Reorganize repo, enrollment share taxonomy, Blancco USB-build fixes, v4.10 PPKGs

Workstation reorganization:
- All build/deploy/helper scripts moved into scripts/ (paths updated to use
  REPO_ROOT instead of SCRIPT_DIR so they resolve sibling dirs from the new
  depth)
- New config/ directory placeholder for site-specific overrides
- Removed stale: mok-keys/, test-vm.sh, test-lab.sh, setup-guide-original.txt,
  unattend/ (duplicate of moved playbook/FlatUnattendW10.xml)
- README.md and SETUP.md structure listings updated, dead "Testing with KVM"
  section removed
- .claude/ gitignored

Enrollment share internal taxonomy (forward-looking; existing servers
unaffected since they keep their current boot.wim with flat paths):
- Single SMB share kept (WinPE only mounts one Y: drive), but content now
  organised into ppkgs/, scripts/, config/, shopfloor-setup/, pre-install/{bios,
  installers}, installers-post/cmm/, blancco/, logs/
- README.md deployed to share root explaining each subdir
- New playbook tasks deploy site-config.json + wait-for-internet.ps1 +
  migrate-to-wifi.ps1 explicitly (were ad-hoc on legacy servers)
- BIOS subdir moved into pre-install/bios/, preinstall/ renamed to pre-install/
- startnet.cmd + startnet-template.cmd updated with new Y:\subdir\ paths
- Bumped GCCH PPKG references v4.9 -> v4.10

Blancco USB-build fixes (so next fresh USB install boots Blancco end-to-end
without the manual fixup we did against GOLD):
- grub-blancco.cfg: kernel/initrd switched HTTP -> TFTP (GRUB's HTTP module
  times out on multi-MB files); added modprobe.blacklist=iwlwifi,iwlmvm,btusb
  (WiFi drivers hang udev on Intel business PCs)
- grubx64.efi rebuilt from updated cfg
- Playbook task added to create /srv/tftp/blancco/ symlinks pointing at the
  HTTP-served binaries

run-enrollment.ps1: OOBEComplete is now set AFTER PPKG install (Win11 22H2+
hangs indefinitely if OOBEComplete is set before the bulk-enrollment PPKG runs).

Also includes deploy-bios.sh / pull-bios.sh / busybox-static / models.txt
that were sitting untracked at the repo root.

