diff --git a/packaging/build_release.ps1 b/packaging/build_release.ps1
index 7580f15..a1f1437 100644
--- a/packaging/build_release.ps1
+++ b/packaging/build_release.ps1
@@ -157,6 +157,15 @@ $builtAt = (Get-Date).ToUniversalTime().ToString("o")
 
 Set-Content -Path (Join-Path $stage ".portable") -Value "1" -Encoding ascii
 
+# Root .cmd launchers (Explorer / Start Menu friendly; ASCII-only).
+$cmdSrc = Join-Path $PSScriptRoot "cmd"
+foreach ($cmdName in @("NetX-FirstRun.cmd", "NetX-Start.cmd", "NetX-Tray.cmd")) {
+    $c = Join-Path $cmdSrc $cmdName
+    if (Test-Path $c) {
+        Copy-Item -Path $c -Destination (Join-Path $stage $cmdName) -Force
+    }
+}
+
 if ($CreateVenv) {
     Write-Host "==> Creating .venv in stage (requires Python 3.11+ on PATH)"
     $py = (Get-Command python -ErrorAction SilentlyContinue)
diff --git a/packaging/cmd/NetX-FirstRun.cmd b/packaging/cmd/NetX-FirstRun.cmd
new file mode 100644
index 0000000..c07282e
--- /dev/null
+++ b/packaging/cmd/NetX-FirstRun.cmd
@@ -0,0 +1,7 @@
+@echo off
+setlocal
+set "ROOT=%~dp0"
+if "%ROOT:~-1%"=="\" set "ROOT=%ROOT:~0,-1%"
+cd /d "%ROOT%"
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%ROOT%\packaging\launch_shortcut.ps1" -Action setup -ProgramRoot "%ROOT%" -DataRoot "%ProgramData%\NetX"
+exit /b %ERRORLEVEL%
diff --git a/packaging/cmd/NetX-Start.cmd b/packaging/cmd/NetX-Start.cmd
new file mode 100644
index 0000000..67f3675
--- /dev/null
+++ b/packaging/cmd/NetX-Start.cmd
@@ -0,0 +1,7 @@
+@echo off
+setlocal
+set "ROOT=%~dp0"
+if "%ROOT:~-1%"=="\" set "ROOT=%ROOT:~0,-1%"
+cd /d "%ROOT%"
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%ROOT%\packaging\launch_shortcut.ps1" -Action start -ProgramRoot "%ROOT%" -DataRoot "%ProgramData%\NetX"
+exit /b %ERRORLEVEL%
diff --git a/packaging/cmd/NetX-Tray.cmd b/packaging/cmd/NetX-Tray.cmd
new file mode 100644
index 0000000..262f21e
--- /dev/null
+++ b/packaging/cmd/NetX-Tray.cmd
@@ -0,0 +1,7 @@
+@echo off
+setlocal
+set "ROOT=%~dp0"
+if "%ROOT:~-1%"=="\" set "ROOT=%ROOT:~0,-1%"
+cd /d "%ROOT%"
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%ROOT%\packaging\launch_shortcut.ps1" -Action tray -ProgramRoot "%ROOT%" -DataRoot "%ProgramData%\NetX" -StartOnLaunch
+exit /b %ERRORLEVEL%
diff --git a/packaging/installer/netx.iss b/packaging/installer/netx.iss
index 2ee015d..9ed8b9f 100644
--- a/packaging/installer/netx.iss
+++ b/packaging/installer/netx.iss
@@ -4,7 +4,7 @@
 
 #define MyAppName "NetX"
 #ifndef MyAppVersion
-  #define MyAppVersion "0.4.3"
+  #define MyAppVersion "0.4.4"
 #endif
 #define MyAppPublisher "NetX"
 #define MyAppURL "https://github.com/hansjone/netx"
@@ -59,7 +59,7 @@ chinesesimplified.EnableAutoUpdate=启用每日静默自动更新（以后需要
 chinesesimplified.InstallService=安装为 Windows 服务（使用已捆绑的 WinSW，可离线）
 
