From a0aceb468006ff2099b1ffb45ae78ee518c2232f Mon Sep 17 00:00:00 2001 From: cproudlock Date: Thu, 6 Aug 2026 14:41:40 -0400 Subject: [PATCH] startnet: define the server address and share credentials once The PXE server address appeared 14 times and the share credentials 13, so moving the server or rotating the account meant editing every net use in the file and rebuilding boot.wim - with no way to tell from a diff whether one had been missed. Now set once at the top as PXESERVER / SHAREUSER / SHAREPASS. Exactly one literal address remains, the definition on line 6. Prose in REM comments is left alone so the paths stay readable. This also reaches the post-boot self-heal for free. startnet already writes C:\Enrollment\fetch-source.txt, and both Fetch-StagingPayload.ps1 and Verify-And-Heal-Staging.ps1 read it (line1=UNC, line2=user, line3=pass) with their own hardcoded values only as a fallback. Confirmed on 579C144: [13:30:35] [INFO] fetch-source.txt: UNC=\172.16.9.1\enrollment user=pxe-upload [13:30:36] [INFO] Mounting \172.16.9.1\enrollment as Z: (attempt 1/5)... so the seeded file wins and the heal follows PXESERVER automatically. My earlier claim that the heal scripts were hardcoded was wrong - they were already config-driven and startnet was already seeding them. The hardcoding was all in startnet itself. Verified: set on line 13, first use on line 20; parens balance; every goto resolves; 1005 CRLF lines with no bare LF; the deployed copy contains exactly one literal address. boot.wim md5 7a9b832b. --- playbook/startnet.cmd | 41 ++++++++++++++++++++++++++--------------- 1 file changed, 26 insertions(+), 15 deletions(-) diff --git a/playbook/startnet.cmd b/playbook/startnet.cmd index 1890f20..969ba10 100644 --- a/playbook/startnet.cmd +++ b/playbook/startnet.cmd @@ -3,10 +3,21 @@ echo Please wait while 'WinPE' is being processed. This may take a few seconds. wpeinit powercfg /s 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c +REM --- Site values ----------------------------------------------------- +REM The PXE server address and share credentials appeared 14 and 13 times +REM respectively, so moving this server or rotating the account meant editing +REM every net use in the file and rebuilding boot.wim. Set them once here. +REM These are also written to C:\Enrollment\fetch-source.txt, which +REM Fetch-StagingPayload.ps1 and Verify-And-Heal-Staging.ps1 read at first +REM logon - so the post-boot self-heal follows this value automatically. +set PXESERVER=172.16.9.1 +set SHAREUSER=pxe-upload +set SHAREPASS=pxe + REM --- Wait for network (DHCP may take a moment after wpeinit) --- echo Waiting for network... :wait_net -ping -n 2 172.16.9.1 >NUL 2>&1 +ping -n 2 %PXESERVER% >NUL 2>&1 if errorlevel 1 goto wait_net echo Network ready. @@ -17,7 +28,7 @@ REM CALLed scripts inside parens does not propagate BIOS_STATUS back to REM this script reliably. Use goto-flow instead so the CALL runs at the REM top scope and BIOS_STATUS persists. set BIOS_STATUS=No BIOS check (share unavailable) -net use B: \\172.16.9.1\winpeapps_bios /user:pxe-upload pxe /persistent:no 2>NUL +net use B: \\%PXESERVER%\winpeapps_bios /user:%SHAREUSER% %SHAREPASS% /persistent:no 2>NUL if not exist B:\check-bios.cmd goto :bios_check_done echo. echo Checking for BIOS updates... @@ -109,7 +120,7 @@ REM Data-driven PC-type menu: the PXE webapp maintains menu.json on the REM enrollment share; select-shopfloor-type.ps1 renders it and writes the REM chosen PCTYPE to X:\pctype.txt. Falls back to the baked-in menu below if REM the share or the picker is unavailable (mirrors the CMM bay picker). -net use Y: \\172.16.9.1\enrollment /user:pxe-upload pxe /persistent:no >NUL 2>NUL +net use Y: \\%PXESERVER%\enrollment /user:%SHAREUSER% %SHAREPASS% /persistent:no >NUL 2>NUL del X:\pctype.txt 2>NUL if exist "Y:\shopfloor-setup\select-shopfloor-type.ps1" powershell.exe -NoProfile -ExecutionPolicy Bypass -File "Y:\shopfloor-setup\select-shopfloor-type.ps1" -MenuJson "Y:\shopfloor-setup\menu.json" -OutFile "X:\pctype.txt" if exist X:\pctype.txt set /p PCTYPE=NUL 2>NUL +net use Y: \\%PXESERVER%\enrollment /user:%SHAREUSER% %SHAREPASS% /persistent:no >NUL 2>NUL del X:\cmm-bay.txt 2>NUL set CMMID= set CMMVARIANT=standard @@ -253,7 +264,7 @@ REM by filling in Office, Region, Expiry, Version