diff --git a/.gitmodules b/.gitmodules
index 4dda871..5805817 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -40,3 +40,6 @@
 [submodule "roles/do1jlr.win_rdp"]
 	path = roles/do1jlr.win_rdp
 	url = https://backwesen.de/voc/win_ansible_role_rdp.git
+[submodule "roles/do1jlr.win_activation"]
+	path = roles/do1jlr.win_activation
+	url = https://backwesen.de/voc/win_ansible_role_activating.git
diff --git a/README.md b/README.md
index 48295eb..38ce37a 100644
--- a/README.md
+++ b/README.md
@@ -68,6 +68,10 @@ After you installed the required deploy host python packages you can verify that
 ansible -m win_ping all
 ```
 
+ Windows Installation
+----------------------
+There is a prepared [autounattend.xml](autounattend.xml) to automate the windows installation.
+
  Ad-hoc copy file example:
 ----------------------------
 ```bash
diff --git a/autounattend.xml b/autounattend.xml
index 2abaca8..e1855cd 100644
--- a/autounattend.xml
+++ b/autounattend.xml
@@ -207,12 +207,18 @@ Notes: Enter your comments here...
 				</SynchronousCommand>
 				<SynchronousCommand wcm:action="add">
 					<Order>3</Order>
-					<Description>autostart OpenSSH</Description>
+					<Description>tart OpenSSH</Description>
 					<RequiresUserInput>false</RequiresUserInput>
 					<CommandLine>powershell -command "Start-Service sshd"</CommandLine>
 				</SynchronousCommand>
 				<SynchronousCommand wcm:action="add">
 					<Order>4</Order>
+					<Description>autostart OpenSSH</Description>
+					<RequiresUserInput>false</RequiresUserInput>
+					<CommandLine>powershell -command "Set-Service -Name sshd -StartupType 'Automatic'"</CommandLine>
+				</SynchronousCommand>
+				<SynchronousCommand wcm:action="add">
+					<Order>5</Order>
 					<Description>OpenSSH PowerShell as default shell</Description>
 					<RequiresUserInput>false</RequiresUserInput>
 					<CommandLine>reg add "HKLM\Software\OpenSSH" /v DefaultShell /t REG_SZ /d "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /f</CommandLine>
diff --git a/group_vars/obs/vars.yml b/group_vars/obs/vars.yml
index 9b2424c..5774f6a 100644
--- a/group_vars/obs/vars.yml
+++ b/group_vars/obs/vars.yml
@@ -31,6 +31,8 @@ win_sshd_otherusepassword: "{{ win_obs_init__autologon_password }}"
 win__special_rdp_user: "{{ voc_user }}"
 win__allow_special_rdp_user: true
 
+# windows product key
+windows_product_key: "{{ lookup('community.general.passwordstore', 'chvoc/ansible/windows/productkey') }}"
 
 # define obs szene
 win_obs_szene__project: 'wk23'
diff --git a/hosts.ini b/hosts.ini
index 2cc7525..f0fa0fa 100644
--- a/hosts.ini
+++ b/hosts.ini
@@ -2,5 +2,5 @@
 obs-white ansible_host=obs-white.local
 obs-yellow ansible_host=10.10.0.211
 # obs-yellow.local
-obs-blue ansible_host=obs-blue.local
+# obs-blue ansible_host=obs-blue.local
 obs-misc ansible_host=obs-misc.local
diff --git a/roles/do1jlr.win_activation b/roles/do1jlr.win_activation
new file mode 160000
index 0000000..b536447
--- /dev/null
+++ b/roles/do1jlr.win_activation
@@ -0,0 +1 @@
+Subproject commit b53644731950306207f65f7e2b5780dbe72b2f9c
diff --git a/site.yml b/site.yml
index c754bc3..0dbb637 100644
--- a/site.yml
+++ b/site.yml
@@ -8,6 +8,7 @@
 - name: Deploy windows users and basic config
   hosts: obs
   roles:
+    - {role: tasks, tags: [task]}
     - {role: win_warn_ansible_start, tags: [always, warn]}
     - {role: do1jlr.win_winerm, tags: winrm}
     - {role: do1jlr.win_base_setup, tags: [user, setup]}