powershell-scripts/winrm-https/deployment-package/NETWORK_SHARE_DEPLOYMENT.md

# Network Share Deployment Guide

This guide explains how to deploy WinRM HTTPS to shopfloor PCs using a network share.

## Overview

Instead of manually copying files to each PC, you can:
1. Place all files on a network share
2. Access the share from each PC
3. Run a batch file to install

This is faster and ensures all PCs get the same configuration.

## Setup Network Share

### Step 1: Create Network Share

**On your file server or management computer:**

```powershell
# Create deployment folder
$deployPath = "C:\Deployment\WinRM-HTTPS"
New-Item -Path $deployPath -ItemType Directory -Force

# Copy all required files to deployment folder
Copy-Item "C:\users\570005354\Downloads\winrm-https\*" -Destination $deployPath -Recurse

# Share the folder
New-SmbShare -Name "WinRM-HTTPS" -Path $deployPath -FullAccess "Everyone"
```

**Or manually:**
1. Create folder: `C:\Deployment\WinRM-HTTPS`
2. Copy all files from `winrm-https` folder
3. Right-click folder → Properties → Sharing → Advanced Sharing
4. Check "Share this folder"
5. Share name: `WinRM-HTTPS`
6. Permissions: Give "Everyone" Read access (or specific security group)

### Step 2: Verify Share Access

**From another computer:**
```powershell
# Test access (replace SERVER with your server name)
Test-Path "\\SERVER\WinRM-HTTPS"

# List files
Get-ChildItem "\\SERVER\WinRM-HTTPS"
```

Expected files:
- ✅ `Deploy-WinRM-HTTPS.bat`
- ✅ `Setup-WinRM-HTTPS.ps1`
- ✅ `wildcard-logon-ds-ge-com-20251017.pfx`
- ✅ Other PS1 scripts

---

## Required Files for Deployment

### Minimal Deployment Package

For basic deployment, you need:

```
\\SERVER\WinRM-HTTPS\
├── Deploy-WinRM-HTTPS.bat              (NEW - Main deployment script)
├── Setup-WinRM-HTTPS.ps1               (WinRM HTTPS setup)
├── wildcard-logon-ds-ge-com-20251017.pfx (Certificate - REQUIRED)
└── README.txt                          (Optional - Instructions)
```

### Complete Package (Recommended)

Include everything for troubleshooting:

```
\\SERVER\WinRM-HTTPS\
├── Deploy-WinRM-HTTPS.bat              (Deployment batch file)
├── Test-WinRM-HTTPS.bat                (Test batch file)
├── Setup-WinRM-HTTPS.ps1               (WinRM setup script)
├── Test-WinRM-HTTPS-Setup.ps1          (Test script)
├── Generate-WildcardCert.ps1           (Certificate generator - optional)
├── Generate-WildcardCert-Alternative.ps1 (Alternative generator)
├── wildcard-logon-ds-ge-com-20251017.pfx (Certificate - REQUIRED!)
├── README.md                           (Documentation)
├── GETTING_STARTED.md                  (User guide)
├── NETWORK_SHARE_DEPLOYMENT.md         (This file)
└── TROUBLESHOOTING_CERTIFICATE_GENERATION.md
```

---

## Deployment Methods

### Method 1: User Runs from Network Share (Simplest)

**On each shopfloor PC:**

1. Open Windows Explorer
2. Navigate to: `\\SERVER\WinRM-HTTPS`
3. Right-click `Deploy-WinRM-HTTPS.bat`
4. Select "Run as Administrator"
5. Enter certificate password when prompted
6. Wait for completion

**Advantages:**
- ✅ Simple - no copying needed
- ✅ Always uses latest files
- ✅ No local disk space used

**Disadvantages:**
- ⚠️ Requires network connectivity during install
- ⚠️ Slower if network is congested

---

### Method 2: Copy to Local Then Run (Recommended)

**On each shopfloor PC:**

```powershell
# Copy files locally first
New-Item -Path "C:\Temp\WinRM-Setup" -ItemType Directory -Force
Copy-Item "\\SERVER\WinRM-HTTPS\*" -Destination "C:\Temp\WinRM-Setup\" -Recurse

# Run locally
cd C:\Temp\WinRM-Setup
.\Deploy-WinRM-HTTPS.bat
```