playbook/FlatUnattendW10.xml

@@ -0,0 +1,222 @@
+<?xml version="1.0" encoding="utf-8"?>
+<unattend xmlns="urn:schemas-microsoft-com:unattend"
+          xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+
+  <!-- 1. windowsPE is intentionally empty -->
+  <settings pass="windowsPE" />
+
+  <!-- 2. Offline servicing (drivers) -->
+  <settings pass="offlineServicing">
+    <component name="Microsoft-Windows-PnpCustomizationsNonWinPE"
+               processorArchitecture="amd64"
+               publicKeyToken="31bf3856ad364e35"
+               language="neutral"
+               versionScope="nonSxS">
+      <DriverPaths>
+        <PathAndCredentials wcm:action="add" wcm:keyValue="1">
+          <Path>W:\Drivers</Path>
+        </PathAndCredentials>
+        <PathAndCredentials wcm:action="add" wcm:keyValue="2">
+          <Path>W:\Deploy\Applications\extra\printdrivers\BROTHER\UNIV-PS-01181\PS\64</Path>
+        </PathAndCredentials>
+        <PathAndCredentials wcm:action="add" wcm:keyValue="3">
+          <Path>W:\Deploy\Applications\extra\printdrivers\HP</Path>
+        </PathAndCredentials>
+        <PathAndCredentials wcm:action="add" wcm:keyValue="4">
+          <Path>W:\Deploy\Applications\extra\printdrivers\XEROX\UNIV_5.1035.2.0_PS_x64_Driver</Path>
+        </PathAndCredentials>
+      </DriverPaths>
+    </component>
+  </settings>
+
+  <!-- 3. specialize: computer naming + RunSynchronous all in ONE component -->
+  <settings pass="specialize">
+    <!-- 3a. Shell-Setup for naming/owner/org -->
+    <component name="Microsoft-Windows-Shell-Setup"
+               processorArchitecture="amd64"
+               publicKeyToken="31bf3856ad364e35"
+               language="neutral"
+               versionScope="nonSxS">
+      <ComputerName>H%serialnumber%</ComputerName>
+      <RegisteredOrganization>GE Aerospace</RegisteredOrganization>
+      <RegisteredOwner>GE</RegisteredOwner>
+      <TimeZone>Eastern Standard Time</TimeZone>
+    </component>
+
+    <!-- 3b. RunSynchronous for all of your installers, copies, etc. -->
+    <component name="Microsoft-Windows-Deployment"
+               processorArchitecture="amd64"
+               publicKeyToken="31bf3856ad364e35"
+               language="neutral"
+               versionScope="nonSxS">
+      <RunSynchronous>
+        <!-- EAP-PEAP MSI -->
+        <RunSynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Path>msiexec /i "C:\Deploy\Applications\extra\wireless\EAP-PEAP.msi" /quiet /norestart</Path>
+          <Description>Install EAP-PEAP</Description>
+        </RunSynchronousCommand>
+
+        <!-- Wi-Fi profiles -->
+        <RunSynchronousCommand wcm:action="add">
+          <Order>2</Order>
+          <Path>cmd /c netsh wlan add profile filename="C:\Deploy\Applications\extra\wireless\BLUESSO.xml" user=all</Path>
+          <Description>Add BLUESSO WiFi profile</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>3</Order>
+          <Path>cmd /c netsh wlan add profile filename="C:\Deploy\Applications\extra\wireless\WiFi-Profile.xml" user=all</Path>
+          <Description>Add generic WiFi profile</Description>
+        </RunSynchronousCommand>
+
+        <!-- Certificates -->
+        <RunSynchronousCommand wcm:action="add">
+          <Order>4</Order>
+          <Path>cmd /c certutil -addstore Root "C:\Deploy\Applications\GE_External_Root_CA_2_1.cer"</Path>
+          <Description>Install External Root Certificate</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>5</Order>
+          <Path>cmd /c certutil -addstore CA "C:\Deploy\Applications\GE_External_Intermediate_CA_2_1.cer"</Path>
+          <Description>Install External Intermediate Certificate</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>6</Order>
+          <Path>cmd /c certutil -addstore Root "C:\Deploy\Applications\GE_Enterprise_Root_CA_2_1.cer"</Path>
+          <Description>Install Enterprise Root Certificate</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>7</Order>
+          <Path>cmd /c certutil -addstore CA "C:\Deploy\Applications\GE_Enterprise_Device_Issuing_CA_2_1.cer"</Path>
+          <Description>Install Enterprise Device Issuing Certificate</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>8</Order>
+          <Path>cmd /c certutil -addstore CA "C:\Deploy\Applications\GE_Enterprise_Server_Issuing_CA_2_1.cer"</Path>
+          <Description>Install Enterprise Server Issuing Certificate</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>9</Order>
+          <Path>cmd /c certutil -addstore CA "C:\Deploy\Applications\GE_Enterprise_Smart_Card_Issuing_CA_2_1.cer"</Path>
+          <Description>Install SmartCard Issuing Certificate</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>10</Order>
+          <Path>cmd /c certutil -addstore CA "C:\Deploy\Applications\GE_Enterprise_User_Issuing_CA_2_1.cer"</Path>
+          <Description>Install User Issuing Certificate</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>11</Order>
+          <Path>cmd /c certutil -addstore Root "C:\Deploy\Applications\GE_Aerospace_Enterprise_Root_CA_1.cer"</Path>
