pxe-server/docs/shopfloor-machine-imaging-guide.md

Shopfloor Machine PC Imaging Guide

Step-by-step for imaging a new (or replacement) shopfloor PC that will sit at a CNC machine and run UDC, eDNC, NTLARS, MTConnect, and the standard shopfloor toolset.

Prerequisites

• PC connected to the PXE switch (not the production network yet)
• USB mouse + keyboard connected
• PXE server is running and reachable (verify by pinging 10.9.100.1 from another PC on the same switch)
• Target machine number known (e.g., 7605) — you can enter it at PXE time, or use 9999 as a placeholder if the PC will be configured at the bay later
• ARTS Lockdown request submitted for this PC (or know that you'll submit one mid-imaging)

---

Step 1: BIOS Configuration

1. Plug the PC into the KVM.
2. Power on the PC and begin tapping F12 to bring up the One-Time-Boot menu.
3. Select BIOS Setup.
4. Toggle Advanced Setup to ENABLED.
5. Click Boot Configuration:
   • Verify Enable Secure Boot is ENABLED
   • Verify Enable Microsoft UEFI CA is ENABLED
6. Click Storage and verify SATA/NVMe Operation is set to AHCI/NVMe.
7. If this is a Precision Tower: click Security and ENABLE "Start Data Wipe" (wipes existing data on next boot).
8. Click Apply Changes, then Exit.

---

Step 2: PXE Boot

1. Begin tapping F12 again to return to the One-Time-Boot menu.
2. Verify the network cable is connected to the PXE Server's isolated switch (NOT the production network).
3. From the One-Time-Boot menu, select ONBOARD NIC (IPV4).
4. Once the PXE Boot menu appears, select Windows PE (Image Deployment).
5. WinPE launches with a command prompt that automatically updates the BIOS to the latest version before prompting you to select the image type.

---

Step 3: Image + Enrollment Selection

1. WinPE Setup Menu: select 3. GEA Shopfloor.
2. GCCH Enrollment Profile: select 1. No Office (machine PCs don't need Office).
3. Shopfloor PC Type: select 6. Standard.
4. Standard PC Sub-Type: select 1. Machine.
5. Machine number prompt:
   • If the PC's target bay is known: type the machine number (e.g., 7605) and press Enter.
   • If the bay isn't known yet: just press Enter to use placeholder 9999. You'll set the real number after the PC is physically placed at the bay (see Step 9).

---

Step 4: Imaging (Automated Phase)

Once GE Image Setup launches:

1. Click Start.
2. The process runs unattended through:
   • Disk partition + Windows install
   • PreInstall apps (Oracle Client 11.2, OpenText HostExplorer, VC++ Redists, eDNC if Standard-Machine, UDC, etc.)
   • GE-Enforce framework registration
   • First reboot
3. Note the Serial Number from the screen — log it in your tracking sheet.
4. The PC reboots and auto-logs in as SupportUser. The "Shopfloor Intune Sync" PowerShell window opens automatically.

This whole phase takes ~20-40 minutes depending on hardware.

---

Step 5: Monitor Intune Enrollment

Once the Shopfloor Intune Sync window is open, you'll see a 5-phase status table that refreshes every 30 seconds:

  1. Intune Registration     [WAITING/IN PROGRESS/COMPLETE]
  2. Device Configuration    [WAITING/IN PROGRESS/COMPLETE]
  3. Software Deployment     [WAITING/IN PROGRESS/COMPLETE]
  4. Credential Setup        [WAITING/IN PROGRESS/COMPLETE]
  5. Lockdown                [WAITING/IN PROGRESS/COMPLETE]

Below the table, an Intune Device ID + QR code appears. Scan the QR with your phone to copy the device ID into your ARTS Lockdown request.