**Or using batch file:**
```batch
@echo off
echo Copying deployment files...
xcopy "\\SERVER\WinRM-HTTPS\*" "C:\Temp\WinRM-Setup\" /E /Y
cd /d C:\Temp\WinRM-Setup
Deploy-WinRM-HTTPS.bat
```

**Advantages:**
- ✅ Faster execution
- ✅ Works if network connection lost
- ✅ Can verify files before running

**Disadvantages:**
- ⚠️ Uses local disk space
- ⚠️ Extra copy step

---

### Method 3: Remote Execution (Advanced)

**From management computer, deploy to multiple PCs:**

```powershell
# List of target PCs
$targetPCs = Get-Content ".\shopfloor-hostnames.txt" | Select-Object -First 5

# Your credentials
$cred = Get-Credential -Message "Enter domain admin credentials"

# Deploy to each PC
foreach ($hostname in $targetPCs) {
    Write-Host "Deploying to $hostname..." -ForegroundColor Yellow

    try {
        # Copy files to remote PC
        $remotePath = "\\$hostname\C$\Temp\WinRM-Setup"
        New-Item -Path $remotePath -ItemType Directory -Force
        Copy-Item "C:\Deployment\WinRM-HTTPS\*" -Destination $remotePath -Recurse

        # Execute remotely
        Invoke-Command -ComputerName $hostname -Credential $cred -ScriptBlock {
            Set-Location "C:\Temp\WinRM-Setup"

            # Run PowerShell script directly
            $certPath = "C:\Temp\WinRM-Setup\wildcard-logon-ds-ge-com-20251017.pfx"
            $certPass = ConvertTo-SecureString "XqHuyaLZSyCYEcpsMz6h5" -AsPlainText -Force

            & "C:\Temp\WinRM-Setup\Setup-WinRM-HTTPS.ps1" `
                -CertificatePath $certPath `
                -CertificatePassword $certPass `
                -Domain "logon.ds.ge.com"
        }

        Write-Host "[OK] $hostname - Deployment complete" -ForegroundColor Green
    }
    catch {
        Write-Host "[FAIL] $hostname - $($_.Exception.Message)" -ForegroundColor Red
    }
}
```

**Advantages:**
- ✅ Deploy to many PCs from one location
- ✅ No physical access needed
- ✅ Can run overnight/batch

**Disadvantages:**
- ⚠️ Requires existing remote access (WinRM or admin shares)
- ⚠️ More complex
- ⚠️ Password visible in script (use secure credential management)

---

### Method 4: Group Policy Startup Script

**For domain-joined computers:**

1. **Copy files to NETLOGON share:**
   ```
   \\DOMAIN\NETLOGON\Scripts\WinRM-HTTPS\
   ```

2. **Create GPO:**
   - Open Group Policy Management
   - Create new GPO: "Deploy WinRM HTTPS"
   - Edit GPO

3. **Add Startup Script:**
   - Computer Configuration → Policies → Windows Settings → Scripts
   - Startup → Add
   - Script: `\\DOMAIN\NETLOGON\Scripts\WinRM-HTTPS\Deploy-WinRM-HTTPS.bat`

4. **Link GPO to OU:**
   - Link to Shopfloor Computers OU
   - PCs will run script on next reboot

**Advantages:**
- ✅ Automated deployment
- ✅ Centrally managed
- ✅ Runs with SYSTEM privileges

**Disadvantages:**
- ⚠️ Requires domain environment
- ⚠️ Requires restart
- ⚠️ Password handling more complex

---

## Security Considerations

### Certificate Password

**Problem:** The batch file and scripts need the certificate password.

**Solutions:**

**Option 1: Interactive Prompt (Recommended for Manual)**
```batch
REM Batch file prompts user
Deploy-WinRM-HTTPS.bat
REM User types password when prompted
```