+          <Description>Install Aerospace Enterprise Root CA</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>12</Order>
+          <Path>cmd /c certutil -addstore Root "C:\Deploy\Applications\ZscalerCommercialCertificate-2048-SHA256.crt"</Path>
+          <Description>Install Zscaler Certificate</Description>
+        </RunSynchronousCommand>
+
+        <!-- Fonts -->
+        <RunSynchronousCommand wcm:action="add">
+          <Order>13</Order>
+          <Path>cmd /c copy "C:\Deploy\Applications\extra\fonts\3OF9.TTF" "%WINDIR%\Fonts\" /Y</Path>
+          <Description>Copy 3OF9 Font</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>14</Order>
+          <Path>cmd /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "3 of 9 Barcode" /t REG_SZ /d "3OF9.TTF" /f</Path>
+          <Description>Register 3OF9 Barcode Font</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>15</Order>
+          <Path>cmd /c copy "C:\Deploy\Applications\extra\fonts\Code39AzaleaNarrow3.ttf" "%WINDIR%\Fonts\" /Y</Path>
+          <Description>Copy Code39 Azalea Narrow Font</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>16</Order>
+          <Path>cmd /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Code39AzaleaNarrow3" /t REG_SZ /d "Code39AzaleaNarrow3.ttf" /f</Path>
+          <Description>Register Code39 Azalea Narrow Font</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>17</Order>
+          <Path>cmd /c copy "C:\Deploy\Applications\extra\fonts\Code39Azalea.ttf" "%WINDIR%\Fonts\" /Y</Path>
+          <Description>Copy Code39 Azalea Font</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>18</Order>
+          <Path>cmd /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Code39Azalea" /t REG_SZ /d "Code39Azalea.ttf" /f</Path>
+          <Description>Register Code39 Azalea Font</Description>
+        </RunSynchronousCommand>
+
+        <!-- OpenText installers -->
+        <RunSynchronousCommand wcm:action="add">
+          <Order>19</Order>
+          <Path>C:\Deploy\Applications\extra\opentext\opentext_hostexplorer_sp1_15.0_v01.exe /quiet /norestart</Path>
+          <Description>Install OpenText HostExplorer SP1</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>20</Order>
+          <Path>C:\Deploy\Applications\extra\opentext\J2SE_Runtime_Environment_1.6.0_22_Static_Config_V2_Co-Exist.EXE /silent /norestart</Path>
+          <Description>Install J2SE Runtime Environment 1.6.0_22</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>21</Order>
+          <Path>C:\Deploy\Applications\extra\opentext\unattended.bat</Path>
+          <Description>Install J2SE Runtime Environment 1.6.0_22</Description>
+        </RunSynchronousCommand>
+
+        <!-- Adobe -->
+        <RunSynchronousCommand wcm:action="add">
+          <Order>22</Order>
+          <Path>msiexec /i "C:\Deploy\Applications\extra\adobe\AcroRead.msi" TRANSFORMS="C:\Deploy\Applications\extra\adobe\AcroRead.mst" /quiet /norestart</Path>
+          <Description>Install Adobe</Description>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>23</Order>
+          <Path>msiexec /p "C:\Deploy\Applications\extra\adobe\AcroRdrDCUpd2500120531.msp" /quiet /norestart</Path>
+          <Description>Apply Adobe Reader Update</Description>
+        </RunSynchronousCommand>         
+      </RunSynchronous>
+    </component>
+  </settings>
+
+  <!-- 4. oobeSystem: hide OEM/EULA screens -->
+  <settings pass="oobeSystem">
+    <component name="Microsoft-Windows-Shell-Setup"
+               processorArchitecture="amd64"
+               publicKeyToken="31bf3856ad364e35"
+               language="neutral"
+               versionScope="nonSxS">
+      <OOBE>
+        <HideEULAPage>true</HideEULAPage>
+        <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
+        <HideOnlineAccountScreens>false</HideOnlineAccountScreens>
+        <HideWirelessSetupInOOBE>false</HideWirelessSetupInOOBE>
+        <HideLocalAccountScreen>true</HideLocalAccountScreen>
+        <NetworkLocation>Work</NetworkLocation>
+        <ProtectYourPC>3</ProtectYourPC>
+        <SkipUserOOBE>false</SkipUserOOBE>
+        <SkipMachineOOBE>false</SkipMachineOOBE>
+      </OOBE>
+      <FirstLogonCommands>
+          <SynchronousCommand wcm:action="add">
+              <Order>1</Order>
+              <CommandLine>C:\Deploy\Applications\extra\zscaler\zscaler.bat</CommandLine>
+              <Description>Install Zscaler Client Connector</Description>
+          </SynchronousCommand>
+          <SynchronousCommand wcm:action="add">
+              <Order>2</Order>
+              <CommandLine>shutdown -a</CommandLine>
+              <Description>Cancel any scheduled shutdown from Office installation</Description>
+          </SynchronousCommand>
+          <SynchronousCommand wcm:action="add">
+              <Order>3</Order>
+              <CommandLine>cmd /c cd C:\Deploy\Applications\extra\office &amp;&amp; install.bat</CommandLine>
+              <Description>Install Office</Description>
+          </SynchronousCommand>
+      </FirstLogonCommands>
+    </component>
+  </settings>
+
+</unattend>

