Add fixnetworkshare, winrm-setup-package, udc remote-execution suites

- NetworkDriveManager.ps1: S: drive repair utility - winrm-setup-package: Invoke-RemoteTask helper + Setup-WinRM.bat + HTML guide - remote-execution/udc: UDC_Update.ps1 and batch wrappers for updating DNC controllers on shop-floor PCs - Invoke-RemoteMaintenance.ps1: substantial rework (~1650 lines) - Schedule-Maintenance and complete-asset minor updates - Bump edncfix gitlink to v1.6.0 (2748bfa) - .gitignore: block inventory.csv/xlsx (CUI) and logs_*.txt (per-host logs) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-17 12:04:40 -04:00
parent 847ec402bd
commit 86b32d8597
24 changed files with 6945 additions and 1352 deletions
--- a/docs/Invoke-RemoteMaintenance.md
+++ b/docs/Invoke-RemoteMaintenance.md
@@ -5,6 +5,7 @@ Remote maintenance toolkit for executing maintenance tasks on shopfloor PCs via
 ## Table of Contents

 - [Overview](#overview)
+- [First-Time Setup](#first-time-setup)
 - [API Integration](#api-integration)
 - [Prerequisites](#prerequisites)
 - [Quick Start](#quick-start)
@@ -17,6 +18,8 @@ Remote maintenance toolkit for executing maintenance tasks on shopfloor PCs via
  - [Service Management](#how-to-manage-services)
  - [Time Synchronization](#how-to-fix-time-sync-issues)
  - [DNC Configuration](#how-to-update-dnc-configurations)
+  - [File Deployment](#how-to-deploy-files)
+  - [Registry Import](#how-to-import-registry-files)
  - [Software Deployment](#how-to-deploy-software)
  - [Batch Operations](#how-to-run-batch-operations)
 - [Targeting Strategies](#targeting-strategies)
@@ -32,13 +35,53 @@ This script provides a comprehensive remote maintenance toolkit for managing sho
 **Location:** `S:\dt\shopfloor\scripts\remote-execution\Invoke-RemoteMaintenance.ps1`

 **Key Features:**
- 19 maintenance tasks available
+- 22 maintenance tasks available
+- General-purpose file deployment (`CopyFile`) and registry import (`ImportReg`) tasks
+- Registry imports run as logged-in user via scheduled task (HKCU support)
+- Optional post-copy commands via scheduled task (service/app restarts)
 - Multiple targeting options (by name, type, business unit, or all)
 - Concurrent execution with configurable throttling
 - Integration with ShopDB for PC discovery

 ---

+## First-Time Setup
+
+Before running this script for the first time, you must allow PowerShell script execution and unblock the script file.
+
+### Step 1: Allow PowerShell Script Execution
+
+Open PowerShell **as Administrator** and run:
+
+```powershell
+Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
+```
+
+When prompted, type `Y` and press Enter. This allows locally-created scripts to run and requires downloaded scripts to be signed or unblocked.
+
+> **Note:** You only need to do this once per user account. `RemoteSigned` is the recommended policy — it allows local scripts while still protecting against untrusted downloads.
+
+### Step 2: Unblock the Script File
+
+Files downloaded from a network share or the internet are marked as "blocked" by Windows. You must unblock the script before it can run.
+
+**Option A — File Explorer (GUI):**
+
+1. Navigate to `S:\dt\shopfloor\scripts\remote-execution\`
+2. Right-click `Invoke-RemoteMaintenance.ps1` and select **Properties**
+3. At the bottom of the General tab, check the **Unblock** checkbox
+4. Click **Apply**, then **OK**
+
+**Option B — PowerShell:**
+
+```powershell
+Unblock-File -Path "S:\dt\shopfloor\scripts\remote-execution\Invoke-RemoteMaintenance.ps1"
+```
+
+> **Important:** If you skip this step, you will get a security error when trying to run the script: *"cannot be loaded because running scripts is disabled on this system"* or *"cannot be loaded. The file is not digitally signed."*
+
+---
+
 ## API Integration

