737a729548
Run-ShopfloorSetup and Stage-Dispatcher top AutoLogonCount up to 10 so SupportUser survives vendor-forced reboots. Sysinternals Autologon, which lockdown uses to switch the bay to ShopFloor, leaves the counter in place, so ShopFloor inherited the remainder. Windows counts it down on every autologon and at 0 sets AutoAdminLogon=0: the bay boots to a ShopFloor password prompt a few reboots after imaging. Delete the counter once Winlogon shows ShopFloor: - Monitor-IntuneProgress.ps1, on the poll that sees the handover - SetShopfloorAutoLogon.bat, after sfld_autologon.ps1 - Force-Lockdown.bat, on success The SupportUser top-ups stay. Tested in the win11 VM: the Monitor block removes the counter for ShopFloor, keeps it for SupportUser, and is a no-op when clean; both batch files leave ShopFloor autologon on with no counter.
86 lines
2.9 KiB
Batchfile
86 lines
2.9 KiB
Batchfile
@echo off
|
|
REM Force-Lockdown.bat - Manual SFLD lockdown trigger for SupportUser.
|
|
REM
|
|
REM Vendor-documented escape hatch: if the Intune-pushed Lockdown
|
|
REM configuration hasn't actually applied within ~30 minutes after the
|
|
REM device was added to the Lockdown group, run sfld_autologon.ps1
|
|
REM directly as admin to force it.
|
|
REM
|
|
REM This wrapper exists so the tech doesn't have to remember the path
|
|
REM or open an elevated cmd by hand. It self-elevates to admin via UAC.
|
|
|
|
REM ---- Self-elevate ---------------------------------------------------
|
|
net session >nul 2>&1
|
|
if %errorLevel% neq 0 (
|
|
echo Requesting admin rights...
|
|
powershell -Command "Start-Process '%~f0' -Verb RunAs"
|
|
exit /b
|
|
)
|
|
|
|
setlocal
|
|
set "SCRIPT=C:\Program Files\Sysinternals\sfld_autologon.ps1"
|
|
|
|
echo ============================================================
|
|
echo Force SFLD Lockdown
|
|
echo ============================================================
|
|
echo.
|
|
echo *** WARNING ***
|
|
echo.
|
|
echo Do NOT run this script unless an ARTS request has already
|
|
echo been submitted and approved for this device.
|
|
echo.
|
|
echo Forcing lockdown without an ARTS request bypasses the
|
|
echo normal Intune Lockdown-group push and will be flagged
|
|
echo in the audit trail.
|
|
echo.
|
|
echo ============================================================
|
|
echo Target: %SCRIPT%
|
|
echo.
|
|
|
|
set /p CONFIRM=Type YES (uppercase) to confirm ARTS request is in place:
|
|
if /i not "%CONFIRM%"=="YES" (
|
|
echo.
|
|
echo Cancelled - no action taken.
|
|
echo.
|
|
pause
|
|
exit /b 2
|
|
)
|
|
echo.
|
|
|
|
if not exist "%SCRIPT%" (
|
|
echo ERROR: %SCRIPT% not found.
|
|
echo Sysinternals Autologon PPKG step may not have completed yet.
|
|
echo.
|
|
pause
|
|
exit /b 1
|
|
)
|
|
|
|
echo Running sfld_autologon.ps1 ...
|
|
echo.
|
|
PowerShell.exe -NoProfile -ExecutionPolicy Bypass -File "%SCRIPT%"
|
|
set RC=%errorLevel%
|
|
|
|
REM On success, write a marker that Monitor-IntuneProgress.ps1 (Phase 6 /
|
|
REM Get-LockdownState) recognizes as authoritative. Manual lockdown via
|
|
REM sfld_autologon.ps1 only flips Winlogon; the Intune Remediation log
|
|
REM never gets the "Autologon set for ShopFloor" line because Detection
|
|
REM now passes and Remediation never re-runs. The marker tells the monitor
|
|
REM to treat (Winlogon registry matches + marker present) as Complete.
|
|
if "%RC%"=="0" (
|
|
if not exist "C:\Enrollment" mkdir "C:\Enrollment"
|
|
> "C:\Enrollment\force-lockdown-applied.txt" echo %DATE% %TIME%
|
|
echo Marker written: C:\Enrollment\force-lockdown-applied.txt
|
|
REM Clear the imaging AutoLogonCount: Autologon leaves it in place and
|
|
REM ShopFloor autologon switches itself off when it counts down to 0.
|
|
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoLogonCount /f /reg:64 >nul 2>&1
|
|
echo Cleared leftover AutoLogonCount.
|
|
)
|
|
|
|
echo.
|
|
echo ============================================================
|
|
echo Lockdown script exit code: %RC%
|
|
echo ============================================================
|
|
echo.
|
|
pause
|
|
endlocal
|