playbook/pxe_server_setup.yml

@@ -300,32 +300,72 @@
         state: directory
         mode: '0777'
 
-    - name: "Create enrollment packages directory"
+    - name: "Create enrollment share with internal taxonomy"
       file:
-        path: /srv/samba/enrollment
+        path: "/srv/samba/enrollment/{{ item }}"
         state: directory
         mode: '0777'
+      loop:
+        - ""
+        - ppkgs
+        - scripts
+        - config
+        - shopfloor-setup
+        - pre-install
+        - pre-install/bios
+        - pre-install/installers
+        - installers-post
+        - installers-post/cmm
+        - blancco
+        - logs
 
-    - name: "Deploy PPKG enrollment packages to enrollment share"
+    - name: "Deploy enrollment share README"
+      copy:
+        dest: /srv/samba/enrollment/README.md
+        mode: '0644'
+        content: |
+          # Enrollment Share Layout
+          Single SMB share mounted by WinPE as Y: during imaging. Subdir layout:
+          - ppkgs/             GCCH bulk-enrollment PPKGs
+          - scripts/           run-enrollment.ps1, wait-for-internet.ps1, migrate-to-wifi.ps1
+          - config/            site-config.json, FlatUnattendW10*.xml, per-site overrides
+          - shopfloor-setup/   Per-PC-type post-imaging scripts
+          - pre-install/       WinPE-phase content (bios/, installers/, preinstall.json)
+          - installers-post/   Post-OOBE app installers (cmm/PCDMIS, etc.)
+          - blancco/           Blancco custom images / configs
+          - logs/              Client log uploads
+
+    - name: "Deploy PPKG enrollment packages to ppkgs/"
       shell: |
         set +e
         # Copy any whole PPKGs (small enough to fit on FAT32)
-        cp -f {{ usb_root }}/enrollment/*.ppkg /srv/samba/enrollment/ 2>/dev/null
+        cp -f {{ usb_root }}/enrollment/*.ppkg /srv/samba/enrollment/ppkgs/ 2>/dev/null
         # Reassemble any split files (foo.ppkg.part.00, .01, ... -> foo.ppkg)
         for first in {{ usb_root }}/enrollment/*.part.00; do
           [ -e "$first" ] || continue
           base="${first%.part.00}"
           name="$(basename "$base")"
           echo "Reassembling $name from chunks..."
-          cat "${base}.part."* > "/srv/samba/enrollment/$name"
+          cat "${base}.part."* > "/srv/samba/enrollment/ppkgs/$name"
         done
-        ls -lh /srv/samba/enrollment/*.ppkg 2>/dev/null
+        ls -lh /srv/samba/enrollment/ppkgs/*.ppkg 2>/dev/null
       ignore_errors: yes
 
-    - name: "Deploy run-enrollment.ps1 to enrollment share"
+    - name: "Deploy enrollment scripts to scripts/"
       copy:
-        src: "{{ usb_mount }}/shopfloor-setup/run-enrollment.ps1"
-        dest: /srv/samba/enrollment/run-enrollment.ps1
+        src: "{{ item.src }}"
+        dest: "/srv/samba/enrollment/scripts/{{ item.dest }}"
+        mode: '0644'
+      loop:
+        - { src: "{{ usb_mount }}/shopfloor-setup/run-enrollment.ps1", dest: "run-enrollment.ps1" }
+        - { src: "{{ usb_mount }}/wait-for-internet.ps1",              dest: "wait-for-internet.ps1" }
+        - { src: "{{ usb_mount }}/migrate-to-wifi.ps1",                dest: "migrate-to-wifi.ps1" }
+      ignore_errors: yes
+
+    - name: "Deploy site-config.json to config/"
+      copy:
+        src: "{{ usb_mount }}/shopfloor-setup/site-config.json"
+        dest: /srv/samba/enrollment/config/site-config.json
         mode: '0644'
       ignore_errors: yes
 
