Collect what bays actually have, separately from what they are told to have
ShopDB knew what a bay SHOULD have and nothing about what it DOES. Adding the observed half makes a rollout a review instead of a typing exercise: the floor reports itself in, you look, and you adopt. The collection uses the mechanism that already exists rather than a new one. POST /api/collector/printers dispatches to the printers plugin's apply_collector_payload, the same ADR-006 hook the computers and backups plugins implement. New client script, new plugin-owned table, no new transport and no new credential. OBSERVED AND ASSIGNED STAY APART, and that is the point rather than a detail. A collector report can never write an assignment row: _reconcile_edges is the only function that writes usesprinter/defaultprinter, it has two call sites, and both are authenticated routes a human calls. If a drifted bay's own state were allowed to become what it is told to install, every configuration error would become permanent the next time that PC checked in. Seeding an assignment from observed state is explicit - POST /assignments/seed-from-observed - because a rollout adopts many machines at once. It routes through the same _reconcile_edges as the editor, so there is one write path with two doors, and a queue matching no known printer is REFUSED rather than guessed into an assignment. That last rule is the lesson from the measuring tools: adopting on a weak key produced 43 duplicate instruments. Two fixes on top of what the agents built. The replace deleted a host's previous rows by exact case-folded name while the read path treats a short name and its FQDN as one machine, so a PC that changed spelling appeared to hold every queue twice - which reads as drift that is not there. And the client sent 'reportedat' where the declared schema said 'observedat'. Also here: the legacy loader now imports machines.printerid, the classic system's record of each machine's default printer, which it silently dropped - the production import would have lost every one. And Set-ShopdbPrinters.ps1 finally registers the per-user logon task, staging Apply-ShopdbDefaultPrinter.ps1 to C:\ProgramData first because the share it lives on is mounted only during the enforcement cycle and the task runs at logon when it is gone. VALIDATED ON WINDOWS 11 (build 26200), not just on Linux pwsh, which parses these scripts happily and executes none of the spooler branches. The reporter: posts a correct payload with the X-API-Key header; resolves BaseUrl and CollectorKey from HKLM when given no arguments; suppresses the virtual queues by port; resolves port addresses; and reads the CONSOLE USER's default out of HKU rather than SYSTEM's own, which is a different and usually wrong answer. Two results matter more than the rest. With the spooler stopped, both the cmdlet and the CIM path fail and the script posts NOTHING - verified against a capture server that recorded zero requests, where an empty list would instead have erased that host's observed rows and read as a bay that lost its printers. A genuinely empty host still posts [], because that is a real and different fact. The logon task registers as the Users group at Limited, and falls back to the well-known SID S-1-5-32-545 when the group name will not resolve, as it will not on localised Windows. It was then run with the source directory RENAMED AWAY, to stand in for the share being unmounted, and it still moved the user's default - which is the whole reason the script is staged to C:\ProgramData rather than run from where it lives. The guarantees against damage were re-checked rather than assumed: an empty assignment changes nothing, an unreachable server changes nothing, -WhatIfOnly leaves no queue, no task, no staged file and no registry value behind, and a drifted queue is repointed IN PLACE with Set-Printer so whoever has it as their default keeps it. Not covered by any of this: the driver-staging path, which needs a real vendor package rather than the class drivers a VM ships with.
This commit is contained in:
cproudlock
@@ -24,6 +24,12 @@
|
||||
# logged-on person, so it records the desired default in HKLM and leaves applying
|
||||
# it to a logon task. Without that, SYSTEM would set a default nobody sees.
|
||||
#
|
||||
# IT ALSO REGISTERS THAT LOGON TASK, and stages a LOCAL copy of
|
||||
# Apply-ShopdbDefaultPrinter.ps1 for it to run. Recording a default that nothing
|
||||
# ever applies was the gap: the queues appeared, the default never moved. The
|
||||
# local copy is not tidiness - the share this script runs from is mounted only
|
||||
# for the enforcement cycle, and the task fires at logon when it is gone.
|
||||
#
|
||||
# Exits 0 always: a printer problem must not fail an enforcement run.
|
||||
|
||||
param(
|
||||
@@ -36,6 +42,26 @@ param(
|
||||
|
||||
[int]$TimeoutSec = 30,
|
||||
|
||||
# Where the per-user logon script is staged. Anywhere is fine as long as it
|
||||
# is on this PC and every user can read it.
|
||||
[string]$LocalScriptDir = (Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) 'ShopDB'),
|
||||
|
||||
[string]$LogonTaskName = 'ShopDB default printer',
|
||||
|
||||
# The task runs as a GROUP, not a person: a shared bay has no one owner and
|
||||
# the default must be applied for whoever logs on. If this name does not
|
||||
# resolve - it is localised on non-English Windows - the well-known SID is
|
||||
# tried instead.
|
||||
[string]$UsersGroup = 'BUILTIN\Users',
|
||||
|
||||
# 0 means at logon only. A shared bay where people pick their own default
|
||||
# can be pulled back on a repeat; a single-user PC should not be, so the
|
||||
# neutral default is the one that does not argue with the user.
|
||||
[int]$RepeatMinutes = 0,
|
||||
|
||||
# For a site that deploys the logon task by GPO instead.
|
||||
[switch]$NoLogonTask,
|
||||
|
||||
# Report what would change and touch nothing.
|
||||
[switch]$WhatIfOnly
|
||||
)
|
||||
@@ -53,6 +79,127 @@ function Log([string]$msg) {
|
||||
"$ts $msg" | Tee-Object -FilePath $logFile -Append | Out-Null
|
||||
}
|
||||
|
||||
# Resolved once, at script scope: $PSScriptRoot is empty when the file is piped
|
||||
# into powershell rather than run by path, and the logon script sits beside this
|
||||
# one.
|
||||
$SCRIPTDIR = $PSScriptRoot
|
||||
if (-not $SCRIPTDIR -and $MyInvocation.MyCommand.Path) {
|
||||
$SCRIPTDIR = Split-Path -Parent $MyInvocation.MyCommand.Path
|
||||
}
|
||||
|
||||
function Ensure-LogonTask {
|
||||
# Half of this feature is per-user state that SYSTEM cannot write. All SYSTEM
|
||||
# can do is arrange for something to run AS the user later, which is this
|
||||
# task. Nothing else registered it, so the default was recorded every cycle
|
||||
# and applied never.
|
||||
if ($NoLogonTask) {
|
||||
Log 'logon task: skipped (-NoLogonTask)'
|
||||
return
|
||||
}
|
||||
|
||||
$source = ''
|
||||
if ($SCRIPTDIR) { $source = Join-Path $SCRIPTDIR 'Apply-ShopdbDefaultPrinter.ps1' }
|
||||
if (-not $source -or -not (Test-Path $source)) {
|
||||
Log "SKIP logon task: Apply-ShopdbDefaultPrinter.ps1 is not beside this script"
|
||||
return
|
||||
}
|
||||
|
||||
# THE LOCAL COPY IS LOAD-BEARING. This script runs from a share that is
|
||||
# mounted only for the enforcement cycle; the task fires at logon, when the
|
||||
# share is gone. A task pointing at the share never runs and says nothing.
|
||||
$localscript = Join-Path $LocalScriptDir 'Apply-ShopdbDefaultPrinter.ps1'
|
||||
$refreshed = $false
|
||||
try {
|
||||
if (-not (Test-Path $LocalScriptDir)) {
|
||||
# Inherited ACL is what is wanted here: every user can read it, only
|
||||
# admins can write it, so the task cannot be pointed somewhere else.
|
||||
New-Item -ItemType Directory -Path $LocalScriptDir -Force -ErrorAction Stop | Out-Null
|
||||
}
|
||||
$stale = $true
|
||||
if (Test-Path $localscript) {
|
||||
$stale = (Get-FileHash -Path $localscript -Algorithm SHA256).Hash -ne
|
||||
(Get-FileHash -Path $source -Algorithm SHA256).Hash
|
||||
}
|
||||
if ($stale) {
|
||||
if ($WhatIfOnly) {
|
||||
Log "WOULD stage the logon script at $localscript"
|
||||
} else {
|
||||
Copy-Item -Path $source -Destination $localscript -Force -ErrorAction Stop
|
||||
$refreshed = $true
|
||||
Log "staged the logon script at $localscript"
|
||||
}
|
||||
}
|
||||
} catch {
|
||||
# No local copy means no task worth registering - a task pointing at a
|
||||
# file that is not there is worse than no task, because it looks fine.
|
||||
Log "ERROR staging ${localscript}: $($_.Exception.Message)"
|
||||
return
|
||||
}
|
||||
|
||||
$arguments = "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File `"$localscript`""
