Generic build for other GE sites: no WJ data, one shopfloor type, Windows USB builder
Everything West Jefferson specific moved out to a separate repo (pxe-site-wj): NTLARS/UDC/heat-treat backups keyed by WJ machine numbers, CMM and Wax/Trace bay lists, WJ OpenText profiles, site-config.json, the WJ preinstall list, and the WJ shopfloor PC types (Collections, NoCollections, Common, Keyence, CMM, Genspect, HeatTreat, Wax/Trace, Display, PartMarker) with GE-Enforce, machine numbers and the desktop layout. The part-marker bench tools moved to their own repo. Dead scripts removed: build-proxmox-iso, deploy-bios, sync_hardware_models, mirror-from-gold, pull-bios, startnet-template.cmd. Shopfloor is one generic type, gea-shopfloor-standard, with today's timing: - PPKG at first logon (unattend Order 10, unchanged). - Install-AppList.ps1 runs C:\PreInstall\preinstall.json during setup. - A new SYSTEM task, GE Shopfloor Post-PPKG, runs postppkg.json once after the post-PPKG reboot. It also clears AutoLogonCount after the ShopFloor handover (the Users-level monitor can be denied that HKLM write) and removes the Intune Sync task when done. - Both lists ship empty. A site adds entries and installers. - WinPE choice 3 goes straight to the PPKG menu. Staging, fetch and heal carry only the generic payload. The webapp's shopfloor sub-menu editor is gone, and the imaging tiles name the new stages. - The playbook deploys the empty lists only if missing. It now deploys the PowerShell 7 MSI the shopfloor unattend installs, which it never did before. Blancco site settings move into the webapp (Updates > Blancco releases): business location, licensing Wi-Fi SSID and password. They are rendered into the served preferences.xml and applied to every staged release, and are seeded from site-vars (site_name, blancco_wifi_ssid, blancco_wifi_password) only while none exist. The repo XML carries no site values; the plaintext Wi-Fi password is gone from it. New site_name and site_timezone settings: report and evidence-pack site name, server clock and webapp time zone. No more West Jefferson defaults in webapp/config.py or the dashboard title. Sync-BPRT.ps1 gets the server address filled in at download instead of WJ's GE address. USB on Windows: - scripts/Build-PxeUsb.ps1 runs the same checks as build-usb.sh. It writes one FAT32 CIDATA partition (ISO files plus patched grub.cfg plus payload) with diskpart and reads every file back by SHA-256. - Tested with Windows PowerShell 5.1 in the win11 VM, and the layout installs and first-boots in the pxetest VM. - scripts/stage-usb-share.sh stages the build folder on a share. - site-content/ is optional for both builders. KB docs/kb/How_To_Deploy_PXE_Server_New_Site.html: new-site deployment, Windows only, with a site-vars.yml guide. Checks: webapp tests pass (5 suites); the unattend lint and playbook syntax checks pass; every .ps1 parses; there are no WJ hosts, IPs, names or PC types in playbook/, webapp/, scripts/ or autoinstall/.
This commit is contained in:
cproudlock
@@ -1,15 +1,18 @@
|
||||
# Run-ShopfloorSetup.ps1 - Main dispatcher for shopfloor PC type setup.
|
||||
# Run-ShopfloorSetup.ps1 - shopfloor setup (gea-shopfloor-standard).
|
||||
#
|
||||
# Called by the unattend FirstLogonCommands as SupportUser (admin), after
|
||||
# Order 10 has already applied the PPKG (run-enrollment.ps1).
|
||||
# Flow:
|
||||
# 1. PreInstall apps (Oracle, VC++, OpenText, UDC) -- from local bundle
|
||||
# 2. Type-specific scripts (eDNC, ACLs, CMM share apps, etc.)
|
||||
# 3. Deferred baseline (desktop org, taskbar pins)
|
||||
# 4. Copy desktop tools (sync_intune, Configure-PC, Set-MachineNumber)
|
||||
# 5. Run enrollment (PPKG install + wait for completion)
|
||||
# 6. Register sync_intune as @logon scheduled task
|
||||
# 7. Reboot -- PPKG file operations complete, sync_intune fires on next logon
|
||||
#
|
||||
# Called by the unattend FirstLogonCommands as SupportUser (admin).
|
||||
# 1. Site app list "during setup": C:\PreInstall\preinstall.json
|
||||
# (Shopfloor\Install-AppList.ps1; empty in the generic build)
|
||||
# 2. Copy desktop tools (sync_intune, Force-Lockdown, SetShopfloorAutoLogon)
|
||||
# 3. Register the "Shopfloor Intune Sync" logon task (Monitor-IntuneProgress:
|
||||
# waits for the PPKG/Intune lockdown, then hands the PC to ShopFloor)
|
||||
# 4. Register "GE Shopfloor Post-PPKG" (SYSTEM, at startup): installs
|
||||
# C:\PreInstall\postppkg.json once after the reboot (empty in the
|
||||
# generic build) and clears AutoLogonCount after the ShopFloor handover
|
||||
# 5. Network gate, run-enrollment (a no-op when Order 10 applied the PPKG),
|
||||
# then Monitor-IntuneProgress -PostPpkg: settle and reboot
|
||||
|
||||
# --- Transcript logging ---
|
||||
$logDir = 'C:\Logs\SFLD'
|
||||
@@ -147,149 +150,27 @@ if (-not $pcType) {
|
||||
exit 0
|
||||
}
|
||||
|
||||
$subtypeFile = Join-Path $enrollDir "pc-subtype.txt"
|
||||
$pcSubType = ''
|
||||
if (Test-Path $subtypeFile) {
|
||||
$pcSubType = (Get-Content $subtypeFile -First 1).Trim()
|
||||
}
|
||||
Write-Host "Shopfloor PC Type: $pcType"
|
||||
|
||||
Write-Host "Shopfloor PC Type: $pcType$(if ($pcSubType) { " / $pcSubType" })"
|
||||
|
||||
# Scripts to skip in the alphabetical baseline loop. Each is either run
|
||||
# explicitly in the finalization phase below, or invoked internally by
|
||||
# another script:
|
||||
#
|
||||
# 05 - Office shortcuts. Invoked by 06 as Phase 0. Office isn't installed
|
||||
# until after the PPKG + reboot, so 05 no-ops initially. 06's SYSTEM
|
||||
# logon task re-runs it on the next boot.
|
||||
# 06 - Desktop org. Phase 2 needs eDNC/NTLARS on disk (installed by
|
||||
# type-specific 01-eDNC.ps1). Run in finalization phase.
|
||||
# 07 - Taskbar pin layout. Reads 06's output. Run in finalization phase.
|
||||
# 08 - Edge default browser + startup tabs. Invoked by 06 as Phase 4.
|
||||
# Reads .url files delivered by DSC (after Intune enrollment). 06's
|
||||
# SYSTEM logon task re-runs it to pick them up.
|
||||
$skipInBaseline = @(
|
||||
'05-OfficeShortcuts.ps1',
|
||||
'06-OrganizeDesktop.ps1',
|
||||
'07-TaskbarLayout.ps1',
|
||||
'08-EdgeDefaultBrowser.ps1',
|
||||
# Machine number flow: split into two scripts registered as scheduled
|
||||
# tasks by Register-CheckMachineNumberTask.ps1. Prompt runs as the
|
||||
# logged-in user (GUI), Apply runs as SYSTEM (privileged writes).
|
||||
# Neither should run in baseline pass.
|
||||
'Prompt-MachineNumber.ps1',
|
||||
'Apply-MachineNumber.ps1',
|
||||
'Check-MachineNumber.ps1',
|
||||
'Configure-PC.ps1'
|
||||
)