@@ -363,43 +403,28 @@
         directory_mode: '0755'
       ignore_errors: yes
 
-    - name: "Create preinstall bundle directory on enrollment share"
-      file:
-        path: "{{ item }}"
-        state: directory
-        mode: '0755'
-      loop:
-        - /srv/samba/enrollment/preinstall
-        - /srv/samba/enrollment/preinstall/installers
-
-    - name: "Deploy preinstall.json (installer binaries staged separately)"
+    - name: "Deploy preinstall.json to pre-install/"
       copy:
         src: "{{ usb_mount }}/preinstall/preinstall.json"
-        dest: /srv/samba/enrollment/preinstall/preinstall.json
+        dest: /srv/samba/enrollment/pre-install/preinstall.json
         mode: '0644'
       ignore_errors: yes
 
-    - name: "Create BIOS update directory on enrollment share"
-      file:
-        path: /srv/samba/enrollment/BIOS
-        state: directory
-        mode: '0755'
-
-    - name: "Deploy BIOS check script and manifest"
+    - name: "Deploy BIOS check script and manifest to pre-install/bios/"
       copy:
         src: "{{ usb_mount }}/shopfloor-setup/BIOS/{{ item }}"
-        dest: /srv/samba/enrollment/BIOS/{{ item }}
+        dest: "/srv/samba/enrollment/pre-install/bios/{{ item }}"
         mode: '0644'
       loop:
         - check-bios.cmd
         - models.txt
       ignore_errors: yes
 
-    - name: "Deploy BIOS update binaries from USB"
+    - name: "Deploy BIOS update binaries from USB to pre-install/bios/"
       shell: >
         if [ -d "{{ usb_root }}/bios" ]; then
-          cp -f {{ usb_root }}/bios/*.exe /srv/samba/enrollment/BIOS/ 2>/dev/null || true
-          count=$(find /srv/samba/enrollment/BIOS -name '*.exe' | wc -l)
+          cp -f {{ usb_root }}/bios/*.exe /srv/samba/enrollment/pre-install/bios/ 2>/dev/null || true
+          count=$(find /srv/samba/enrollment/pre-install/bios -name '*.exe' | wc -l)
           echo "Deployed $count BIOS binaries"
         else
           echo "No bios/ on USB - skipping"
@@ -668,6 +693,29 @@
         remote_src: yes
         mode: '0644'
 
+    - name: "Create TFTP blancco directory"
+      file:
+        path: "{{ tftp_dir }}/blancco"
+        state: directory
+        owner: nobody
+        group: nogroup
+        mode: '0755'
+
+    - name: "Create TFTP symlinks for Blancco kernel/initrd (GRUB HTTP times out on large files; TFTP is reliable)"
+      file:
+        src: "{{ web_root }}/blancco/{{ item }}"
+        dest: "{{ tftp_dir }}/blancco/{{ item }}"
+        state: link
+        force: yes
+        owner: nobody
+        group: nogroup
+      loop:
+        - vmlinuz-bde-linux
+        - initramfs-bde-linux.img
+        - intel-ucode.img
+        - amd-ucode.img
+        - config.img
+
     - name: "Build Ubuntu kernel modules tarball for Blancco"
       shell: |
         set -e