What to do at each phase

• Phase 1 → COMPLETE: a >> Select Device Category in Intune portal hint appears. Action: in Intune, set the Device Category to Shopfloor (or whatever your site uses).
• Phase 2 → COMPLETE: just keep watching.
• Phase 3 → IN PROGRESS forever: known issue — the DSC device-config.yaml download is currently failing with a 403. It does NOT block setup-complete — Phases 4 and 5 are independent. Skip ahead.
• Phase 4 → COMPLETE: SFLD share creds landed in registry. A >> Initiate ARTS Lockdown request hint appears if you haven't already.
• Phase 5 → COMPLETE: lockdown applied via Intune Remediation. The script auto-fires "Setup Complete" and reboots the PC.

If Phase 5 stays WAITING for >30 minutes after Phase 4 completes, see Step 6.

---

Step 6: Force Lockdown (only if needed)

If Phase 5 is stuck WAITING for 30+ minutes after Phase 4 completed AND the ARTS Lockdown request is approved:

1. Open an elevated cmd or PowerShell.
2. Run:

   C:\Enrollment\shopfloor-setup\Shopfloor\Force-Lockdown.bat
   

3. It self-elevates via UAC, prompts for confirmation:

   Type YES (uppercase) to confirm ARTS request is in place: YES
   

4. The script runs sfld_autologon.ps1, flips Winlogon to ShopFloor autologon, and writes C:\Enrollment\force-lockdown-applied.txt on success.
5. Within 30 seconds, the Intune Sync window's Phase 5 flips to COMPLETE → "Setup Complete" → reboot.

WARNING: Do NOT run Force-Lockdown without an approved ARTS request. It bypasses the normal Intune Lockdown-group push and will be flagged in the audit trail.

---

Step 7: Post-Reboot — ShopFloor Autologon Phase

After the lockdown reboot, the PC auto-logs in as ShopFloor (instead of SupportUser).

What happens automatically:

1. WiFi profile (AESFMA SSID) lands via Intune.
2. PC connects to AESFMA.
3. S: drive maps to \\tsgwp00525.wjs.geaerospace.net\shared.
4. GE Shopfloor Machine Apps Enforce scheduled task fires on logon.
5. Manifest engine reads \\tsgwp00525\...\common\manifest.json AND \\tsgwp00525\...\standard-machine\manifest.json, evaluates each app entry against current state, runs installer if not detected.
6. Apps installed/verified: Adobe Acrobat Reader DC, WJF Defect Tracker, 3OF9 barcode font, Edge IE-Mode site list + policy, VNC firewall rule, Oracle Client 11.2, OpenText HostExplorer ShopFloor, UDC, eDNC + NTLARS, eMxInfo.txt, MTConnect Fanuc/OKUMA/Makino/eDNC variants (per machine number).
7. May take 5-15 minutes on first logon (cold app installs); subsequent logons skip-and-validate in <30 seconds.

You can watch progress in C:\GE Aerospace\machineapps-enforce.log.

---

Step 8: Move to the Bay

Physically move the PC to its target machine. Plug into the production ethernet (NOT the PXE switch).

If the PC doesn't have an assigned machine number yet, or if you used 9999 placeholder at PXE time, continue to Step 9.

If you entered the real machine number at PXE time, Configure-PC.ps1 already wrote it to UDC, eDNC, the DNC registry, and MTConnect Devices.xml automatically — skip to Step 10.

---

Step 9: Set Machine Number (only if 9999 placeholder was used)

1. Log in as SupportUser (admin).
2. Run from Desktop or Start Menu:

   Set Machine Number.lnk
   

   (which calls C:\Enrollment\shopfloor-setup\Standard\Set-MachineNumber.ps1)
3. Type the new machine number (digits only) when the GUI prompts.
4. Click OK. The script:
   • Stops UDC, writes the new number to UDC settings JSON, relaunches UDC
   • Writes the new number to eDNC registry (HKLM:\SOFTWARE\WOW6432Node\GE Aircraft Engines\DNC\General\MachineNo)
   • Pulls the per-machine eDNC .reg backup from \\tsgwp00525\...\ntlars-backups\<num>.reg (restores eFocas/PPDCS/Hssb config for that machine)
   • Updates MTConnect Devices.xml for any installed agent (Fanuc/Okuma/Makino/eDNC) and restarts the agent service
5. A summary dialog confirms what was updated.