|
||||
|
||||
# Scripts run AFTER type-specific scripts complete. 05 and 08 are NOT
|
||||
# here because 06 calls them internally as sub-phases.
|
||||
$runAfterTypeSpecific = @(
|
||||
'06-OrganizeDesktop.ps1',
|
||||
'07-TaskbarLayout.ps1'
|
||||
)
|
||||
|
||||
# --- Run Shopfloor baseline scripts first (skipping deferred ones) ---
|
||||
$baselineDir = Join-Path $setupDir "Shopfloor"
|
||||
if (Test-Path $baselineDir) {
|
||||
$scripts = Get-ChildItem -Path $baselineDir -Filter "*.ps1" -File | Sort-Object Name
|
||||
foreach ($script in $scripts) {
|
||||
if ($skipInBaseline -contains $script.Name) {
|
||||
Write-Host "Skipping baseline: $($script.Name) (runs in finalization phase)"
|
||||
continue
|
||||
}
|
||||
cmd /c "shutdown /a 2>nul" *>$null
|
||||
Write-Host "Running baseline: $($script.Name)"
|
||||
try {
|
||||
& $script.FullName
|
||||
} catch {
|
||||
Write-Warning "Baseline script $($script.Name) failed: $_"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# --- PCType dir alias resolution (2026-05-04 rename reorg) -------------
|
||||
# Fleet PCs may have pc-type.txt = legacy "Standard"/"CMM"/etc OR new
|
||||
# gea-shopfloor-* names. Repo dirs have been renamed to new names; this
|
||||
# helper resolves either form to the actual on-disk dir under $setupDir.
|
||||
$pcTypeDirAliases = @(
|
||||
@('Standard', 'gea-shopfloor-collections', 'gea-shopfloor-nocollections'),
|
||||
@('Standard-Machine', 'gea-shopfloor-collections', 'gea-shopfloor-nocollections'),
|
||||
@('Standard-Timeclock', 'gea-shopfloor-common'),
|
||||
@('CMM', 'gea-shopfloor-cmm'),
|
||||
@('Keyence', 'gea-shopfloor-keyence'),
|
||||
@('Lab', 'gea-shopfloor-common'),
|
||||
@('WaxAndTrace', 'gea-shopfloor-waxtrace'),
|
||||
@('Genspect', 'gea-shopfloor-genspect'),
|
||||
@('Display', 'gea-shopfloor-display'),
|
||||
@('Heattreat', 'gea-shopfloor-heattreat')
|
||||
)
|
||||
function Resolve-PCTypeDir {
|
||||
param([string]$BaseDir, [string]$Name)
|
||||
$primary = Join-Path $BaseDir $Name
|
||||
if (Test-Path $primary) { return $primary }
|
||||
foreach ($g in $pcTypeDirAliases) {
|
||||
if ($g -icontains $Name) {
|
||||
foreach ($alias in $g) {
|
||||
if ($alias -ieq $Name) { continue }
|
||||
$candidate = Join-Path $BaseDir $alias
|
||||
if (Test-Path $candidate) { return $candidate }
|
||||
}
|
||||
}
|
||||
}
|
||||
return $null
|
||||
}
|
||||
|
||||
# --- Run type-specific scripts (if not just baseline Shopfloor) ---
|
||||
if ($pcType -ne "Shopfloor") {
|
||||
$typeDir = Resolve-PCTypeDir -BaseDir $setupDir -Name $pcType
|
||||
if ($typeDir -and (Test-Path $typeDir)) {
|
||||
# Only run numbered scripts (01-eDNC.ps1, 02-MachineNumberACLs.ps1).
|
||||
# Unnumbered .ps1 files (Set-MachineNumber.ps1) are desktop tools,
|
||||
# not installer scripts, and must not auto-run during setup.
|
||||
$scripts = Get-ChildItem -Path $typeDir -Filter "*.ps1" -File |
|
||||
Where-Object { $_.Name -match '^\d' } |
|
||||
Sort-Object Name
|
||||
foreach ($script in $scripts) {
|
||||
cmd /c "shutdown /a 2>nul" *>$null
|
||||
Write-Host "Running $pcType setup: $($script.Name)"
|
||||
try {
|
||||
& $script.FullName
|
||||
} catch {
|
||||
Write-Warning "Script $($script.Name) failed: $_"
|
||||
}
|
||||
}
|
||||
} else {
|
||||
Write-Host "No type-specific scripts found for $pcType."
