Stop installing Zscaler twice, and reconcile the unattends with the share
Zscaler: Install-Zscaler.ps1 ships in all three MCL packages with Zscaler-windows-4.7.0.317-installer-x64.msi bundled. It is tenant-aware (geaerospace.com for GCCH, geaerospaceglobal.com for RoW, gegovdev.us for QA) and passes enableFips=1. Our FirstLogonCommands entry installed 4.5.0.337, two minor versions older, without enableFips, and with userDomain hardcoded to geaerospace.com - wrong for a RoW bay, which startnet's tenant sub-menu can produce. Two msiexec runs against the same product at one logon also risk 1618. Removed, same reasoning as Office. THE BIGGER FIND, while removing it: this repo template was badly out of date with the share, and the playbook deploys it with force: yes. Missing here but present live: specialize Orders 39-48 - the bulk-enrollment orchestrator registration (Order 39, Register-BulkEnrollTask-Standard.ps1), the Default User startup-delay and Start-menu tweaks, the two NoAutoUpdate keys, the 'vanilla' Shift+F10 fallback alias, and the removable-media block that stops the PPKG being auto-detected at OOBE. Also missing: FirstLogonCommands Orders 4-10 (wuauserv disable, Default User hive edits, removable-media unblock). A playbook run would therefore have stripped enrollment from every gea-standard and gea-engineer bay. Both templates are now reconciled against the live share. Engineer gets its own template. The two files differ only by FirstLogonCommands Order 11, which installs the Engineering Layer - so deploying one shared file to both, as the playbook did, silently removed that entry from gea-engineer on every run. Split into FlatUnattendW10.xml and FlatUnattendW10-engineer.xml with an explicit per-type loop. lint-unattend.py passes clean on all three live files and all three repo copies.
This commit is contained in:
cproudlock
@@ -253,7 +253,58 @@
|
||||
<Path>cmd /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v EnableDynamicContentInWSB /t REG_DWORD /d 0 /f</Path>
|
||||
<Description>Disable Search Highlights</Description>
|
||||
</RunSynchronousCommand>
|
||||
</RunSynchronous>
|
||||
|
||||
<RunSynchronousCommand wcm:action="add">
|
||||
<Order>39</Order>
|
||||
<Path>powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Deploy\Applications\BPRT\Register-BulkEnrollTask-Standard.ps1"</Path>
|
||||
<Description>Add bulk enrollment orchestrator to Run key</Description>
|
||||
</RunSynchronousCommand>
|
||||
<RunSynchronousCommand wcm:action="add">
|
||||
<Order>40</Order>
|
||||
<Path>reg.exe load HKU\TempDefault C:\Users\Default\NTUSER.DAT</Path>
|
||||
<Description>Load Default User registry hive</Description>
|
||||
</RunSynchronousCommand>
|
||||
<RunSynchronousCommand wcm:action="add">
|
||||
<Order>41</Order>
|
||||
<Path>reg.exe add "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v StartupDelayInMSec /t REG_DWORD /d 0 /f</Path>
|
||||
<Description>Disable startup delay for all new users</Description>
|
||||
</RunSynchronousCommand>
|
||||
<RunSynchronousCommand wcm:action="add">
|
||||
<Order>42</Order>
|
||||
<Path>reg.exe add "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v WaitForIdleState /t REG_DWORD /d 0 /f</Path>
|
||||
<Description>Disable wait for idle state for all new users</Description>
|
||||
</RunSynchronousCommand>
|
||||
<RunSynchronousCommand wcm:action="add">
|
||||
<Order>43</Order>
|
||||
<Path>reg.exe add "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartShownOnUpgrade /t REG_DWORD /d 1 /f</Path>
|
||||
<Description>Prevent Start menu from opening on first login</Description>
|
||||
</RunSynchronousCommand>
|
||||
<RunSynchronousCommand wcm:action="add">
|
||||
<Order>44</Order>
|
||||
<Path>reg.exe unload HKU\TempDefault</Path>
|
||||
<Description>Unload Default User registry hive</Description>
|
||||
</RunSynchronousCommand>
