Windows Settings rejected the provisioning XML: Global/SubscriberId is base:SubscriberType (\w+, at most 20 characters) in the schemas Windows ships in %SYSTEMROOT%\schemas\provisioning, and "renner-unifi" contains a hyphen. It is now "rennerunifi". Those schemas also allow WPA3ENT and Hotspot2/NAIRealm, which the online schema reference lacks: the profile uses WPA3ENT again (the network is WPA3-Enterprise) and carries NAI realm renner.uno next to the domain. TestWindowsProfileSchema validates the signed document with xmllint against a copy of that schema folder (WLAN_SETUP_PROVISIONING_XSD); without it the test is skipped, the schemas are Microsoft's files and not in the repo. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>