---

Step 10: Verify the Machine

Before signing off, confirm the PC is healthy:

# Service health
Get-Service | Where-Object { $_.Name -match '^(MTConnect|Makino|MakinoMTConnect|MTConnect eDNC|MTConnect Adapter|UDC|DNC)' } |
    Format-Table Name, Status, StartType -AutoSize

# Machine number persisted everywhere
"UDC: $((Get-Content 'C:\ProgramData\UDC\udc_settings.json' -Raw | ConvertFrom-Json).GeneralSettings.MachineNumber)"
"eDNC: $((Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\GE Aircraft Engines\DNC\General' -Name MachineNo).MachineNo)"

# MTConnect HTTP probe (depends on variant - port 5000 for Fanuc/OKUMA, 5001 for eDNC, 5005 for UDC)
Invoke-WebRequest 'http://localhost:5000/probe' -UseBasicParsing -TimeoutSec 3 | Select StatusCode

# Manifest engine ran cleanly
Get-Content 'C:\GE Aerospace\machineapps-enforce.log' -Tail 20

Expected healthy state:

• All MTConnect/UDC/DNC services: Running + Auto start type
• UDC + eDNC machine numbers: match the assigned bay
• HTTP probe: HTTP 200 with a <MTConnectDevices> XML response
• Manifest enforce log: ends with evaluation complete: N entries, 0 failures (or similar)

---

Troubleshooting

Intune Sync window closes by itself

It writes C:\Logs\SFLD\sync_intune_transcript.txt continuously. Open that log to see what it last reported. Re-launch via:

C:\Enrollment\shopfloor-setup\Shopfloor\sync_intune.bat

Phase 3 stuck at IN PROGRESS

Known issue — the DSC blob download is 403'ing right now. Doesn't block setup-complete. If you need DSC's wallpaper / start menu pins / FileSystem actions, escalate to IT to fix the SAS token or storage account firewall on geasfldwestjefferson. Until then, those visual customizations won't appear — operators won't notice if the start menu pins are absent because they're not the primary workflow.

Phase 5 (Lockdown) stays WAITING after 30 minutes

ARTS request is probably still pending. Confirm approval, then run Force-Lockdown.bat (Step 6).

Manifest engine logs show "DllNotFoundException" or "share not reachable"

PC isn't on AESFMA WiFi yet (or WiFi profile hasn't pushed). Wait 5-10 minutes after the post-lockdown reboot. Verify:

(Get-NetConnectionProfile).Name
Test-Path '\\tsgwp00525.wjs.geaerospace.net\shared\dt\shopfloor\common\manifest.json'

If Test-Path returns False, WiFi/auth isn't ready. If True, kick the manifest engine manually:

Start-ScheduledTask -TaskName 'GE Shopfloor Machine Apps Enforce'

MTConnect not running after machine-number set

The wrapper logs land at C:\GE Aerospace\mtc-install-runservice-batconvert.log. Common causes: pre-existing Windows Firewall Block rule (rare), Mark-of-the-Web on copied EXEs (the wrapper's Unblock-File sweep handles this), or the bundle isn't on the SFLD share for this variant. Open the log and grep for ERROR.

Configure-PC machine-number GUI doesn't open

The script needs a desktop session. Won't run via WinRM/SSH/non-interactive. Make sure you're logged in at the console as SupportUser.

---

Reference

• PXE server: 10.9.100.1
• SFLD share: \\tsgwp00525.wjs.geaerospace.net\shared\dt\shopfloor\
• Manifest engine log: C:\GE Aerospace\machineapps-enforce.log
• Intune sync transcript: C:\Logs\SFLD\sync_intune_transcript.txt
• DSC logs: C:\Logs\SFLD\ (DSCDeployment.log, DSCInstall.log, version.txt)
• Per-app install logs: C:\Logs\SFLD\Install-*.log
• Force-Lockdown marker: C:\Enrollment\force-lockdown-applied.txt
• Set-MachineNumber script: C:\Enrollment\shopfloor-setup\Standard\Set-MachineNumber.ps1