8b144a17bb
- Settings > Endpoints > Enrollment. Migration tab: readiness counts and progress, each PC's state with the reasons it is blocked, "Upgrade selected" and "Upgrade next 25", and live wave progress. Credentials tab: enrolled PCs with revoke, pending requests with approve and reject, and the shared key and auto-enroll switches. Turning the shared key off asks for confirmation and shows how many PCs are not enrolled. - The server certificate page shows the SPKI pin to put in the GE-Enforce pin entry. - The agent upgrade script and the asset and printer reporters send the PC's credential when it has one (over https, only to the issuing server), fall back to the shared key, check server pins, and log refusals clearly. - New Set-ShopDBServerPins.ps1 (GE-Enforce entry) and Get-ShopDBServerPin.ps1. - AGENT-CONTRACT.md documents per-PC credentials; the rollout runbook covers phases, gates, rollback, pin and wave entries, and every place the shared key lives and how to clear it at cutover. - Removed the 09-14 certificate design notes and dated session reports, and two VM notes that carried a live collector key and advised plain http. - Corrected the GE-Enforce collector note, which claimed a plain registry token is protected by ACL.
591 lines
26 KiB
PowerShell
591 lines
26 KiB
PowerShell
# Report-AssetToShopDB.ps1
|
|
#
|
|
# Reports a PC's identity to ShopDB (Flask) so the computers/machines record
|
|
# stays current with whatever the PC actually is right now: hostname, BIOS
|
|
# serial, pc-type, logged-in user, DNC machine number (2001, 2002, ... when
|
|
# present) and its corp/AESFMA IPv4 address.
|
|
#
|
|
# TARGET: the ADR-006 collector API.
|
|
# POST <shopdb>/api/collector/computers
|
|
# The server is NOT baked in. It comes from HKLM:\SOFTWARE\GE\ShopDB BaseUrl,
|
|
# which Install-GEEnforce.ps1 provisions and the enforcement client already
|
|
# needs, or from -ApiUrl in the manifest entry's Args. ADR-015: a site name in
|
|
# product code is a defect, and this script ships to every site.
|
|
# The computers plugin's apply_collector_payload upserts idempotently by
|
|
# hostname (create if missing, patch-style update if present - only the fields
|
|
# posted here change, so it never clobbers model/VNC/WinRM). Machine number maps
|
|
# to Asset.assetnumber; the placeholder 9999 is skipped server-side.
|
|
#
|
|
# AUTH: the collector API does NOT honor the GE-Enforce IP allowlist (that only
|
|
# covers the geenforce fetch/report endpoints). Once the endpoint agent (1.20+)
|
|
# has enrolled this PC, its per-PC credential is read from the agent's
|
|
# SYSTEM-only credential.bin and sent as X-Endpoint-Credential; the server then
|
|
# refuses the shared key for this PC (401 SHARED_KEY_REFUSED). Before that, a
|
|
# collector.ingest key is sent as the X-API-Key header, read from
|
|
# HKLM:\SOFTWARE\GE\ShopDB CollectorKey (same secret store the GE-Enforce client
|
|
# uses; provisioned at imaging), or overridden via the manifest entry's Args
|
|
# -ApiKey. Never bake the key into the manifest JSON on the share.
|
|
#
|
|
# PINS: when HKLM:\SOFTWARE\GE\ShopDB ServerPins is set, the server's TLS key
|
|
# must match one of them or nothing is sent. See
|
|
# plugins/endpoints/docs/PER-PC-CREDENTIALS-ROLLOUT.md.
|
|
#
|
|
# Deployed in common\ (runs on EVERY shopfloor pc-type). Non-DNC bays report
|
|
# identity with no machineNo, so no PC-to-machine link is built - by design.
|
|
# Runs every GE-Enforce cycle as a Type=PS1 / DetectionMethod=Always entry under
|
|
# the SYSTEM task. Always exits 0 so "last run result" stays clean; failures are
|
|
# logged, never thrown.
|
|
#
|
|
# WHY ONE NIC ONLY:
|
|
