S: drive mapping via HKLM\Run, autologon-count non-intervention, Phase 4 no-scripts handling

- Register-MapSfldShare.ps1: swap scheduled task for HKLM\Run entry. Task with -GroupId runs in session 0 with no HKCU, so /persistent:yes fails and the drive mapping isn't visible to Explorer. Run key fires at Explorer startup in the interactive user's session with full token + HKCU. Unregisters legacy 'GE Shopfloor Map S: Drive' task for PCs already imaged.
- Run-ShopfloorSetup.ps1: stop bumping AutoLogonCount (99 at start, 4 at end). Windows decrements per-logon and at 0 clears AutoAdminLogon + DefaultPassword, which nukes the lockdown-configured ShopFloor autologon. Re-enable-wired-NICs task now gates on Autologon_Remediation.log 'Autologon set for ShopFloor' instead of SFLD creds, so wired stays off through the whole Intune+DSC+lockdown chain.
- Monitor-IntuneProgress.ps1: Phase 4 treats 'no custom scripts' as COMPLETE when DSC install is done (was WAITING, which stalled the state machine on PC types without scripts). Push retrigger out to 15min when entering lockdown-wait so a stale 5min retrigger doesn't fire mid-Remediation. Removed the AutoLogonCount delete in Invoke-SetupComplete since we no longer set it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/Run-ShopfloorSetup.ps1

@@ -26,11 +26,11 @@ Write-Host "    Transcript: $transcriptPath"
 Write-Host "================================================================"
 Write-Host ""
 
-# Bump AutoLogonCount HIGH at the start so reboots during setup (e.g. VC++ 2008
-# triggering an immediate ExitWindowsEx) don't exhaust autologin attempts before
-# the dispatcher can complete. The end-of-script reset puts it back to 2 once
-# everything succeeds.
-reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoLogonCount /t REG_DWORD /d 99 /f | Out-Null
+# AutoLogonCount is NOT set here. Previously we bumped it to 99/4, but
+# Windows decrements it per-logon and at 0 clears AutoAdminLogon -- which
+# nukes the lockdown-configured ShopFloor autologon later in the chain.
+# The unattend XML's <AutoLogon><LogonCount> handles SupportUser logons;
+# the lockdown's Autologon.exe handles ShopFloor. We stay out of it.
 
 # Cancel any pending reboot so it doesn't interrupt setup
 cmd /c "shutdown /a 2>nul" *>$null
@@ -237,32 +237,28 @@ if (Test-Path -LiteralPath $monitorScript) {
 # Set auto-logon to expire after 4 more logins (2 needed for sync_intune
 # pre-reboot + post-reboot, plus 2 margin for unexpected reboots from
 # Windows Update, PPKG file operations, or script crashes).
-reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoLogonCount /t REG_DWORD /d 4 /f | Out-Null
-Write-Host "Auto-logon set to 4 remaining logins."
+# (AutoLogonCount intentionally not set -- see comment at top of script)
 
 # --- Register cross-PC-type enforcers (Acrobat, etc.) ---
 # These run on every logon regardless of PC type, mounting the SFLD share
 # for version-pinned app enforcement. Initial install already handled by
 # preinstall flow; enforcers only kick in when detection fails.
-# --- Re-enable wired NICs once SFLD creds arrive (Phase 5) ---
+# --- Re-enable wired NICs once lockdown completes (Phase 6) ---
 # migrate-to-wifi.ps1 disables wired NICs so the PPKG runs over WiFi.
-# After Phase 5 (SFLD creds populated), WiFi duty is done and the tech
-# needs wired back for production ethernet. Monitor-IntuneProgress runs
-# as Limited and can't call Enable-NetAdapter (needs admin). This SYSTEM
-# task fires at logon, waits for the SFLD cred marker, re-enables wired
-# NICs, and self-deletes. If creds haven't landed yet, the task exits
-# quickly and the repetition interval retries every 5 minutes.
+# Keep them disabled through the entire Intune sync + DSC + lockdown
+# chain so nothing interrupts the WiFi-based enrollment. Only re-enable
+# after lockdown lands (Autologon_Remediation.log confirms ShopFloor
+# autologon set). Monitor-IntuneProgress runs as Limited and can't call
+# Enable-NetAdapter (needs admin). This SYSTEM task fires at logon,
+# polls for lockdown completion, re-enables wired NICs, and self-deletes.
 $reEnableTask = 'GE Re-enable Wired NICs'
 try {
     $script = @'
-$credsBase = 'HKLM:\SOFTWARE\GE\SFLD\Credentials'
-if (-not (Test-Path $credsBase)) { exit 0 }
-$hasCreds = $false
-Get-ChildItem -Path $credsBase -ErrorAction SilentlyContinue | ForEach-Object {
-    $p = Get-ItemProperty -Path $_.PSPath -ErrorAction SilentlyContinue
-    if ($p -and $p.TargetHost -and $p.Username -and $p.Password) { $hasCreds = $true }
-}
-if (-not $hasCreds) { exit 0 }
+$imeLogs = 'C:\ProgramData\Microsoft\IntuneManagementExtension\Logs'
+$remLog  = Join-Path $imeLogs 'Autologon_Remediation.log'
+if (-not (Test-Path $remLog)) { exit 0 }
+$content = Get-Content $remLog -Raw -ErrorAction SilentlyContinue
+if ($content -notmatch 'Autologon set for ShopFloor') { exit 0 }
 Get-NetAdapter -Physical -ErrorAction SilentlyContinue |
     Where-Object { $_.InterfaceDescription -notmatch 'Wi-?Fi|Wireless|WLAN|802\.11' } |
     Enable-NetAdapter -Confirm:$false -ErrorAction SilentlyContinue