diff --git a/playbook/shopfloor-setup/Shopfloor/Force-Lockdown.bat b/playbook/shopfloor-setup/Shopfloor/Force-Lockdown.bat index a31fa29..ca03013 100644 --- a/playbook/shopfloor-setup/Shopfloor/Force-Lockdown.bat +++ b/playbook/shopfloor-setup/Shopfloor/Force-Lockdown.bat @@ -70,6 +70,10 @@ if "%RC%"=="0" ( if not exist "C:\Enrollment" mkdir "C:\Enrollment" > "C:\Enrollment\force-lockdown-applied.txt" echo %DATE% %TIME% echo Marker written: C:\Enrollment\force-lockdown-applied.txt + REM Clear the imaging AutoLogonCount: Autologon leaves it in place and + REM ShopFloor autologon switches itself off when it counts down to 0. + reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoLogonCount /f /reg:64 >nul 2>&1 + echo Cleared leftover AutoLogonCount. ) echo. diff --git a/playbook/shopfloor-setup/Shopfloor/SetShopfloorAutoLogon.bat b/playbook/shopfloor-setup/Shopfloor/SetShopfloorAutoLogon.bat index 2ea90af..3a32e1a 100755 --- a/playbook/shopfloor-setup/Shopfloor/SetShopfloorAutoLogon.bat +++ b/playbook/shopfloor-setup/Shopfloor/SetShopfloorAutoLogon.bat @@ -10,3 +10,8 @@ if %errorlevel% neq 0 ( "C:\Program Files\PowerShell\7\pwsh.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files\Sysinternals\sfld_autologon.ps1" + +REM 2) Clear any leftover imaging AutoLogonCount. Imaging tops it up for +REM SupportUser and Autologon leaves it in place, so ShopFloor autologon +REM would switch itself off again when it counts down to 0. +reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoLogonCount /f /reg:64 >nul 2>&1 diff --git a/playbook/shopfloor-setup/Shopfloor/lib/Monitor-IntuneProgress.ps1 b/playbook/shopfloor-setup/Shopfloor/lib/Monitor-IntuneProgress.ps1 index 4e34683..3bdb869 100644 --- a/playbook/shopfloor-setup/Shopfloor/lib/Monitor-IntuneProgress.ps1 +++ b/playbook/shopfloor-setup/Shopfloor/lib/Monitor-IntuneProgress.ps1 @@ -249,6 +249,27 @@ function Get-Phase1 { # the force-lockdown marker has been written by sfld_autologon.ps1. # When either signal is present, push idx=8 / status=succeeded so the # dashboard card flips to 100% green. + + # Lockdown handover also ends the imaging autologon budget. + # Run-ShopfloorSetup and Stage-Dispatcher top AutoLogonCount up to 10 for + # SupportUser, and the Sysinternals Autologon run that switches the bay to + # ShopFloor leaves it in place. ShopFloor then inherited the remainder and + # Windows turned autologon off when it reached 0 - the bay parked at a + # ShopFloor password prompt a few reboots after imaging. Delete it as soon + # as Winlogon shows ShopFloor. Proven in the win11 VM 2026-10-02. GE-Enforce + # common carries the same cleanup (Remove-AutoLogonCount.ps1) for bays + # imaged before this. + try { + $wlKey = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' + $wlNow = Get-ItemProperty $wlKey -ErrorAction Stop + if ($wlNow.DefaultUserName -like 'ShopFloor*' -and $null -ne $wlNow.AutoLogonCount) { + Remove-ItemProperty $wlKey -Name AutoLogonCount -ErrorAction Stop + Write-Host "Removed leftover AutoLogonCount ($($wlNow.AutoLogonCount)) after ShopFloor handover" + } + } catch { + Write-Warning "Could not clear AutoLogonCount: $_" + } + if (-not $script:cache.LockdownCompletePushed) { $lockdownApplied = $false try {