|
||||
}
|
||||
}
|
||||
|
||||
# --- Finalization: run deferred baseline scripts (desktop org, taskbar pins)
|
||||
# ---
|
||||
# These needed to wait until all apps (eDNC, NTLARS, UDC, OpenText) were
|
||||
# installed by the baseline + type-specific phases above. 06 internally
|
||||
# calls 05 (Office shortcuts) and 08 (Edge config) as sub-phases, so we
|
||||
# only need to invoke 06 and 07 explicitly here.
|
||||
foreach ($name in $runAfterTypeSpecific) {
|
||||
$script = Join-Path $baselineDir $name
|
||||
if (-not (Test-Path $script)) {
|
||||
Write-Warning "Deferred script not found: $script"
|
||||
continue
|
||||
}
|
||||
# --- 1. Site app list, during setup ---
|
||||
Report-Stage -Stage 'Run-ShopfloorSetup: installing the site app list' -Index 3
|
||||
$appList = Join-Path $setupDir 'Shopfloor\Install-AppList.ps1'
|
||||
if (Test-Path -LiteralPath $appList) {
|
||||
cmd /c "shutdown /a 2>nul" *>$null
|
||||
Write-Host "Running deferred baseline: $name"
|
||||
try {
|
||||
& $script
|
||||
& $appList -ListPath 'C:\PreInstall\preinstall.json' -Phase 'PreInstall'
|
||||
} catch {
|
||||
Write-Warning "Deferred script $name failed: $_"
|
||||
Write-Warning "Install-AppList failed: $_"
|
||||
}
|
||||
} else {
|
||||
Write-Warning "Install-AppList.ps1 not found at $appList"
|
||||
}
|
||||
|
||||
cmd /c "shutdown /a 2>nul" *>$null
|
||||
Report-Stage -Stage 'Run-ShopfloorSetup: site app list done' -Index 4
|
||||
Write-Host "Shopfloor setup complete for $pcType."
|
||||
|
||||
# --- Copy utility scripts to SupportUser desktop ---
|
||||
foreach ($tool in @('sync_intune.bat', 'Configure-PC.bat', 'Force-Lockdown.bat', 'SetShopfloorAutoLogon.bat')) {
|
||||
# --- 2. Copy utility scripts to SupportUser desktop ---
|
||||
foreach ($tool in @('sync_intune.bat', 'Force-Lockdown.bat', 'SetShopfloorAutoLogon.bat')) {
|
||||
$src = Join-Path $setupDir "Shopfloor\$tool"
|
||||
if (Test-Path $src) {
|
||||
Copy-Item -Path $src -Destination "C:\Users\SupportUser\Desktop\$tool" -Force
|
||||
@@ -297,28 +178,7 @@ foreach ($tool in @('sync_intune.bat', 'Configure-PC.bat', 'Force-Lockdown.bat',
|
||||
}
|
||||
}
|
||||
|
||||
# Machine-number-using PC types (collections + nocollections, plus their
|
||||
# legacy Standard-Machine alias) get the Set-MachineNumber helper on the
|
||||
# SupportUser desktop. Timeclock / Lab / common variants don't use a
|
||||
# machine number, so the helper has nothing to do there.
|
||||
$needsMachineNumberHelper = $false
|
||||
if ($pcType -ieq 'Standard' -and $pcSubType -ne 'Timeclock') { $needsMachineNumberHelper = $true }
|
||||
if ($pcType -ieq 'gea-shopfloor-collections' -or $pcType -ieq 'gea-shopfloor-nocollections') { $needsMachineNumberHelper = $true }
|
||||
if ($needsMachineNumberHelper) {
|
||||
$helperSrc = Resolve-PCTypeDir -BaseDir $setupDir -Name 'gea-shopfloor-collections'
|
||||
if (-not $helperSrc) { $helperSrc = Resolve-PCTypeDir -BaseDir $setupDir -Name 'Standard' }
|
||||
foreach ($helper in @('Set-MachineNumber.bat', 'Set-MachineNumber.ps1')) {
|
||||
if ($helperSrc) {
|
||||
$src = Join-Path $helperSrc $helper
|
||||
if (Test-Path $src) {
|
||||
Copy-Item -Path $src -Destination "C:\Users\SupportUser\Desktop\$helper" -Force
|
||||
Write-Host "$helper copied to SupportUser desktop."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# --- Register sync_intune as persistent @logon scheduled task ---