**Option 2: Encrypted File (Recommended for Automation)**
```powershell
# One-time setup: Store password encrypted
$certPass = Read-Host "Enter cert password" -AsSecureString
$certPass | Export-Clixml -Path "\\SERVER\WinRM-HTTPS\cert-password.xml"

# Modify Deploy-WinRM-HTTPS.bat to use:
# -CertificatePasswordFile ".\cert-password.xml"
```

**Option 3: Environment Variable (Less Secure)**
```batch
REM Set on each PC or via GPO
setx WINRM_CERT_PASS "XqHuyaLZSyCYEcpsMz6h5" /M
```

**⚠️ Never:**
- Hardcode password in batch file on network share (readable by everyone)
- Email password in plaintext
- Store password in unencrypted text file

### Share Permissions

**Recommended permissions:**

- **Read:** Authenticated Users or Shopfloor Computers group
- **Change/Full Control:** IT Admins only

```powershell
# Set proper permissions
Grant-SmbShareAccess -Name "WinRM-HTTPS" -AccountName "DOMAIN\Domain Computers" -AccessRight Read -Force
Grant-SmbShareAccess -Name "WinRM-HTTPS" -AccountName "DOMAIN\IT Admins" -AccessRight Full -Force
```

### Certificate Protection

The certificate PFX file contains the private key. Protect it:

1. **Use share permissions** to restrict access
2. **Use certificate password** (you did ✅)
3. **Monitor access** to the share
4. **Delete from share** after deployment complete

---

## Deployment Workflow

### Recommended Workflow

**Phase 1: Prepare (One Time)**
```
1. Create network share: \\SERVER\WinRM-HTTPS
2. Copy all deployment files
3. Test from one PC
4. Document password securely
```

**Phase 2: Test Deployment (3-5 PCs)**
```
For each test PC:
1. Navigate to \\SERVER\WinRM-HTTPS
2. Right-click Deploy-WinRM-HTTPS.bat → Run as Administrator
3. Enter password when prompted
4. Verify success
5. Test connection from management server
```

**Phase 3: Full Deployment (All 175 PCs)**
```
Option A: Manual
- Visit each PC or send instructions to users
- Run Deploy-WinRM-HTTPS.bat

Option B: Remote
- Use remote execution script
- Deploy in batches of 20

Option C: Automated
- Use GPO startup script
- Schedule during maintenance window
```

**Phase 4: Verification**
```
1. Run connection test:
   .\Invoke-RemoteAssetCollection-HTTPS.ps1 -TestConnections

2. Check logs for failures

3. Remediate failed PCs
```

**Phase 5: Cleanup**
```
1. Remove certificate from network share
2. Store password in secure vault
3. Document deployed PCs
4. Update asset inventory
```

---

## Example: Complete Deployment Session

### Step 1: Setup Share

```powershell
# On management server
$deployPath = "C:\Deployment\WinRM-HTTPS"
New-Item -Path $deployPath -ItemType Directory -Force

# Copy files
Copy-Item "C:\users\570005354\Downloads\winrm-https\*" -Destination $deployPath

# Share
New-SmbShare -Name "WinRM-HTTPS" -Path $deployPath -ReadAccess "Everyone"

Write-Host "Share created: \\$env:COMPUTERNAME\WinRM-HTTPS"
```

### Step 2: Test on One PC

**On test PC (G1JJVH63ESF):**
1. Open Explorer: `\\MANAGEMENT-SERVER\WinRM-HTTPS`
2. Right-click `Deploy-WinRM-HTTPS.bat` → Run as Administrator
3. Enter password: `XqHuyaLZSyCYEcpsMz6h5`
4. Wait for completion

### Step 3: Verify

**From management server:**
```powershell
# Test connection
Test-WSMan -ComputerName "G1JJVH63ESF.logon.ds.ge.com" -UseSSL -Port 5986

# If successful, create session
$cred = Get-Credential
$session = New-PSSession -ComputerName "G1JJVH63ESF.logon.ds.ge.com" `
    -UseSSL -Port 5986 -Credential $cred

# Test command
Invoke-Command -Session $session -ScriptBlock { $env:COMPUTERNAME }

# Cleanup
Remove-PSSession $session
```

