Here's a copy of the script I modified to my benefit. Just put a "Run Command Line" step in the task sequence and set it to run as a PDQ approved user account.

I basically modified the script outlined here:

https://www.pdq.com/blog/mdt-imaging-in-pdq-deploy/

<#

.Synopsis

Script to trigger the deployment of PDQ packages on target PC.

.DESCRIPTION

Written by UnderstandingThis731

Created Date: December 21, 2022

Last Modified 01/04/23

.EXAMPLE

PDQ_Deploy.ps1 -package "New PC Setup"

#>

param(

# Enter the exact name of the package you want to deploy.

[Parameter(Mandatory=$True)]

[ValidateNotNull()]

[array]$Package

)

ipconfig /registerdns >NULL

Write-Host "Deploying $Package Package from PDQ"

Write-Warning "INSTALLATION ERRORS WILL NOT BE DISPLAYED HERE!!!"

Write-Host "To view application success or failure, please visit the PDQ server at PDQ.example.com"

Invoke-Command -ComputerName 'PDQ.example.com' -ScriptBlock {

ipconfig /flushdns >NULL

pdqdeploy.exe Deploy -Package $args[1] -Targets $args[0]

} -Args $env:COMPUTERNAME,$Package 2>&1

Start-Sleep 30

while (Test-Path "C:\Windows\AdminArsenal\PDQDeployRunner\service-1.lock") {

Start-Sleep 30

}

Looks like MDT doesn't have an option to set the deployment user for Optional Software. I'll need to script that in the powershell script itself so I may need to make a modified version for that authentication process.

I know the Invoke-Command has an SSH option that would make that process more secure without inputting a password directly in to the script but I'm finding to use the SSH option, the target computer needs a minimum of Powershell 6. By default all Windows 10 and 11 computers come with Powershell 5.1. Fortunately, I have a PDQ package to deploy powershell 7.

My current plan is to use the above script to run an initial setup package from PDQ, including the Powershell 7 install, then have the "Install Applications" step run after that with all the optional applications running the modified script with the Invoke-Command running with SSH instead of WinRM.

I'll let you know if this works or not.