S: drive mapping via HKLM\Run, autologon-count non-intervention, Phase 4 no-scripts handling

- Register-MapSfldShare.ps1: swap scheduled task for HKLM\Run entry. Task with -GroupId runs in session 0 with no HKCU, so /persistent:yes fails and the drive mapping isn't visible to Explorer. Run key fires at Explorer startup in the interactive user's session with full token + HKCU. Unregisters legacy 'GE Shopfloor Map S: Drive' task for PCs already imaged.
- Run-ShopfloorSetup.ps1: stop bumping AutoLogonCount (99 at start, 4 at end). Windows decrements per-logon and at 0 clears AutoAdminLogon + DefaultPassword, which nukes the lockdown-configured ShopFloor autologon. Re-enable-wired-NICs task now gates on Autologon_Remediation.log 'Autologon set for ShopFloor' instead of SFLD creds, so wired stays off through the whole Intune+DSC+lockdown chain.
- Monitor-IntuneProgress.ps1: Phase 4 treats 'no custom scripts' as COMPLETE when DSC install is done (was WAITING, which stalled the state machine on PC types without scripts). Push retrigger out to 15min when entering lockdown-wait so a stale 5min retrigger doesn't fire mid-Remediation. Removed the AutoLogonCount delete in Invoke-SetupComplete since we no longer set it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/Shopfloor/Register-MapSfldShare.ps1

@@ -1,12 +1,18 @@
-# Register-MapSfldShare.ps1 - Stage Map-SfldShare.ps1 + register a logon
-# task that maps S: for any user in BUILTIN\Users (SupportUser, ShopFloor,
-# any future end-user accounts).
+# Register-MapSfldShare.ps1 - Stage Map-SfldShare.ps1 + register an
+# HKLM\Run entry that maps S: for any interactive user (SupportUser,
+# ShopFloor, any future end-user accounts).
+#
+# Why HKLM\Run instead of a scheduled task: Run fires at Explorer
+# startup in the logged-in user's interactive session with their full
+# token + HKCU mounted. No principal/LogonType/group-SID plumbing, no
+# "task fires in session 0 but drive not visible to Explorer" class of
+# bugs. Works for every BUILTIN\Users member with no extra logic.
 #
 # Why not the vendor's ConsumeCredentials.ps1: it calls
-# New-StoredCredential -Persist LocalMachine (needs admin) before net use.
-# ShopFloor is non-admin, so the cred-store fails and net use has no auth.
-# Our Map-SfldShare.ps1 reads HKLM creds directly and passes them inline
-# to net use /user: -- no Credential Manager needed, works as Limited.
+# New-StoredCredential -Persist LocalMachine (needs admin) before net
+# use. ShopFloor is non-admin, so the cred-store fails and net use has
+# no auth. Our Map-SfldShare.ps1 reads HKLM creds directly and passes
+# them inline to net use /user: -- no Credential Manager needed.
 
 $ErrorActionPreference = 'Continue'
 
@@ -14,6 +20,10 @@ $installRoot = 'C:\Program Files\GE\SfldShare'
 $mapScript   = Join-Path $installRoot 'Map-SfldShare.ps1'
 $logDir      = 'C:\Logs\SFLD'
 $logFile     = Join-Path $logDir 'register-mapshare.log'
+$runKey      = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
+$runValue    = 'GE Map SFLD Share'
+$legacyTask  = 'GE Shopfloor Map S: Drive'
+
 if (-not (Test-Path $logDir)) { New-Item -Path $logDir -ItemType Directory -Force | Out-Null }
 
 function Write-RegLog {
@@ -38,39 +48,30 @@ if (Test-Path $src) {
     exit 1
 }
 
+# Remove the legacy scheduled task if it exists (left behind by older
+# imaging runs that used the scheduled-task approach).
+if (Get-ScheduledTask -TaskName $legacyTask -ErrorAction SilentlyContinue) {
+    try {
+        Unregister-ScheduledTask -TaskName $legacyTask -Confirm:$false -ErrorAction Stop
+        Write-RegLog "Removed legacy scheduled task '$legacyTask'"
+    } catch {
+        Write-RegLog "Failed to remove legacy task '$legacyTask': $_"
+    }
+}
+
+# Register HKLM\Run entry. Runs at Explorer startup for every
+# interactive user in that user's session.
 try {
-    $action = New-ScheduledTaskAction `
-        -Execute 'powershell.exe' `
-        -Argument "-NoProfile -ExecutionPolicy Bypass -File `"$mapScript`""
+    $command = '"{0}" -NoProfile -ExecutionPolicy Bypass -File "{1}"' -f `
+        "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe", $mapScript
 
-    $trigger = New-ScheduledTaskTrigger -AtLogOn
-
-    # BUILTIN\Users + Limited: any logged-in user triggers it; action
-    # runs in that user's session so net use lands the drive in the
-    # right place.
-    $principal = New-ScheduledTaskPrincipal -GroupId 'S-1-5-32-545' -RunLevel Limited
-
-    $settings = New-ScheduledTaskSettingsSet `
-        -AllowStartIfOnBatteries `
-        -DontStopIfGoingOnBatteries `
-        -StartWhenAvailable `
-        -ExecutionTimeLimit (New-TimeSpan -Minutes 5)
-
-    Write-RegLog "Registering 'GE Shopfloor Map S: Drive' (logon trigger, BUILTIN\Users -> $vendorScript)"
-
-    Register-ScheduledTask `
-        -TaskName  'GE Shopfloor Map S: Drive' `
-        -Action    $action `
-        -Trigger   $trigger `
-        -Principal $principal `
-        -Settings  $settings `
-        -Force `
-        -Description 'Map SFLD share drives on any user logon using HKLM creds (parallel to the principal-restricted vendor task) so ShopFloor and other end-user accounts get S: mapped' `
-        -ErrorAction Stop | Out-Null
-
-    Write-RegLog 'Scheduled task registered'
+    if (-not (Test-Path $runKey)) {
+        New-Item -Path $runKey -Force | Out-Null
+    }
+    New-ItemProperty -Path $runKey -Name $runValue -Value $command -PropertyType String -Force | Out-Null
+    Write-RegLog "Set $runKey\$runValue = $command"
 } catch {
-    Write-RegLog "FAILED to register task: $_"
+    Write-RegLog "FAILED to register Run key: $_"
     exit 1
 }