|
||||
# --- 3. Register sync_intune as persistent @logon scheduled task ---
|
||||
# Must be registered BEFORE enrollment because Install-ProvisioningPackage
|
||||
# triggers an immediate reboot that kills run-enrollment.ps1. The task
|
||||
# registration must survive the PPKG reboot, so we do it here while
|
||||
@@ -330,13 +190,12 @@ if ($needsMachineNumberHelper) {
|
||||
# PPKG reboot, and is irrelevant to the Intune lifecycle.
|
||||
$taskName = 'Shopfloor Intune Sync'
|
||||
$monitorScript = Join-Path $setupDir 'Shopfloor\lib\Monitor-IntuneProgress.ps1'
|
||||
$configureScript = Join-Path $setupDir 'Shopfloor\Configure-PC.ps1'
|
||||
|
||||
if (Test-Path -LiteralPath $monitorScript) {
|
||||
try {
|
||||
$action = New-ScheduledTaskAction `
|
||||
-Execute 'powershell.exe' `
|
||||
-Argument "-NoProfile -NoExit -ExecutionPolicy Bypass -File `"$monitorScript`" -AsTask -ConfigureScript `"$configureScript`""
|
||||
-Argument "-NoProfile -NoExit -ExecutionPolicy Bypass -File `"$monitorScript`" -AsTask"
|
||||
|
||||
$trigger = New-ScheduledTaskTrigger -AtLogOn
|
||||
|
||||
@@ -367,94 +226,13 @@ if (Test-Path -LiteralPath $monitorScript) {
|
||||
Write-Warning "Monitor-IntuneProgress.ps1 not found at $monitorScript"
|
||||
}
|
||||
|
||||
# Set auto-logon to expire after 4 more logins (2 needed for sync_intune
|
||||
# pre-reboot + post-reboot, plus 2 margin for unexpected reboots from
|
||||
# Windows Update, PPKG file operations, or script crashes).
|
||||
# (AutoLogonCount intentionally not set -- see comment at top of script)
|
||||
|
||||
# --- Register cross-PC-type enforcers (Acrobat, etc.) ---
|
||||
# These run on every logon regardless of PC type, mounting the SFLD share
|
||||
# for version-pinned app enforcement. Initial install already handled by
|
||||
# preinstall flow; enforcers only kick in when detection fails.
|
||||
# Wired-disable / re-enable dance retired after PXE LAN renumber to
|
||||
# 172.16.9.0/24. GE Report IP filters Get-NetIPAddress on StartsWith("10.")
|
||||
# so PXE LAN addresses are no longer caught - wired NIC can stay up
|
||||
# through the whole imaging chain without leaking to the GE webhook.
|
||||
|
||||
$commonSetupDir = Join-Path $setupDir 'common'
|
||||
|
||||
# --- Register the unified GE-Enforce scheduled task ---
|
||||
# Single dispatcher for all PC-type ongoing-update enforcement. Reads
|
||||
# per-pctype manifest.json from the tsgwp00525 share and processes
|
||||
# common + per-type + per-type-subtype manifests in order.
|
||||
#
|
||||
# Display PCs are excluded: their kiosk user cannot reach the SFLD
|
||||
# share, and everything Display needs (kiosk EXE + Edge policies) is
|
||||
# baked at imaging time (preinstall.json Install-KioskApp + 09-Setup-
|
||||
# Display.ps1). No ongoing share-dependent enforcement on Displays.
|
||||
$noEnforceTypes = @('Display', 'gea-shopfloor-display')
|
||||
$registerGE = Join-Path $commonSetupDir 'Register-GEEnforce.ps1'
|
||||
if ($noEnforceTypes -contains $pcType) {
|
||||
Write-Host ""
|
||||
Write-Host "=== Skipping GE-Enforce registration ($pcType is self-contained) ==="
|
||||
} elseif (Test-Path -LiteralPath $registerGE) {
|
||||
Write-Host ""
|
||||
Write-Host "=== Registering unified GE Shopfloor enforcer ==="
|
||||
try {
|
||||
$enforcerRuntime = Join-Path $commonSetupDir 'GE-Enforce.ps1'
|
||||
$libSource = Join-Path $commonSetupDir 'lib\Install-FromManifest.ps1'
