# Register-BulkEnrollTask-Standard.ps1 - register the BulkEnrollmentOrchestrator
# logon task for the gea-standard and gea-engineer images.
#
# WHY THIS IS A FILE AND NOT AN INLINE COMMAND
# This ran inline as "powershell.exe -Command ..." in the unattend's specialize
# pass at RunSynchronousCommand Order 39. RunSynchronousCommand/Path is capped at
# 259 characters by the unattend schema; the inline form was 604, so Windows
# Setup rejected the ENTIRE answer file:
#
#   /settings/RunSynchronous/RunSynchronousCommand/[Order="39"]/Path
#   Description = Value is invalid.   hrResult = 0x80220005   pass = specialize
#
# One over-length value invalidates every pass, so the machine stops at a dialog
# with nothing configured.
#
# WHY THERE ARE TWO OF THESE SCRIPTS
# gea-shopfloor uses Register-BulkEnrollTask.ps1, which launches the orchestrator
# as a PowerShell script with -ManualFallback: shopfloor bays are vanilla by
# design, so the orchestrator skips BPRT injection and the provisioning package.
# gea-standard and gea-engineer enrol normally and call the .cmd wrapper instead.
# All three image types share ONE Deploy\Applications\BPRT directory (a symlink
# to _shared\Applications\BPRT), so the two variants need distinct filenames.
#
# PESetup's CopyPackages copies the whole of <media>\Deploy\Applications to the
# target before the image is applied, so this script is present at
# C:\Deploy\Applications\BPRT\ by the time specialize runs. See
# docs/PESETUP-INTERNALS.md.

$ErrorActionPreference = 'Stop'

$taskName = 'BulkEnrollmentOrchestrator'
$orchestrator = 'C:\Deploy\Applications\BPRT\Start-BulkEnrollOrchestrator.cmd'

# Self-deleting task: schtasks /Delete drops the registration, then the
# orchestrator runs. cmd's & chains them so the delete happens even if the
# orchestrator later reboots the machine.
$argument = '/c schtasks /Delete /TN {0} /F & "{1}"' -f $taskName, $orchestrator

$action    = New-ScheduledTaskAction -Execute 'cmd.exe' -Argument $argument
$trigger   = New-ScheduledTaskTrigger -AtLogOn
# S-1-5-32-544 = BUILTIN\Administrators. GroupId + Highest so it runs elevated
# for whichever admin logs on first, without naming an account.
$principal = New-ScheduledTaskPrincipal -GroupId 'S-1-5-32-544' -RunLevel Highest
$settings  = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit (New-TimeSpan -Hours 3)

Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force

Write-Host "Registered scheduled task '$taskName'."