 [Tasks]
-Name: "desktopicon"; Description: "{cm:CreateDesktopIcon}"; GroupDescription: "{cm:AdditionalIcons}"; Flags: unchecked
+Name: "desktopicon"; Description: "{cm:CreateDesktopIcon}"; GroupDescription: "{cm:AdditionalIcons}"; Flags: checkedonce
 Name: "firstrun"; Description: "{cm:RunFirstSetup}"; GroupDescription: "{cm:SetupOptions}"; Flags: checkedonce
 
 [Files]
@@ -75,16 +75,20 @@ Name: "{commonappdata}\NetX\pgdata"
 Name: "{commonappdata}\NetX\backups"
 
 [Icons]
-Name: "{group}\NetX Tray"; Filename: "powershell.exe"; Parameters: "-NoProfile -ExecutionPolicy Bypass -File ""{app}\packaging\launch_shortcut.ps1"" -Action tray -ProgramRoot ""{app}"" -DataRoot ""{commonappdata}\NetX"" -StartOnLaunch"; WorkingDir: "{app}"; IconFilename: "{app}\packaging\assets\netx.ico"
-Name: "{group}\Start NetX"; Filename: "powershell.exe"; Parameters: "-NoProfile -ExecutionPolicy Bypass -File ""{app}\packaging\launch_shortcut.ps1"" -Action start -ProgramRoot ""{app}"" -DataRoot ""{commonappdata}\NetX"""; WorkingDir: "{app}"; IconFilename: "{app}\packaging\assets\netx.ico"
+; Prefer .cmd targets so Server 2012 / classic Start Menu shows normal program entries.
+; Also pin First-time setup + Start to common desktop (always), not only optional tray icon.
+Name: "{group}\NetX Tray"; Filename: "{app}\NetX-Tray.cmd"; WorkingDir: "{app}"; IconFilename: "{app}\packaging\assets\netx.ico"
+Name: "{group}\Start NetX"; Filename: "{app}\NetX-Start.cmd"; WorkingDir: "{app}"; IconFilename: "{app}\packaging\assets\netx.ico"
 Name: "{group}\Stop NetX"; Filename: "powershell.exe"; Parameters: "-NoProfile -ExecutionPolicy Bypass -File ""{app}\packaging\launch_shortcut.ps1"" -Action stop -ProgramRoot ""{app}"" -DataRoot ""{commonappdata}\NetX"""; WorkingDir: "{app}"; IconFilename: "{app}\packaging\assets\netx.ico"
 Name: "{group}\Check for updates"; Filename: "powershell.exe"; Parameters: "-NoProfile -ExecutionPolicy Bypass -File ""{app}\packaging\launch_shortcut.ps1"" -Action update -ProgramRoot ""{app}"" -DataRoot ""{commonappdata}\NetX"""; WorkingDir: "{app}"; IconFilename: "{app}\packaging\assets\netx.ico"
 Name: "{group}\Open NetX UI"; Filename: "http://127.0.0.1:8890/"; IconFilename: "{app}\packaging\assets\netx.ico"
-Name: "{group}\First-time setup"; Filename: "powershell.exe"; Parameters: "-NoProfile -ExecutionPolicy Bypass -File ""{app}\packaging\launch_shortcut.ps1"" -Action setup -ProgramRoot ""{app}"" -DataRoot ""{commonappdata}\NetX"""; WorkingDir: "{app}"; IconFilename: "{app}\packaging\assets\netx.ico"
+Name: "{group}\First-time setup"; Filename: "{app}\NetX-FirstRun.cmd"; WorkingDir: "{app}"; IconFilename: "{app}\packaging\assets\netx.ico"
 Name: "{group}\Install Windows Service (admin)"; Filename: "powershell.exe"; Parameters: "-ExecutionPolicy Bypass -File ""{app}\packaging\install_service.ps1"" -ProgramRoot ""{app}"" -DataRoot ""{commonappdata}\NetX"" -Start"; WorkingDir: "{app}"; IconFilename: "{app}\packaging\assets\netx.ico"
 Name: "{group}\Enable silent auto-update (daily)"; Filename: "powershell.exe"; Parameters: "-ExecutionPolicy Bypass -File ""{app}\packaging\install_update_task.ps1"" -ProgramRoot ""{app}"" -DataRoot ""{commonappdata}\NetX"""; WorkingDir: "{app}"; IconFilename: "{app}\packaging\assets\netx.ico"
 Name: "{group}\Enable start at logon"; Filename: "powershell.exe"; Parameters: "-ExecutionPolicy Bypass -File ""{app}\packaging\install_autostart.ps1"" -ProgramRoot ""{app}"""; WorkingDir: "{app}"; IconFilename: "{app}\packaging\assets\netx.ico"
-Name: "{autodesktop}\NetX"; Filename: "powershell.exe"; Parameters: "-NoProfile -ExecutionPolicy Bypass -File ""{app}\packaging\launch_shortcut.ps1"" -Action tray -ProgramRoot ""{app}"" -DataRoot ""{commonappdata}\NetX"" -StartOnLaunch"; WorkingDir: "{app}"; IconFilename: "{app}\packaging\assets\netx.ico"; Tasks: desktopicon
+Name: "{commondesktop}\NetX First-time setup"; Filename: "{app}\NetX-FirstRun.cmd"; WorkingDir: "{app}"; IconFilename: "{app}\packaging\assets\netx.ico"
+Name: "{commondesktop}\NetX Start"; Filename: "{app}\NetX-Start.cmd"; WorkingDir: "{app}"; IconFilename: "{app}\packaging\assets\netx.ico"
+Name: "{commondesktop}\NetX"; Filename: "{app}\NetX-Tray.cmd"; WorkingDir: "{app}"; IconFilename: "{app}\packaging\assets\netx.ico"; Tasks: desktopicon
 