playbook/shopfloor-setup/BIOS/models.txt

@@ -0,0 +1,47 @@
+# ModelSubstring|BIOSFile|Version
+13 Plus PB13250|Dell_Pro_PA13250_PA14250_PB13250_PB14250_PB16250_2.8.1.exe|2.8.1
+14 MC14250|Dell_Pro_Max_MC16250_MC14250_1.9.0.exe|1.9.0
+14 PC14250|Dell_Pro_PC14250_PC16250_1.7.0.exe|1.7.0
+14 Premium MA14250|Dell_Pro_Max_MA14250_MA16250_1.7.1.exe|1.7.1
+16 Plus MB16250|Dell_Pro_Max_MB16250_MB18250_2.2.2.exe|2.2.2
+24250|Dell_Pro_Plus_QB24250_QC24250_QC24251_1.9.2.exe|1.9.2
+5430|Latitude_5430_7330_Rugged_1.41.0.exe|1.41.0
+7090|OptiPlex_7090_1.40.0.exe|1.40.0
+7220 Rugged|Latitude_7220_Rugged_Extreme_Tablet_1.50.0.exe|1.50.0
+7230 Rugged Extreme Tablet|Latitude_7230_1.30.1.exe|1.30.1
+7320 2-in-1 Detachable|Dell_Latitude_7320_Detachable_1.45.0_64.exe|1.45.0
+7350 Detachable|Latitude_7350_Detachable_1.9.1.exe|1.9.1
+7400 AIO|Latitude_7X00_1.43.0.exe|1.43.0
+AIO Plus 7410|Latitude_7X10_1.43.0.exe|1.43.0
+AIO Plus 7420|Latitude_7X20_1.48.0.exe|1.48.0
+Latitude 5330|Latitude_5330_1.33.0.exe|1.33.0
+Latitude 5340|Latitude_5340_1.27.1.exe|1.27.1
+Latitude 5350|Latitude_5350_1.20.0.exe|1.20.0
+Latitude 5440|Latitude_5440_Precision_3480_1.28.1.exe|1.28.1
+Latitude 5450|Latitude_5450_Precision_3490_1.20.1.exe|1.20.1
+Latitude 5530|Precision_5530_1.42.0.exe|1.42.0
+Latitude 5540|Precision_5540_1.42.0.exe|1.42.0
+Latitude 7430|Latitude_7X30_1.38.0.exe|1.38.0
+Latitude 7440|Latitude_7X40_1.28.1.exe|1.28.1
+Latitude 7450|OptiPlex_7450_1.34.0.exe|1.34.0
+Micro 7010|OptiPlex_7010_1.33.0_SEMB.exe|1.33.0
+Micro QCM1250|Dell_Pro_QBT1250_QBS1250_QBM1250_QCT1250_QCS1250_QCM1250_SEMB_1.12.2.exe|1.12.2
+OptiPlex 3000|OptiPlex_3000_1.38.0.exe|1.38.0
+OptiPlex 7000|OptiPlex_7000_1.38.0.exe|1.38.0
+Precision 5490|OptiPlex_5490_AIO_1.45.0.exe|1.45.0
+Precision 5550|Precision_3590_3591_Latitude_5550_1.8.0.exe|1.8.0
+Precision 5570|XPS9520_Precision5570_1.39.0_QSL0.exe|1.39.0
+Precision 5680|Precision_5680_1_27_0.exe|1.27.0
+Precision 5690|Precision_5690_1.18.0.exe|1.18.0
+Precision 5820 Tower|Precision_5820_2.48.0.exe|2.48.0
+Precision 5860 Tower|Precision_5860_3.5.0.exe|3.5.0
+Precision 7560|Precision_7X60_1.44.1.exe|1.44.1
+Precision 7670|Precision_7X70_1.8.0.exe|1.8.0
+Precision 7680|Precision_7X80_1.9.0.exe|1.9.0
+Precision 7770|OptiPlex_7770_7470_1.40.0.exe|1.40.0
+Precision 7780|OptiPlex_7780_7480_1.43.0.exe|1.43.0
+Precision 7820 Tower|Precision_7820_7920_2.50.0.exe|2.50.0
+Precision 7865 Tower|Precision_7865_1.6.1.exe|1.6.1
+Precision 7875 Tower|Precision_7875_SHP_02.07.03.exe|2.7.3
+Rugged 14 RB14250|Dell_Pro_Rugged_RB14250_RA13250_1.13.1.exe|1.13.1
+Tower Plus 7020|OptiPlex_7020_1.22.1_SEMB.exe|1.22.1

playbook/shopfloor-setup/run-enrollment.ps1

@@ -33,30 +33,38 @@ $newName = "E$serial"
 Log "Setting computer name to $newName"
 Rename-Computer -NewName $newName -Force -ErrorAction SilentlyContinue
 