 When using `-All`, `-PcType`, or `-BusinessUnit` targeting, the script retrieves PC lists from the ShopDB API:
@@ -53,12 +96,12 @@ GET /api.asp?action=getShopfloorPCs&businessunitid=1 # Specific business unit

 | ID | Type | ID | Type |
 |----|------|----|------|
-| 1 | Shopfloor | 7 | Heat Treat |
-| 2 | CMM | 8 | Engineer |
-| 3 | Wax Trace | 9 | Standard |
-| 4 | Keyence | 10 | Inspection |
-| 5 | EAS1000 | 11 | Dashboard |
-| 6 | Genspect | 12 | Lobby Display |
+| 1 | Standard | 7 | Keyence |
+| 2 | Engineer | 8 | Genspect |
+| 3 | Shopfloor | 9 | Heat Treat |
+| 4 | Uncategorized | 10 | Inspection |
+| 5 | CMM | 11 | Dashboard |
+| 6 | Wax / Trace | 12 | Lobby Display |

 **See:** [ShopDB API Reference](ShopDB-API.html) for complete API documentation.

@@ -133,6 +176,15 @@ The script outputs status for each PC:
 |-----------|------|-------------|
 | `-Task` | string | Maintenance task to execute |

+### File Deployment Parameters (CopyFile / ImportReg)
+
+| Parameter | Type | Description |
+|-----------|------|-------------|
+| `-SourcePath` | string | Source file path (local or UNC). Required for CopyFile and ImportReg |
+| `-DestinationPath` | string | Destination file path on remote PCs. Required for CopyFile |
+| `-RunCommand` | string | Command to run after CopyFile. Runs as logged-in user by default (via scheduled task) |
+| `-AsSystem` | switch | Run ImportReg and -RunCommand in the WinRM session (SYSTEM context) instead of as logged-in user |
+
 ### Optional Parameters

 | Parameter | Type | Default | Description |
@@ -140,7 +192,8 @@ The script outputs status for each PC:
 | `-Credential` | PSCredential | Prompt | Remote authentication |
 | `-ApiUrl` | string | Production | ShopDB API endpoint |
 | `-ThrottleLimit` | int | 5 | Max concurrent sessions |
-| `-DnsSuffix` | string | logon.ds.ge.com | DNS suffix for resolution |
+| `-DnsSuffix` | string | logon.ds.ge.com | DNS suffix for FQDN resolution |
+| `-LogFile` | switch | Off | Enable transcript logging to `logs/` directory |

 ### PC Types

@@ -194,13 +247,22 @@ TBD, Blisk, HPT, Spools, Inspection, Venture, Turn/Burn, DT

 | Task | Description | Duration | Impact |
 |------|-------------|----------|--------|
-| `UpdateEMxAuthToken` | Update eMx auth from share | 1-2 min | None |
-| `DeployUDCWebServerConfig` | Deploy UDC config | 1-2 min | None |
+| `UpdateDNCMXHosts` | Update FtpHostPrimary/Secondary in DNC\MX registry | <1 min | None |
+| `AuditDNCConfig` | Compare DNC registry vs UDC backup JSON, export CSV | 1-5 min | None |
+| `CheckDefectTracker` | Check if Defect_Tracker.exe is running, export CSV | 1-5 min | None |
+
+### File Deployment Tasks
+
+| Task | Description | Duration | Impact |
+|------|-------------|----------|--------|
+| `CopyFile` | Copy file from `-SourcePath` to `-DestinationPath` on remote PCs | 1-2 min | Low |
+| `ImportReg` | Copy `.reg` file and import via scheduled task as logged-in user | 1-2 min | Low |

 ### System Tasks

 | Task | Description | Duration | Impact |
 |------|-------------|----------|--------|
+| `GPUpdate` | Force Group Policy refresh (`gpupdate /force`) | <1 min | Low |
 | `Reboot` | Restart PC (30s delay) | 2-5 min | High |