 [Run]
 ; First-run is NonInteractive + bundled DB so offline machines succeed without prompts or downloads.
diff --git a/packaging/launch_shortcut.ps1 b/packaging/launch_shortcut.ps1
index fd9e12d..5a43966 100644
--- a/packaging/launch_shortcut.ps1
+++ b/packaging/launch_shortcut.ps1
@@ -50,9 +50,10 @@ function Ensure-NetxEnv {
     & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $setup `
         -ProgramRoot $prog -DataRoot $data -NonInteractive -DbMode bundled
     if ($LASTEXITCODE -ne 0 -or -not (Test-Path $envPath)) {
+        $cmd = Join-Path $prog "NetX-FirstRun.cmd"
         throw (T `
-            "First-time setup failed. Run Start Menu → NetX → First-time setup.`nLog: $log" `
-            "首次配置失败。请运行「开始菜单 → NetX → First-time setup」。`n日志: $log")
+            "First-time setup failed.`nDouble-click: $cmd`nOr: Start Menu → All Programs → NetX → First-time setup`nLog: $log" `
+            "首次配置失败。`n请双击: $cmd`n或: 开始菜单 → 所有程序 → NetX → First-time setup`n日志: $log")
     }
 }
 
diff --git a/packaging/manifest.example.json b/packaging/manifest.example.json
index 06459d3..952a592 100644
--- a/packaging/manifest.example.json
+++ b/packaging/manifest.example.json
@@ -1,11 +1,11 @@
 {
   "channel": "stable",
-  "latest": "0.4.3",
+  "latest": "0.4.4",
   "min_compatible": "0.3.0",
-  "notes_url": "https://github.com/hansjone/netx/releases/tag/v0.4.3",
+  "notes_url": "https://github.com/hansjone/netx/releases/tag/v0.4.4",
   "windows": {
-    "url": "https://github.com/hansjone/netx/releases/download/v0.4.3/NetX-0.4.3-win64.zip",
-    "setup_url": "https://github.com/hansjone/netx/releases/download/v0.4.3/NetX-Setup-0.4.3.exe",
+    "url": "https://github.com/hansjone/netx/releases/download/v0.4.4/NetX-0.4.4-win64.zip",
+    "setup_url": "https://github.com/hansjone/netx/releases/download/v0.4.4/NetX-Setup-0.4.4.exe",
     "sha256": "",
     "size": 0
   }
diff --git a/pyproject.toml b/pyproject.toml
index ee59d1a..3c04c34 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "netx-ops"
-version = "0.4.3"
+version = "0.4.4"
 description = "netx operations tool: alarm-centric workflows with REST API and stdio MCP"
 readme = "README.md"
 requires-python = ">=3.11"