54cbe6b5d6
Sixteen files that run on every shopfloor PC existed only on the SFLD share. The cost showed up while debugging the NTLARS backup: the script that posts to ShopDB could not be read, reviewed or diffed, so its behaviour was inferred from log output for most of a day. It turned out to hold a silent fallback that had been governing the whole fleet for months. Imported as-is from tsgwp00525-v2, no edits: lib/ShopdbBackupClient.psm1 the shared backup client scripts/Backup-NtlarsSettings.ps1 converted to use it scripts/Set-ShopdbCollectorKey.ps1 collector credential delivery scripts/Test-RegExport.ps1 exercises the .reg codec with mocks scripts/Set-EventSaver*.ps1 kiosk power / screensaver / disable scripts/Setup-OpenText.* OpenText install + toolbar scripts/Migrate-PCType.ps1, Select-KioskType.ps1, Set-FmsHostsEntry.ps1, scripts/ensure-vnc-firewall.ps1, Install-AcroReader.cmd, Install-Oracle11r2.cmd lib/Install-FromManifest.ps1 is also updated from the share, which was 37 lines AHEAD of this repo and purely additive: the Add-EnforceResult reporting added during the kiosk API cutover, done live and never committed back. Nothing was removed. Checked for embedded secrets before committing; there are none. Set-ShopdbCollectorKey deliberately reads its token from a sibling file on the share rather than holding it, so the script is safe to track. The share remains what actually runs. This makes it reviewable, and makes the next drift visible as a diff rather than a surprise.
38 lines
1.3 KiB
PowerShell
Executable File
38 lines
1.3 KiB
PowerShell
Executable File
# ensure-vnc-firewall.ps1
|
|
# Idempotent inbound firewall rules for VNC port 5900 on all network profiles.
|
|
# Called by Install-FromManifest with Type=PS1, DetectionMethod=Always (runs
|
|
# every enforcement cycle; the Remove + New pattern makes repeat runs cheap
|
|
# and always end in a known-good state).
|
|
#
|
|
# Exit 0 on success, 1 on failure. SYSTEM context.
|
|
|
|
$ErrorActionPreference = 'Continue'
|
|
|
|
$rules = @(
|
|
@{ Name = 'GE Shopfloor VNC 5900 TCP'; Protocol = 'TCP'; LocalPort = 5900 }
|
|
@{ Name = 'GE Shopfloor VNC 5900 UDP'; Protocol = 'UDP'; LocalPort = 5900 }
|
|
)
|
|
|
|
$failed = 0
|
|
foreach ($r in $rules) {
|
|
try {
|
|
Remove-NetFirewallRule -DisplayName $r.Name -ErrorAction SilentlyContinue
|
|
New-NetFirewallRule `
|
|
-DisplayName $r.Name `
|
|
-Direction Inbound `
|
|
-Protocol $r.Protocol `
|
|
-LocalPort $r.LocalPort `
|
|
-Action Allow `
|
|
-Profile Domain,Private,Public `
|
|
-Description 'VNC remote access for shopfloor ops (5900). Managed by GE Shopfloor Enforce.' `
|
|
-ErrorAction Stop | Out-Null
|
|
Write-Host "[OK] $($r.Name) ($($r.Protocol) $($r.LocalPort))"
|
|
} catch {
|
|
Write-Host "[FAIL] $($r.Name): $_"
|
|
$failed++
|
|
}
|
|
}
|
|
|
|
if ($failed -gt 0) { exit 1 }
|
|
exit 0
|