 ### Software Deployment Tasks
@@ -222,18 +284,19 @@ Deployment tasks require source files to be available before execution:

 | Task | Source File Path |
 |------|------------------|
-| `InstallDashboard` | `\\tsgwp00525.wjs.geaerospace.net\dt\shopfloor\scripts\Dashboard\GEAerospaceDashboardSetup.exe` |
-| `InstallLobbyDisplay` | `\\tsgwp00525.wjs.geaerospace.net\dt\shopfloor\scripts\LobbyDisplay\GEAerospaceLobbyDisplaySetup.exe` |
-| `UpdateEMxAuthToken` | `\\tsgwp00525.wjs.geaerospace.net\dt\shopfloor\scripts\eMx\eMxInfo.txt` |
-| `DeployUDCWebServerConfig` | `\\tsgwp00525.wjs.geaerospace.net\dt\shopfloor\scripts\UDC\udc_webserver_settings.json` |
+| `InstallDashboard` | `\\tsgwp00525.wjs.geaerospace.net\shared\dt\shopfloor\scripts\Dashboard\GEAerospaceDashboardSetup.exe` |
+| `InstallLobbyDisplay` | `\\tsgwp00525.wjs.geaerospace.net\shared\dt\shopfloor\scripts\LobbyDisplay\GEAerospaceLobbyDisplaySetup.exe` |
+| `CopyFile` | Any file - specified via `-SourcePath` parameter |
+| `ImportReg` | Any `.reg` file - specified via `-SourcePath` parameter |

 ### How Deployment Works

 1. **Pre-flight Check:** Script verifies source file exists
 2. **WinRM Session:** Opens remote session to target PC
 3. **File Push:** Copies source file to `C:\Windows\Temp\` on remote PC
-4. **Execution:** Runs install/copy task using pushed file
-5. **Cleanup:** Removes temp file from remote PC
+4. **Execution:** Runs install/copy/import task using pushed file
+5. **Post-action:** Optionally runs command as logged-in user via scheduled task
+6. **Cleanup:** Removes temp file from remote PC

 ```
 +---------------------+     WinRM      +---------------------+
@@ -242,50 +305,44 @@ Deployment tasks require source files to be available before execution:
 |  Source Files:      |   Push File    |  Temp Location:     |
 |  - Setup.exe        | ------------>  |  C:\Windows\Temp    |
 |  - config.json      |                |                     |
-|  - eMxInfo.txt      |   Execute      |  Final Location:    |
-|    (network)        | ------------>  |  C:\Program Files   |
+|  - settings.reg     |   Execute      |  Final Location:    |
+|    (any path/UNC)   | ------------>  |  -DestinationPath   |
+|                     |                |                     |
+|                     |  Sched. Task   |  Logged-in User:    |
+|                     | ------------>  |  - regedit /s       |
+|                     |                |  - RunCommand        |
 +---------------------+                +---------------------+
 ```

-### Directory Structure
+### CopyFile Details

-Ensure your script directory contains the required files:
+The `CopyFile` task:

-```
-S:\dt\shopfloor\scripts\remote-execution\
-├── Invoke-RemoteMaintenance.ps1
-├── GEAerospaceDashboardSetup.exe      # For InstallDashboard
-├── GEAerospaceLobbyDisplaySetup.exe   # For InstallLobbyDisplay
-└── udc_webserver_settings.json        # For DeployUDCWebServerConfig
-```
+1. **Source:** Any file specified via `-SourcePath` (local or UNC path)
+2. **Destination:** Specified via `-DestinationPath`
+3. **Backup:** Existing file is backed up as `<name>-old-<timestamp>.<ext>`
+4. **Post-action:** If `-RunCommand` is specified, runs as the logged-in user via a one-shot scheduled task (same pattern as Dashboard/Lobby kiosk relaunch)

-### eMx Auth Token Details
+### ImportReg Details

-The `UpdateEMxAuthToken` task:
+The `ImportReg` task:

-1. **Source:** `\\tsgwp00525.wjs.geaerospace.net\dt\shopfloor\scripts\eMx\eMxInfo.txt`
-2. **Destinations:** (both paths if they exist)
-   - `C:\Program Files\GE Aircraft Engines\DNC\eMxInfo.txt`
-   - `C:\Program Files (x86)\GE Aircraft Engines\DNC\eMxInfo.txt`
-3. **Backup:** Creates `eMxInfo-old-YYYYMMDD-HHMMSS.txt` before overwriting
-4. **Post-action:** Restarts DNC service (`LDnc.exe`)
-
-### UDC Web Server Config Details
-
-The `DeployUDCWebServerConfig` task:
-
-1. **Pre-check:** Verifies UDC is installed (`C:\Program Files\UDC` exists)
-2. **Skip:** PCs without UDC are skipped (not counted as failures)
-3. **Destination:** `C:\ProgramData\UDC\udc_webserver_settings.json`
-4. **Backup:** Creates backup before overwriting
+1. **Source:** `.reg` file specified via `-SourcePath`
+2. **Import method:** `regedit.exe /s` via one-shot scheduled task as logged-in user
+3. **HKCU support:** Runs as the logged-in user, so both HKLM and HKCU keys apply correctly
+4. **Fallback:** If no user is logged in, runs `regedit.exe /s` directly (HKLM only)
+5. **Cleanup:** Temp `.reg` file removed after import

 ### Dashboard/Lobby Display Install Details

 Both kiosk app installers:

 1. **Installer type:** Inno Setup (supports `/VERYSILENT`)
-2. **Execution:** Silent install with no user prompts
-3. **Cleanup:** Installer removed from temp after execution
+2. **Pre-install:** Kills running Edge kiosk via `PrepareToInstall` in Inno Setup
+3. **Execution:** Silent install with no user prompts (120-second timeout)
+4. **Post-install:** Creates a one-shot scheduled task to relaunch Edge in kiosk mode as the logged-in user (e.g. `lg044513sd`), then auto-deletes the task
+5. **Cleanup:** Installer removed from temp after execution
+6. **Connectivity:** Offline PCs are skipped with a ping check before connecting

 **Uninstall GUIDs:**
 - Dashboard: `{9D9EEE25-4D24-422D-98AF-2ADEDA4745ED}`
@@ -295,7 +352,7 @@ Both kiosk app installers:

 To add a new application for deployment, edit the script in two places:

-**Step 1: Add to `$KioskAppConfig` hashtable (~line 1388)**
+**Step 1: Add to `$KioskAppConfig` hashtable**

 ```powershell
 $KioskAppConfig = @{
@@ -304,10 +361,11 @@ $KioskAppConfig = @{
    # Add new application
    'InstallNewApp' = @{
        Action = 'Install'
-        InstallerPath = '\\tsgwp00525.wjs.geaerospace.net\dt\shopfloor\scripts\NewApp\NewAppSetup.exe'
+        InstallerPath = '\\tsgwp00525.wjs.geaerospace.net\shared\dt\shopfloor\scripts\NewApp\NewAppSetup.exe'
        InstallerName = 'NewAppSetup.exe'
        AppName = 'New Application Name'
        UninstallGuid = '{YOUR-GUID-HERE}'  # Find in registry after manual install
+        KioskUrl = 'https://tsgwp00525.wjs.geaerospace.net/shopdb/your-page/'  # Optional: relaunch Edge kiosk after install
    }
    'UninstallNewApp' = @{
        Action = 'Uninstall'
@@ -334,7 +392,7 @@ $KioskAppConfig = @{
 **Step 3: Place installer on network share**

 ```
-\\tsgwp00525.wjs.geaerospace.net\dt\shopfloor\scripts\NewApp\NewAppSetup.exe
+\\tsgwp00525.wjs.geaerospace.net\shared\dt\shopfloor\scripts\NewApp\NewAppSetup.exe
 ```

 **Finding the Uninstall GUID:**
@@ -562,37 +620,129 @@ wuauclt /detectnow

 ### How to Update DNC Configurations

-#### Update eMx Authentication Token
+#### Update DNC MX Hosts

-**Scenario:** eMx authentication is failing on DNC PCs.
+**Scenario:** FtpHostPrimary/FtpHostSecondary in DNC\MX registry needs updating (hostname migration).

