“The bypass uses a CXH (cloud experience host) URI (Uniform Resource Identifier) string during the OOBE to invoke the hidden local account setup screen.” this had to be data mined or something yeah.