Step 4 handles wireless setup more reliably.

3 — Account management

Set up a local admin account here. If the device needs to be domain-joined, skip the domain join — that can be handled via a Level automation after enrollment.

4 — Add applications

This is where the Level install happens. You'll add a PowerShell script that joins the wireless network and installs the Level agent.

5 — Add certificates

No changes needed.

6 — Finish

Click Create to generate the .ppkg file.

Step 3: Prepare the PowerShell Script

Copy the script below into a text editor and save it as a .ps1 file. Update three values before saving:

Line 2: Replace Put Your SSID Here with your wireless network name
Line 3: Replace Put Your Wi-Fi Password Here with your wireless password
Near the end: Paste your Level install command where indicated (get it from Add new device → Windows → One-line command in Level)

__PRESERVE_CODE_8__

💡 TIP: The script logs its output to C:\temp\LevelInstall.txt on the target device. Check this file if the Level agent doesn't appear after provisioning.

⚠️ WARNING: The wireless password is stored in plain text in the .ps1 file and embedded in the .ppkg. Treat the provisioning package as a sensitive file and limit who has access to it.

Step 4: Add the Script to the Package

Back in the WCD wizard at the Add applications step:

Click + to add an application.
Give it a name (e.g., "Install Level Agent").
In the Installer Path field, browse to and select your .ps1 file.
In the Command Line Arguments field, enter:

__PRESERVE_CODE_13__

Replace your_script.ps1 with the actual filename.

Leave all other settings at their defaults and click Add.

Step 5: Generate and Deploy the Package

Complete the remaining wizard steps and click Create on the Finish page.
Copy the generated .ppkg file to a USB drive. Only the .ppkg is needed — the .ps1 script is embedded inside it.

To deploy to a new device:

Power on the device. It will boot into OOBE and display the language selection screen.
Do not answer any OOBE prompts.
Insert the USB drive.
Windows detects the .ppkg file and begins provisioning automatically.

The device renames itself, creates the local admin account, joins the wireless network, and installs the Level agent. It then appears in your Level Device Listing.

ℹ️ NOTE: The provisioning process takes a few seconds. The device will reboot once or twice as part of the process — this is expected.

FAQ

Can I use this for devices that will be joined to a domain? Yes — set up the local admin account in the wizard, skip the domain join step, and handle domain join later via a Level automation after the device enrolls.
What if my network doesn't use WPA2 PSK? The wireless profile in the script is configured for WPA2 PSK. If your network uses a different authentication method (WPA3, 802.1X, etc.), update the <authentication> and <encryption> values in the XML profile accordingly.
The device provisioned but Level isn't showing up — what happened? Check C:\temp\LevelInstall.txt on the device for the install log. Common causes: the wireless network wasn't joined before the connectivity timeout expired, or an AV/EDR tool blocked the Level download. See AV/EDR False Detections and Offline Troubleshooting.
Do I need to create a new package for each device group in Level? Yes — the install key embedded in the script determines which group the device lands in. Create a separate .ppkg per group, or use a single install key without a group and move devices afterward.
Can I use a wired network instead of wireless? Yes — remove the wireless profile and netsh wlan sections from the script and simplify the connectivity check to just verify that downloads.level.io is reachable.