 ```powershell
 # Single PC
-.\Invoke-RemoteMaintenance.ps1 -ComputerName "DNC-PC01" -Task UpdateEMxAuthToken -Credential $cred
+.\Invoke-RemoteMaintenance.ps1 -ComputerName "DNC-PC01" -Task UpdateDNCMXHosts -Credential $cred

 # All shopfloor PCs
-.\Invoke-RemoteMaintenance.ps1 -All -Task UpdateEMxAuthToken -Credential $cred
+.\Invoke-RemoteMaintenance.ps1 -All -Task UpdateDNCMXHosts -Credential $cred
 ```

 **What it does:**
-1. Backs up existing `eMxInfo.txt` with timestamp
-2. Copies new token file from network share
-3. Verifies file was updated
+1. Checks both 32-bit (WOW6432Node) and 64-bit registry paths
+2. Only updates values matching the old hostname - skips unexpected values
+3. Safe to run on all PCs: no-ops if DNC\MX key doesn't exist

-#### Deploy UDC Web Server Configuration
+#### Audit DNC Config vs UDC Backup

-**Scenario:** UDC web server settings need to be updated.
+**Scenario:** Verify DNC registry settings match UDC backup JSON files.

 ```powershell
-# Deploy to PCs with UDC installed
-.\Invoke-RemoteMaintenance.ps1 -ComputerName "UDC-PC01","UDC-PC02" -Task DeployUDCWebServerConfig -Credential $cred
+.\Invoke-RemoteMaintenance.ps1 -All -Task AuditDNCConfig -Credential $cred -LogFile
 ```

 **What it does:**
-1. Checks if UDC is installed
-2. Backs up existing configuration
-3. Deploys new web server settings
-4. Does NOT restart UDC (requires manual restart)
+1. Reads DNC registry values (General, eFocas, Hssb, PPDCS keys)
+2. Compares against UDC backup JSON files on the network share
+3. Reports MATCH/MISMATCH/MISSING for each field
+4. Exports CSV report to `logs/`
+
+#### Check Defect Tracker Status
+
+```powershell
+.\Invoke-RemoteMaintenance.ps1 -PcType Shopfloor -Task CheckDefectTracker -Credential $cred
+```
+
+**What it does:**
+1. Checks if `Defect_Tracker.exe` is running on each PC
+2. Reports machine number + running status
+3. Exports CSV report to `logs/`
+
+---
+
+### How to Deploy Files
+
+**Scenario:** Push any file to remote PCs with automatic backup of existing files.
+
+#### Basic File Copy
+
+```powershell
+# Copy a config file to a specific destination
+.\Invoke-RemoteMaintenance.ps1 -ComputerName "PC01","PC02" -Task CopyFile `
+    -SourcePath "\\server\share\config.json" `
+    -DestinationPath "C:\ProgramData\App\config.json" `
+    -Credential $cred
+```
+
+**What it does:**
+1. Copies source file to `C:\Windows\Temp\` on remote PC via WinRM
+2. Creates backup of existing file (if any) with timestamp
+3. Moves temp file to final destination
+4. Verifies deployment
+
+#### File Copy with Post-Copy Command
+
+**Scenario:** Deploy a file and restart a service/app in the logged-in user's session.
+
+```powershell
+# Deploy eMxInfo.txt and kill DNC so it picks up the new file
+.\Invoke-RemoteMaintenance.ps1 -All -Task CopyFile `
+    -SourcePath "\\server\share\eMxInfo.txt" `
+    -DestinationPath "C:\Program Files (x86)\DNC\Server Files\eMxInfo.txt" `
+    -RunCommand "taskkill /IM DNCMain.exe /F" `
+    -Credential $cred
+
+# Deploy UDC config (no restart needed)
+.\Invoke-RemoteMaintenance.ps1 -PcType Shopfloor -Task CopyFile `
+    -SourcePath "\\server\share\udc_webserver_settings.json" `