|
||||
<RunSynchronousCommand wcm:action="add">
|
||||
<Order>45</Order>
|
||||
<Path>reg add HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /t REG_DWORD /d 1 /f</Path>
|
||||
<Description>Disable automatic Windows updates (NoAutoUpdate)</Description>
|
||||
</RunSynchronousCommand>
|
||||
<RunSynchronousCommand wcm:action="add">
|
||||
<Order>46</Order>
|
||||
<Path>reg add HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /t REG_DWORD /d 1 /f</Path>
|
||||
<Description>Disable automatic Windows updates (AUOptions)</Description>
|
||||
</RunSynchronousCommand>
|
||||
<RunSynchronousCommand wcm:action="add">
|
||||
<Order>47</Order>
|
||||
<Path>reg.exe add "HKLM\Software\Microsoft\Command Processor" /v AutoRun /t REG_SZ /d "doskey vanilla=powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Deploy\Applications\BPRT\Show-VanillaConfirmation.ps1" /f</Path>
|
||||
<Description>Define vanilla CMD alias for manual OOBE fallback via Shift+F10</Description>
|
||||
</RunSynchronousCommand>
|
||||
<RunSynchronousCommand wcm:action="add">
|
||||
<Order>48</Order>
|
||||
<Path>reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices" /v Deny_All /t REG_DWORD /d 1 /f</Path>
|
||||
<Description>Block all removable media reads to prevent PPKG auto-detection at OOBE</Description>
|
||||
</RunSynchronousCommand>
|
||||
</RunSynchronous>
|
||||
</component>
|
||||
</settings>
|
||||
|
||||
@@ -277,15 +328,45 @@
|
||||
</OOBE>
|
||||
<FirstLogonCommands>
|
||||
|
||||
<!-- Install Zscaler -->
|
||||
<SynchronousCommand wcm:action="add">
|
||||
<Order>2</Order>
|
||||
<CommandLine>C:\Deploy\Applications\extra\zscaler\zscaler.bat</CommandLine>
|
||||
<Description>Install Zscaler Client Connector</Description>
|
||||
</SynchronousCommand>
|
||||
|
||||
<!-- Install Microsoft Office -->
|
||||
</FirstLogonCommands>
|
||||
|
||||
<SynchronousCommand wcm:action="add">
|
||||
<CommandLine>cmd /c sc config wuauserv start= disabled</CommandLine>
|
||||
<Description>disable windows update</Description>
|
||||
<Order>4</Order>
|
||||
</SynchronousCommand>
|
||||
<SynchronousCommand wcm:action="add">
|
||||
<CommandLine>cmd /c sc stop wuauserv</CommandLine>
|
||||
<Description>disable windows update</Description>
|
||||
<Order>5</Order>
|
||||
</SynchronousCommand>
|
||||
<SynchronousCommand wcm:action="add">
|
||||
<CommandLine>reg.exe load HKU\TempDefault C:\Users\Default\NTUSER.DAT</CommandLine>
|
||||
<Description>Load Default User registry hive to reverse startup delay</Description>
|
||||
<Order>6</Order>
|
||||
</SynchronousCommand>
|
||||
<SynchronousCommand wcm:action="add">
|
||||
<CommandLine>reg.exe delete "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v StartupDelayInMSec /f</CommandLine>
|
||||
<Description>Remove startup delay override from Default User</Description>
|
||||
<Order>7</Order>
|
||||
</SynchronousCommand>
|
||||
<SynchronousCommand wcm:action="add">
|
||||
<CommandLine>reg.exe delete "HKU\TempDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v WaitForIdleState /f</CommandLine>
|
||||
<Description>Remove wait for idle state override from Default User</Description>
|
||||
<Order>8</Order>
|
||||
</SynchronousCommand>
|
||||
<SynchronousCommand wcm:action="add">
|
||||
<CommandLine>reg.exe unload HKU\TempDefault</CommandLine>
|
||||
<Description>Unload Default User registry hive</Description>
|
||||
<Order>9</Order>
|
||||
</SynchronousCommand>
|
||||
<SynchronousCommand wcm:action="add">
|
||||
<CommandLine>reg.exe delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices" /v Deny_All /f</CommandLine>
|
||||
<Description>Restore removable media access after OOBE PPKG block</Description>
|
||||
<Order>10</Order>
|
||||
</SynchronousCommand>
|
||||
</FirstLogonCommands>
|
||||
</component>
|
||||
</settings>
|
||||
|
||||
|
||||
Reference in New Issue
Block a user