on the target copy. REM The ACTIVE ppkg is read from \\172.16.9.1\enrollment\ppkg.conf, which the REM PXE webapp writes on upload - so a new ppkg goes live with no startnet edit. REM The baked-in values below are only a fallback if ppkg.conf is missing. -net use Y: \\172.16.9.1\enrollment /user:pxe-upload pxe /persistent:no >nul 2>&1 +net use Y: \\%PXESERVER%\enrollment /user:%SHAREUSER% %SHAREPASS% /persistent:no >nul 2>&1 set SOURCE_PPKG= set TARGET_PPKG= set PPKG_VER= @@ -339,7 +350,7 @@ echo. echo Loading Wax/Trace bay list from PXE share... REM Mount enrollment share early so the picker can read INDEX.csv. Later REM net use Y: will be a no-op if Y: is already mapped. -net use Y: \\172.16.9.1\enrollment /user:pxe-upload pxe /persistent:no >NUL 2>NUL +net use Y: \\%PXESERVER%\enrollment /user:%SHAREUSER% %SHAREPASS% /persistent:no >NUL 2>NUL del X:\waxtrace-asset.txt 2>NUL if not exist "Y:\installers-post\waxtrace\select-waxtrace-asset.ps1" goto waxtrace_picker_skip powershell.exe -NoProfile -ExecutionPolicy Bypass -File "Y:\installers-post\waxtrace\select-waxtrace-asset.ps1" -IndexPath "Y:\installers-post\waxtrace\bay-config.csv" -OutFile "X:\waxtrace-asset.txt" @@ -367,7 +378,7 @@ if not "%PPKG%"=="" set NEED_ENROLL=1 if not "%PCTYPE%"=="" set NEED_ENROLL=1 if "%NEED_ENROLL%"=="0" goto enroll_staged if exist Y:\ goto enroll_already_mapped -net use Y: \\172.16.9.1\enrollment /user:pxe-upload pxe /persistent:no +net use Y: \\%PXESERVER%\enrollment /user:%SHAREUSER% %SHAREPASS% /persistent:no :enroll_already_mapped if "%PPKG%"=="" goto enroll_staged if not exist "Y:\ppkgs\%SOURCE_PPKG%" ( @@ -389,7 +400,7 @@ echo. echo Starting GEA Standard setup... start "FlatApp" %SYSTEMDRIVE%\GESetup\FlatSetupLoader.exe for /l %%i in (1,1,2000000) do rem -net use Z: \\172.16.9.1\winpeapps\gea-standard /user:pxe-upload pxe /persistent:no +net use Z: \\%PXESERVER%\winpeapps\gea-standard /user:%SHAREUSER% %SHAREPASS% /persistent:no goto end :gea-engineer @@ -397,7 +408,7 @@ echo. echo Starting GEA Engineer setup... start "FlatApp" %SYSTEMDRIVE%\GESetup\FlatSetupLoader.exe for /l %%i in (1,1,2000000) do rem -net use Z: \\172.16.9.1\winpeapps\gea-engineer /user:pxe-upload pxe /persistent:no +net use Z: \\%PXESERVER%\winpeapps\gea-engineer /user:%SHAREUSER% %SHAREPASS% /persistent:no goto end :gea-shopfloor @@ -419,7 +430,7 @@ if "%PCTYPE%"=="" goto gea_shopfloor_media_shared REM Free Z: first. A leftover mapping makes net use fail with "device already REM in use" and the probe below would then pass against the OLD media. net use Z: /delete /y >NUL 2>&1 -net use Z: \\172.16.9.1\winpeapps\_media\%PCTYPE% /user:pxe-upload pxe /persistent:no >NUL 2>&1 +net use Z: \\%PXESERVER%\winpeapps\_media\%PCTYPE% /user:%SHAREUSER% %SHAREPASS% /persistent:no >NUL 2>&1 REM Probe a file that only resolves when the view exists AND its symlinks are REM intact. A dangling view must not image silently off a half-mapped drive. if exist "Z:\Deploy\Control\HardwareDriver.json" goto end @@ -432,7 +443,7 @@ echo. net use Z: /delete /y >NUL 2>&1 :gea_shopfloor_media_shared -net use Z: \\172.16.9.1\winpeapps\gea-shopfloor /user:pxe-upload pxe /persistent:no +net use Z: \\%PXESERVER%\winpeapps\gea-shopfloor /user:%SHAREUSER% %SHAREPASS% /persistent:no goto end :end @@ -640,9 +651,9 @@ REM Stage the staging self-heal directly too, so the unattend Order 5 heal step REM runs even if Fetch-StagingPayload itself did not land. Small, reliable copy. robocopy "Y:\shopfloor-setup" "%OSDRIVE%\Enrollment" "Verify-And-Heal-Staging.ps1" /R:1 /W:1 /NFL /NDL /NJH /NJS > %OSDRIVE%\Enrollment\fetch-source.txt ( -echo \\172.16.9.1\enrollment -echo pxe-upload -echo pxe +echo \\%PXESERVER%\enrollment +echo %SHAREUSER% +echo %SHAREPASS% ) REM --- Always copy Shopfloor baseline scripts --- mkdir %OSDRIVE%\Enrollment\shopfloor-setup 2>NUL @@ -955,7 +966,7 @@ for /f "skip=1 tokens=*" %%S in ('wmic bios get serialnumber 2^>NUL') do if not for /f "tokens=*" %%a in ("%SERIAL%") do set SERIAL=%%a if "%SERIAL%"=="" set SERIAL=unknown-serial -net use Y: \\172.16.9.1\enrollment /user:pxe-upload pxe /persistent:no >NUL 2>&1 +net use Y: \\%PXESERVER%\enrollment /user:%SHAREUSER% %SHAREPASS% /persistent:no >NUL 2>&1 if not exist "Y:\" goto harvest_done set LOGDEST=Y:\imaging-logs\%SERIAL% mkdir "Y:\imaging-logs" 2>NUL