6f86c81a44
Zscaler: Install-Zscaler.ps1 ships in all three MCL packages with Zscaler-windows-4.7.0.317-installer-x64.msi bundled. It is tenant-aware (geaerospace.com for GCCH, geaerospaceglobal.com for RoW, gegovdev.us for QA) and passes enableFips=1. Our FirstLogonCommands entry installed 4.5.0.337, two minor versions older, without enableFips, and with userDomain hardcoded to geaerospace.com - wrong for a RoW bay, which startnet's tenant sub-menu can produce. Two msiexec runs against the same product at one logon also risk 1618. Removed, same reasoning as Office. THE BIGGER FIND, while removing it: this repo template was badly out of date with the share, and the playbook deploys it with force: yes. Missing here but present live: specialize Orders 39-48 - the bulk-enrollment orchestrator registration (Order 39, Register-BulkEnrollTask-Standard.ps1), the Default User startup-delay and Start-menu tweaks, the two NoAutoUpdate keys, the 'vanilla' Shift+F10 fallback alias, and the removable-media block that stops the PPKG being auto-detected at OOBE. Also missing: FirstLogonCommands Orders 4-10 (wuauserv disable, Default User hive edits, removable-media unblock). A playbook run would therefore have stripped enrollment from every gea-standard and gea-engineer bay. Both templates are now reconciled against the live share. Engineer gets its own template. The two files differ only by FirstLogonCommands Order 11, which installs the Engineering Layer - so deploying one shared file to both, as the playbook did, silently removed that entry from gea-engineer on every run. Split into FlatUnattendW10.xml and FlatUnattendW10-engineer.xml with an explicit per-type loop. lint-unattend.py passes clean on all three live files and all three repo copies.
19 KiB
19 KiB