-# --- Set OOBE complete (must happen before PPKG reboot) ---
-Log "Setting OOBE as complete..."
-reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OOBE" /v OOBEComplete /t REG_DWORD /d 1 /f | Out-Null
-reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OOBE" /v SetupDisplayedEula /t REG_DWORD /d 1 /f | Out-Null
-
 # --- Install provisioning package ---
-# This triggers an IMMEDIATE reboot. Nothing below this line executes.
-# BPRT app installs (Chrome, Office, Tanium, etc.) happen on the next boot.
-# The sync_intune scheduled task (registered by Run-ShopfloorSetup.ps1
-# before calling us) fires at the next logon to monitor Intune enrollment.
+# IMPORTANT: The PPKG must be installed BEFORE OOBEComplete is set. Bulk
+# enrollment PPKGs are designed to run during OOBE; on Windows 11 22H2+ they
+# can hang indefinitely if OOBE is already marked complete.
+#
+# Install-ProvisioningPackage triggers an IMMEDIATE reboot. Nothing below
+# this line executes. BPRT app installs (Chrome, Office, Tanium, etc.) happen
+# on the next boot. The sync_intune scheduled task (registered by
+# Run-ShopfloorSetup.ps1 before calling us) fires at the next logon to
+# monitor Intune enrollment.
+$ppkgLogDir = "C:\Logs\PPKG"
+New-Item -ItemType Directory -Path $ppkgLogDir -Force -ErrorAction SilentlyContinue | Out-Null
 Log "Installing provisioning package (PPKG will reboot immediately)..."
+Log "PPKG diagnostic logs -> $ppkgLogDir"
 try {
-    Install-ProvisioningPackage -PackagePath $ppkgFile.FullName -ForceInstall -QuietInstall
+    Install-ProvisioningPackage -PackagePath $ppkgFile.FullName -ForceInstall -QuietInstall -LogsDirectoryPath $ppkgLogDir
     Log "Install-ProvisioningPackage returned (reboot may be imminent)."
 } catch {
     Log "ERROR: Install-ProvisioningPackage failed: $_"
     Log "Attempting fallback with Add-ProvisioningPackage..."
     try {
-        Add-ProvisioningPackage -PackagePath $ppkgFile.FullName -ForceInstall -QuietInstall
+        Add-ProvisioningPackage -PackagePath $ppkgFile.FullName -ForceInstall -QuietInstall -LogsDirectoryPath $ppkgLogDir
         Log "Add-ProvisioningPackage returned."
     } catch {
         Log "ERROR: Fallback also failed: $_"
     }
 }
 
+# --- Set OOBE complete (only reached if PPKG didn't trigger immediate reboot) ---
+Log "Setting OOBE as complete..."
+reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OOBE" /v OOBEComplete /t REG_DWORD /d 1 /f | Out-Null
+reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OOBE" /v SetupDisplayedEula /t REG_DWORD /d 1 /f | Out-Null
+
 # If we get here, the PPKG didn't reboot immediately. Unlikely but handle it.
 Log "PPKG did not trigger immediate reboot. Returning to caller."

playbook/startnet.cmd

@@ -66,11 +66,11 @@ echo   5. Pro Plus Office (x64) with Access
 echo   6. Skip enrollment
 echo.
 set /p enroll=Enter your choice (1-6):
-if "%enroll%"=="1" set PPKG=GCCH_Prod_SFLD_NoOffice_US_Exp_20260430_v4.8.ppkg
-if "%enroll%"=="2" set PPKG=GCCH_Prod_SFLD_StdOffice-x86_US_Exp_20260430_v4.8.ppkg
-if "%enroll%"=="3" set PPKG=GCCH_Prod_SFLD_StdOffice-x64_US_Exp_20260430_v4.8.ppkg
-if "%enroll%"=="4" set PPKG=GCCH_Prod_SFLD_ProPlusOffice-x86_US_Exp_20260430_v4.8.ppkg
-if "%enroll%"=="5" set PPKG=GCCH_Prod_SFLD_ProPlusOffice-x64_US_Exp_20260430_v4.8.ppkg
+if "%enroll%"=="1" set PPKG=GCCH_Prod_SFLD_NoOffice_US_Exp_20260430_v4.10.ppkg
+if "%enroll%"=="2" set PPKG=GCCH_Prod_SFLD_StdOffice-x86_US_Exp_20260430_v4.10.ppkg
+if "%enroll%"=="3" set PPKG=GCCH_Prod_SFLD_StdOffice-x64_US_Exp_20260430_v4.10.ppkg
+if "%enroll%"=="4" set PPKG=GCCH_Prod_SFLD_ProPlusOffice-x86_US_Exp_20260430_v4.10.ppkg
+if "%enroll%"=="5" set PPKG=GCCH_Prod_SFLD_ProPlusOffice-x64_US_Exp_20260430_v4.10.ppkg
 if "%enroll%"=="6" set PPKG=
 if "%enroll%"=="" goto enroll_menu
 
@@ -158,7 +158,7 @@ if not "%PCTYPE%"=="" set NEED_ENROLL=1
 if "%NEED_ENROLL%"=="0" goto enroll_staged
 net use Y: \\10.9.100.1\enrollment /user:pxe-upload pxe /persistent:no
 if "%PPKG%"=="" goto enroll_staged
-if not exist "Y:\%PPKG%" (
+if not exist "Y:\ppkgs\%PPKG%" (
     echo WARNING: %PPKG% not found on server. Enrollment will be skipped.
     set PPKG=
 )
@@ -251,8 +251,8 @@ echo Found Windows at W:
 mkdir W:\Enrollment 2>NUL
 