|
||||
|
||||
$task = Get-ScheduledTask -TaskName $LogonTaskName -ErrorAction SilentlyContinue
|
||||
if ($task -and -not $refreshed) {
|
||||
# Re-registering every cycle throws away the task's run history, which
|
||||
# is the only evidence it ever fired. So it is replaced only when it
|
||||
# points somewhere other than the local copy, or has no group principal
|
||||
# - a task left behind running as one person applies one person's
|
||||
# default. Matched on the PATH rather than the whole argument string
|
||||
# because Task Scheduler is free to normalise quoting, and an exact
|
||||
# compare would churn over a difference that changes nothing.
|
||||
$registered = @($task.Actions)[0]
|
||||
$pointslocal = $registered -and $registered.Arguments -and
|
||||
$registered.Arguments.IndexOf($localscript, [StringComparison]::OrdinalIgnoreCase) -ge 0
|
||||
if ($pointslocal -and $task.Principal.GroupId) {
|
||||
Log "logon task present: $LogonTaskName"
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
if ($WhatIfOnly) {
|
||||
Log "WOULD register the logon task: $LogonTaskName -> $localscript"
|
||||
return
|
||||
}
|
||||
|
||||
try {
|
||||
$triggers = @(New-ScheduledTaskTrigger -AtLogOn)
|
||||
if ($RepeatMinutes -gt 0) {
|
||||
$triggers += New-ScheduledTaskTrigger -Once -At (Get-Date) `
|
||||
-RepetitionInterval (New-TimeSpan -Minutes $RepeatMinutes)
|
||||
}
|
||||
$action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument $arguments
|
||||
$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries `
|
||||
-DontStopIfGoingOnBatteries -StartWhenAvailable
|
||||
} catch {
|
||||
# An SKU without the ScheduledTasks module is the likely reason. Nothing
|
||||
# to register with, and still not a reason to fail the run.
|
||||
Log "ERROR building the logon task: $($_.Exception.Message)"
|
||||
return
|
||||
}
|
||||
|
||||
# Limited, not Highest: setting your own default printer needs no elevation,
|
||||
# and a task the whole Users group can trigger should not have any.
|
||||
$candidates = @($UsersGroup)
|
||||
if ($UsersGroup -ne 'S-1-5-32-545') { $candidates += 'S-1-5-32-545' }
|
||||
|
||||
$lasterror = 'no principal accepted'
|
||||
foreach ($groupid in $candidates) {
|
||||
try {
|
||||
$principal = New-ScheduledTaskPrincipal -GroupId $groupid -RunLevel Limited -ErrorAction Stop
|
||||
Register-ScheduledTask -TaskName $LogonTaskName -Action $action -Trigger $triggers `
|
||||
-Principal $principal -Settings $settings -Force -ErrorAction Stop | Out-Null
|
||||
Log "registered the logon task: $LogonTaskName as $groupid"
|
||||
return
|
||||
} catch {
|
||||
$lasterror = $_.Exception.Message
|
||||
}
|
||||
}
|
||||
|
||||
# A missing logon task means the default is not applied. It does not mean the
|
||||
# queues are wrong, so it is logged and the run carries on.
|
||||
Log "ERROR registering ${LogonTaskName}: $lasterror"
|
||||
}
|
||||
|
||||
$REGPATH = 'HKLM:\SOFTWARE\GE\ShopDB'
|
||||
|
||||
if (-not $BaseUrl) {
|
||||
@@ -72,6 +219,11 @@ if (-not $BaseUrl) {
|
||||
|
||||
Log "=== Set printers for $Hostname ==="
|
||||
|
||||
# Before the API call on purpose: the task depends on files on this PC, not on
|
||||
# the server. A bad minute from the API must not leave a bay with no way to apply
|
||||
# the default it was already told about.
|
||||
Ensure-LogonTask
|
||||
|
||||
$url = $BaseUrl.TrimEnd('/') + '/api/printers/for-host/' + [uri]::EscapeDataString($Hostname)
|
||||
try {
|
||||
$response = Invoke-RestMethod -Uri $url -Method Get -TimeoutSec $TimeoutSec
|
||||
@@ -206,7 +358,8 @@ foreach ($printer in $wanted) {
|
||||
}
|
||||
|
||||
# The default is recorded, not applied: this process is SYSTEM and the setting
|
||||
# is per user. Apply-ShopdbDefaultPrinter.ps1 reads it at logon.
|
||||
# is per user. The logon task registered above runs
|
||||
# Apply-ShopdbDefaultPrinter.ps1, which reads this value in the user's context.
|
||||
if ($defaultname) {
|
||||
if ($WhatIfOnly) {
|
||||
Log "WOULD record default: $defaultname"
|
||||
|
||||
Reference in New Issue
Block a user