+    -DestinationPath "C:\ProgramData\UDC\udc_webserver_settings.json" `
+    -Credential $cred
+```
+
+The `-RunCommand` runs via a one-shot scheduled task as the logged-in user, so it works for user-session processes (same pattern as Dashboard/Lobby Display kiosk relaunch).
+
+---
+
+### How to Import Registry Files
+
+**Scenario:** Apply registry settings from a `.reg` file to remote PCs.
+
+```powershell
+# Import a .reg file on all shopfloor PCs
+.\Invoke-RemoteMaintenance.ps1 -PcType Shopfloor -Task ImportReg `
+    -SourcePath "\\server\share\intranet-zone.reg" `
+    -Credential $cred
+
+# Import on specific PCs
+.\Invoke-RemoteMaintenance.ps1 -ComputerName "PC01" -Task ImportReg `
+    -SourcePath "C:\Scripts\my-settings.reg" `
+    -Credential $cred
+```
+
+**What it does (default — as logged-in user):**
+1. Copies `.reg` file to `C:\Windows\Temp\` on remote PC via WinRM
+2. Creates a one-shot scheduled task as the logged-in user
+3. Runs `regedit.exe /s` to silently import the registry file
+4. Cleans up temp file and scheduled task
+
+**HKCU support:** Because the import runs as the logged-in user (via scheduled task), both `HKLM` and `HKCU` keys in the `.reg` file are applied correctly. If no user is logged in, it falls back to direct import (HKLM only).
+
+#### HKLM-Only / System Context
+
+Use `-AsSystem` when the `.reg` file only contains `HKLM` keys and you want to skip the scheduled task overhead:
+
+```powershell
+# Import HKLM-only registry settings directly as SYSTEM
+.\Invoke-RemoteMaintenance.ps1 -All -Task ImportReg `
+    -SourcePath "\\server\share\machine-policy.reg" `
+    -AsSystem -Credential $cred
+```
+
+This runs `regedit.exe /s` directly in the WinRM session (SYSTEM context). Faster, but HKCU keys will not apply to any user.

 ---

@@ -612,22 +762,21 @@ $kiosks = @("KIOSK-01", "KIOSK-02", "KIOSK-03")
 ```

 **What it does:**
-1. Copies installer from network share
-2. Runs silent installation
-3. Configures auto-start
-4. Cleans up installer
+1. Pings target PC (skips if offline)
+2. Copies installer from network share to `C:\Windows\Temp\`
+3. Kills running Edge kiosk
+4. Runs silent installation (120-second timeout)
+5. Relaunches Edge kiosk via scheduled task as the logged-in user
+6. Cleans up installer and scheduled task

-**After installation:**
- Run data collection to update PC type
- Reboot PC to complete setup
+**No reboot required** — Edge relaunches automatically in the logged-in user's session.

 ```powershell
-# Complete Dashboard deployment sequence
-.\Invoke-RemoteMaintenance.ps1 -ComputerName "KIOSK-01" -Task InstallDashboard -Credential $cred
-.\Invoke-RemoteMaintenance.ps1 -ComputerName "KIOSK-01" -Task Reboot -Credential $cred
+# Deploy to all Dashboard kiosks
+.\Invoke-RemoteMaintenance.ps1 -PcType Dashboard -Task InstallDashboard -Credential $cred

-# After reboot, update ShopDB
-.\Update-ShopfloorPCs-Remote.ps1 -ComputerName "KIOSK-01" -Credential $cred
+# Deploy to all Lobby Display kiosks
+.\Invoke-RemoteMaintenance.ps1 -PcType "Lobby Display" -Task InstallLobbyDisplay -Credential $cred
 ```

 #### Install Lobby Display