 REM --- Copy site config (drives site-specific values in all setup scripts) ---
-if exist "Y:\site-config.json" (
-    copy /Y "Y:\site-config.json" "W:\Enrollment\site-config.json"
+if exist "Y:\config\site-config.json" (
+    copy /Y "Y:\config\site-config.json" "W:\Enrollment\site-config.json"
     echo Copied site-config.json.
 ) else (
     echo WARNING: site-config.json not found on enrollment share.
@@ -260,14 +260,14 @@ if exist "Y:\site-config.json" (
 
 REM --- Copy PPKG if selected ---
 if "%PPKG%"=="" goto copy_pctype
-copy /Y "Y:\%PPKG%" "W:\Enrollment\%PPKG%"
+copy /Y "Y:\ppkgs\%PPKG%" "W:\Enrollment\%PPKG%"
 if errorlevel 1 (
     echo WARNING: Failed to copy enrollment package.
     goto copy_pctype
 )
-copy /Y "Y:\run-enrollment.ps1" "W:\Enrollment\run-enrollment.ps1"
-copy /Y "Y:\wait-for-internet.ps1" "W:\Enrollment\wait-for-internet.ps1"
-copy /Y "Y:\migrate-to-wifi.ps1" "W:\Enrollment\migrate-to-wifi.ps1"
+copy /Y "Y:\scripts\run-enrollment.ps1" "W:\Enrollment\run-enrollment.ps1"
+copy /Y "Y:\scripts\wait-for-internet.ps1" "W:\Enrollment\wait-for-internet.ps1"
+copy /Y "Y:\scripts\migrate-to-wifi.ps1" "W:\Enrollment\migrate-to-wifi.ps1"
 
 REM --- Create enroll.cmd at drive root as manual fallback ---
 > W:\enroll.cmd (
@@ -307,15 +307,15 @@ if exist "Y:\shopfloor-setup\%PCTYPE%" (
 )
 
 REM --- Stage preinstall bundle (apps installed locally to save Azure bandwidth) ---
-if exist "Y:\preinstall\preinstall.json" (
+if exist "Y:\pre-install\preinstall.json" (
     mkdir W:\PreInstall 2>NUL
     mkdir W:\PreInstall\installers 2>NUL
-    copy /Y "Y:\preinstall\preinstall.json" "W:\PreInstall\preinstall.json"
-    if exist "Y:\preinstall\installers" (
-        xcopy /E /Y /I "Y:\preinstall\installers" "W:\PreInstall\installers\"
+    copy /Y "Y:\pre-install\preinstall.json" "W:\PreInstall\preinstall.json"
+    if exist "Y:\pre-install\installers" (
+        xcopy /E /Y /I "Y:\pre-install\installers" "W:\PreInstall\installers\"
         echo Staged preinstall bundle to W:\PreInstall.
     ) else (
-        echo WARNING: Y:\preinstall\installers not found - preinstall.json staged without installers.
+        echo WARNING: Y:\pre-install\installers not found - preinstall.json staged without installers.
     )
 ) else (
     echo No preinstall bundle on PXE server - skipping.
@@ -329,9 +329,9 @@ REM during shopfloor-setup (Azure DSC provisions those creds later), so this
 REM bootstrap exists to get the first-install through. Post-imaging, the logon-
 REM triggered CMM-Enforce.ps1 takes over from the share.
 if /i not "%PCTYPE%"=="CMM" goto skip_cmm_stage
-if exist "Y:\cmm-installers\cmm-manifest.json" (
+if exist "Y:\installers-post\cmm\cmm-manifest.json" (
     mkdir W:\CMM-Install 2>NUL
-    xcopy /E /Y /I "Y:\cmm-installers" "W:\CMM-Install\"
+    xcopy /E /Y /I "Y:\installers-post\cmm" "W:\CMM-Install\"
     echo Staged CMM bootstrap to W:\CMM-Install.
 ) else (
     echo WARNING: Y:\cmm-installers not found - CMM PC cannot install Hexagon apps at imaging time.