|
||||
# Stage enforcer runtime so the scheduled task can reach it post-imaging.
|
||||
$runtimeDir = 'C:\Program Files\GE\Shopfloor'
|
||||
$runtimeLib = Join-Path $runtimeDir 'lib'
|
||||
foreach ($d in @($runtimeDir, $runtimeLib)) {
|
||||
if (-not (Test-Path $d)) { New-Item -Path $d -ItemType Directory -Force | Out-Null }
|
||||
}
|
||||
Copy-Item -LiteralPath $enforcerRuntime -Destination (Join-Path $runtimeDir 'GE-Enforce.ps1') -Force
|
||||
Copy-Item -LiteralPath $libSource -Destination (Join-Path $runtimeLib 'Install-FromManifest.ps1') -Force
|
||||
& $registerGE -EnforcerPath (Join-Path $runtimeDir 'GE-Enforce.ps1')
|
||||
} catch {
|
||||
Write-Warning "GE-Enforce registration failed: $_"
|
||||
}
|
||||
# --- 4. Post-PPKG app list + AutoLogonCount cleanup (SYSTEM task) ---
|
||||
# Registered before the PPKG step: the PPKG reboot can kill this script.
|
||||
$registerPost = Join-Path $setupDir 'Shopfloor\Register-PostPpkgTask.ps1'
|
||||
if (Test-Path -LiteralPath $registerPost) {
|
||||
try { & $registerPost } catch { Write-Warning "Post-PPKG task registration failed: $_" }
|
||||
} else {
|
||||
Write-Warning "Register-GEEnforce.ps1 not found - no ongoing enforcement will run on this PC"
|
||||
}
|
||||
|
||||
# Map S: drive on user logon for every account in BUILTIN\Users. The
|
||||
# vendor 'SFLD - Consume Credentials' task is principal-restricted and
|
||||
# does not fire for the ShopFloor end-user, so this parallel task fills
|
||||
# the gap. Cross-PC-type because every shopfloor account needs S:.
|
||||
# Display PCs skipped: kiosk user has no SFLD creds, S: map would fail
|
||||
# every logon. Self-contained Display has no share dependency.
|
||||
$registerMapShare = Join-Path $setupDir 'Shopfloor\Register-MapSfldShare.ps1'
|
||||
if ($noEnforceTypes -contains $pcType) {
|
||||
Write-Host ""
|
||||
Write-Host "=== Skipping S: drive logon mapper ($pcType is self-contained) ==="
|
||||
} elseif (Test-Path -LiteralPath $registerMapShare) {
|
||||
Write-Host ""
|
||||
Write-Host "=== Registering S: drive logon mapper ==="
|
||||
try { & $registerMapShare } catch { Write-Warning "Map-SfldShare registration failed: $_" }
|
||||
} else {
|
||||
Write-Host "Register-MapSfldShare.ps1 not found (optional) - skipping"
|
||||
}
|
||||
|
||||
# --- Check Machine Number logon prompt ---
|
||||
# Auto-register the "Check Machine Number" scheduled task. Bays imaged with
|
||||
# the 9999 placeholder will prompt the first ShopFloor end-user logon to
|
||||
# enter the real machine number; on success Update-MachineNumber.ps1 pulls
|
||||
# the per-machine NTLARS .reg + UDC settings JSON + UDC data backup from
|
||||
# SFLD and the task self-unregisters. Self-disables once the number is
|
||||
# real, so safe to always register here.
|
||||
# Skipped for self-contained types (Display) that have no machine number.
|
||||
$registerCheckMN = Join-Path $setupDir 'Shopfloor\Register-CheckMachineNumberTask.ps1'
|
||||
if ($noEnforceTypes -contains $pcType) {
|
||||
Write-Host ""
|
||||
Write-Host "=== Skipping Check Machine Number task ($pcType has no machine number) ==="
|
||||
} elseif (Test-Path -LiteralPath $registerCheckMN) {
|
||||
Write-Host ""
|
||||
Write-Host "=== Registering Check Machine Number logon task ==="
|
||||
try { & $registerCheckMN } catch { Write-Warning "Check-MachineNumber registration failed: $_" }
|
||||
} else {
|
||||
Write-Host "Register-CheckMachineNumberTask.ps1 not found (optional) - skipping"
|
||||
Write-Warning "Register-PostPpkgTask.ps1 not found at $registerPost"
|
||||
}
|
||||
|
||||
# --- Run enrollment (PPKG install) ---
|
||||
|
||||
Reference in New Issue
Block a user