ge-aerospace/pxe-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Run-ShopfloorSetup: PPKG handoff + pre-PPKG network gate

Browse Source 
Block run-enrollment when this PC has no WiFi adapter and no default
route. PXE imaging LAN has no DHCP gateway, so towers without WiFi
get stuck in PPKG enrollment (AAD + Intune endpoints unreachable)
and require a re-image. Recurring failure mode observed 2026-05-05.
Tech-facing R/X retry+abort prompt walks them through plugging into
a corp wall jack.

Replace plain post-PPKG reboot with handoff to Monitor-IntuneProgress
-PostPpkg: cancel the pending shutdown timer, run a 180s settle so
MDM can push the baseline policy, render live status during settle,
then issue a clean reboot. The persistent @logon sync_intune task
resumes tracking on the next boot.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
cproudlock
2026-05-08 13:00:49 -04:00
parent 0e105fdbf2
commit 39f9945382
1 changed files with 69 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
playbook/shopfloor-setup/Run-ShopfloorSetup.ps1
View File

@@ -386,16 +386,81 @@ if (Test-Path -LiteralPath $registerMapShare) {
# an immediate reboot -- everything after this call is unlikely to execute.
# The sync_intune task is already registered above, so the PPKG reboot
# can kill us and the chain continues on the next boot.
# ---- Network-handoff gate (BEFORE PPKG) ----
# PXE imaging LAN has no DHCP gateway by design. Laptops with WiFi auto-
# connect to corp SSID and get a default route via WiFi - PPKG/AAD/Intune
# work fine. Towers without WiFi have ONLY the wired link to PXE LAN ->
# no default route -> AAD + Intune endpoints unreachable -> enrollment
# stalls -> re-image required (recurring failure mode observed
# 2026-05-05). Block run-enrollment until tech provides a usable internet
# path. Cheap to verify, prevents wasted imaging cycles.
$hasWifi = [bool](Get-NetAdapter -ErrorAction SilentlyContinue |
Where-Object { $_.PhysicalMediaType -eq 'Native 802.11' -or $_.MediaType -like '*802.11*' })
$hasDefaultRoute = [bool](Get-NetRoute -DestinationPrefix '0.0.0.0/0' -ErrorAction SilentlyContinue)
if (-not $hasWifi -and -not $hasDefaultRoute) {
Write-Host ""
Write-Host "================================================================" -ForegroundColor Red
Write-Host " STOP - NO USABLE INTERNET PATH" -ForegroundColor Red
Write-Host "================================================================" -ForegroundColor Red
Write-Host ""
Write-Host " This PC has no WiFi adapter and no default route." -ForegroundColor Yellow
Write-Host " Currently on the PXE imaging LAN, which has no gateway." -ForegroundColor Yellow
Write-Host " PPKG enrollment WILL fail because AAD + Intune endpoints" -ForegroundColor Yellow
Write-Host " are unreachable from this network." -ForegroundColor Yellow
Write-Host ""
Write-Host " FIX: Plug this PC into a corp wall jack now." -ForegroundColor Cyan
Write-Host ""
Write-Host " Verify with: ipconfig" -ForegroundColor Cyan
Write-Host " A non-blank Default Gateway must show on the wired NIC." -ForegroundColor Cyan
Write-Host ""
Write-Host " Press R to retry after moving the cable." -ForegroundColor Cyan
Write-Host " Press X to abort imaging (no enrollment runs)." -ForegroundColor Cyan
Write-Host ""
while ($true) {
try { $key = ([Console]::ReadKey($true).KeyChar.ToString()).ToUpper() }
catch { $key = (Read-Host 'Press R or X').Trim().ToUpper() }
if ($key -eq 'X') {
Write-Host "Aborted by tech. Imaging stopped before PPKG." -ForegroundColor Yellow
try { Stop-Transcript | Out-Null } catch {}
exit 1
}
if ($key -eq 'R') {
$hasDefaultRoute = [bool](Get-NetRoute -DestinationPrefix '0.0.0.0/0' -ErrorAction SilentlyContinue)
if ($hasDefaultRoute) {
Write-Host "Default route detected. Continuing to PPKG enrollment." -ForegroundColor Green
break
}
Write-Host "Still no default route. Verify cable + corp jack." -ForegroundColor Red
}
}
}
$enrollScript = Join-Path $enrollDir 'run-enrollment.ps1'
if (Test-Path -LiteralPath $enrollScript) {
Write-Host ""
Write-Host "=== Running enrollment (PPKG install) ==="
Write-Host "NOTE: PPKG will trigger an immediate reboot. This is expected."
Write-Host "NOTE: PPKG schedules a near-immediate reboot. We will cancel"
Write-Host " it and hand off to Monitor-IntuneProgress -PostPpkg, which"
Write-Host " runs a 180s settle (giving MDM time to push baseline"
Write-Host " policy) and then performs a clean reboot."
try { Stop-Transcript | Out-Null } catch {}
& $enrollScript
# If we get here, the PPKG didn't reboot (maybe no PPKG file found).
Write-Host "Enrollment returned without rebooting. Rebooting now..."
# PPKG completes -> we're back here with a pending shutdown timer.
# Hand off to Monitor in -PostPpkg mode. Monitor cancels the shutdown,
# settles, renders live status, then issues its own reboot. The
# persistent @logon sync_intune task fires on the next boot to resume
# tracking through device-category-assignment + lockdown.
Write-Host ""
Write-Host "=== Handing off to Monitor-IntuneProgress -PostPpkg ==="
cmd /c "shutdown /a 2>nul" | Out-Null
$monitor = Join-Path $setupDir 'Shopfloor\lib\Monitor-IntuneProgress.ps1'
if (Test-Path -LiteralPath $monitor) {
& powershell.exe -NoProfile -ExecutionPolicy Bypass -File $monitor -PostPpkg
} else {
Write-Warning "Monitor-IntuneProgress.ps1 not found at $monitor - falling back to plain reboot"
shutdown /r /t 10
}
} else {
Write-Host "run-enrollment.ps1 not found - skipping enrollment."
Write-Host ""