### Step 4: Deploy to Next Batch

```powershell
# Deploy to next 5 PCs
$nextBatch = Get-Content ".\shopfloor-hostnames.txt" | Select-Object -Skip 1 -First 5

foreach ($hostname in $nextBatch) {
    Write-Host "`nDeploying to $hostname..." -ForegroundColor Cyan

    # Instructions for manual deployment
    Write-Host "1. RDP/physically access: $hostname" -ForegroundColor Yellow
    Write-Host "2. Open: \\MANAGEMENT-SERVER\WinRM-HTTPS" -ForegroundColor Yellow
    Write-Host "3. Run: Deploy-WinRM-HTTPS.bat (as Administrator)" -ForegroundColor Yellow
    Write-Host "4. Password: XqHuyaLZSyCYEcpsMz6h5" -ForegroundColor Yellow

    $continue = Read-Host "`nPress Enter when complete (or S to skip)"
    if ($continue -eq 'S') { continue }

    # Test after deployment
    try {
        Test-WSMan -ComputerName "$hostname.logon.ds.ge.com" -UseSSL -Port 5986 -ErrorAction Stop
        Write-Host "[OK] $hostname - WinRM HTTPS working" -ForegroundColor Green
    }
    catch {
        Write-Host "[FAIL] $hostname - Could not connect" -ForegroundColor Red
    }
}
```

---

## Troubleshooting Network Share Deployment

### Problem: "Cannot access network share"

**Check:**
```powershell
# Test connectivity
Test-NetConnection -ComputerName SERVER -Port 445

# Test share access
Test-Path "\\SERVER\WinRM-HTTPS"

# List shares
Get-SmbShare -CimSession SERVER

# Check permissions
Get-SmbShareAccess -Name "WinRM-HTTPS"
```

**Solution:**
- Verify share exists
- Check firewall (port 445)
- Verify user has Read access
- Try with UNC path: `\\SERVER.domain.com\WinRM-HTTPS`

---

### Problem: "Access Denied" running batch file

**Solution:**
- Right-click → Run as Administrator
- User must be local admin on PC
- Check UAC settings

---

### Problem: Certificate password prompt fails

**Solution:**
- Modify batch file to read from file
- Use encrypted credential file
- Or hardcode temporarily for testing (remove after)

---

## Creating README for Network Share

```text
# WinRM HTTPS Deployment

This folder contains files to deploy WinRM HTTPS to shopfloor PCs.

## Quick Start

1. Right-click Deploy-WinRM-HTTPS.bat
2. Select "Run as Administrator"
3. Enter certificate password when prompted
4. Wait for completion

## Password

Contact IT Support for the certificate password.

## Files

- Deploy-WinRM-HTTPS.bat - Main deployment script
- Setup-WinRM-HTTPS.ps1 - PowerShell setup script
- wildcard-*.pfx - Certificate (DO NOT DELETE)

## Support

For issues, contact: IT Support / Extension: XXXX
```

Save as `README.txt` in the share.

---

## Summary

**Best Practice for Your Scenario:**

1. ✅ Create network share: `\\SERVER\WinRM-HTTPS`
2. ✅ Include:
   - `Deploy-WinRM-HTTPS.bat`
   - `Setup-WinRM-HTTPS.ps1`
   - `wildcard-logon-ds-ge-com-20251017.pfx`
3. ✅ Deploy to 3-5 test PCs manually
4. ✅ Verify each deployment
5. ✅ Deploy to remaining PCs in batches
6. ✅ Remove certificate from share when done

**Certificate Password Storage:**
- Store in password manager
- Share only with authorized personnel
- Use encrypted files for automation

**The batch files handle:**
- ✅ Administrator check
- ✅ File verification
- ✅ Error handling
- ✅ User feedback