# Some bays carry two NICs - a private controller NIC and the routable
|
|
# corporate NIC. This script reports ALL of them and lets the server decide
|
|
# which is the PC's address, from the collector_corporate_ranges setting.
|
|
# Choosing here was wrong: a bay cannot know a site's addressing, and a CMM
|
|
# whose 10Gbit controller link carries a default route reported the
|
|
# machine-side address as the PC's - with the corporate one never sent.
|
|
|
|
param(
|
|
# Flask collector endpoint for the computers plugin. Empty resolves from
|
|
# HKLM:\SOFTWARE\GE\ShopDB BaseUrl; override here if the path ever moves.
|
|
[string]$ApiUrl = '',
|
|
|
|
# Comma-separated CIDRs naming this site's routable ranges, e.g.
|
|
# '10.20.0.0/23,10.21.4.0/26'. Empty uses the default-route NIC instead.
|
|
[string]$AllowedRanges = '',
|
|
|
|
# collector.ingest key (X-API-Key). Default: read from the GE-Enforce secret
|
|
# store in the registry. Override with -ApiKey via Args for testing.
|
|
[string]$ApiKey = '',
|
|
|
|
[int]$TimeoutSec = 30
|
|
)
|
|
|
|
$ErrorActionPreference = 'Continue'
|
|
|
|
# Force TLS 1.2 - older images default to SystemDefault which may negotiate a
|
|
# protocol the site rejects; the collector POST is HTTPS.
|
|
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
|
|
|
$logDir = 'C:\Logs\Shopfloor'
|
|
if (-not (Test-Path $logDir)) {
|
|
New-Item -ItemType Directory -Path $logDir -Force -ErrorAction SilentlyContinue | Out-Null
|
|
}
|
|
$logFile = Join-Path $logDir ('report-asset-{0}.log' -f (Get-Date -Format 'yyyyMMdd'))
|
|
|
|
function Log([string]$msg) {
|
|
$ts = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
|
|
"$ts $msg" | Tee-Object -FilePath $logFile -Append | Out-Null
|
|
}
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Per-PC credential and server pin. Kept in step with the same block in
|
|
# Report-AssetToShopDB.ps1, Report-PrintersToShopDB.ps1 and
|
|
# upgrade-shopdbagent.ps1: each runs standalone, so the text is duplicated.
|
|
#
|
|
# Credential: the endpoint agent (1.20+) enrolls and stores its own credential
|
|
# in credential.bin, DPAPI LocalMachine, readable only by SYSTEM and
|
|
# Administrators. When present it is sent as X-Endpoint-Credential and the
|
|
# shared key is not sent. Without it the shared CollectorKey goes as X-API-Key.
|
|
#
|
|
# Pins: HKLM\SOFTWARE\GE\ShopDB ServerPins (REG_MULTI_SZ), lowercase hex
|
|
# SHA-256 of the server leaf certificate's SubjectPublicKeyInfo. When any pin
|
|
# is set the TLS handshake is accepted only if the leaf key matches one.
|
|
# ---------------------------------------------------------------------------
|
|
|
|
$ShopDbCredentialFile = Join-Path $env:ProgramData 'ShopDB\EndpointAgent\credential\credential.bin'
|
|
|
|
$ShopDbPinSource = @'
|
|
using System;
|
|
using System.Collections.Generic;
|
|
using System.Net;
|
|
using System.Net.Security;
|
|
using System.Security.Cryptography;
|
|
using System.Security.Cryptography.X509Certificates;
|
|
|
|
public static class ShopDbServerPinValidator
|
|
{
|
|
private static readonly HashSet<string> Pins = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
|
|
public static string LastPresented;
|
|
|
|
public static void Install(string[] pins)
|
|
{
|
|
Pins.Clear();
|
|
foreach (string pin in pins)
|
|
{
|
|
if (!String.IsNullOrEmpty(pin)) { Pins.Add(pin); }
|
|
}
|
|
ServicePointManager.ServerCertificateValidationCallback = Validate;
|
|
}
|
|
|
|
public static bool Validate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors errors)
|
|
{
|
|
if (Pins.Count == 0) { return errors == SslPolicyErrors.None; }
|
|
if (certificate == null) { return false; }
|
|
try
|
|
{
|
|
LastPresented = SpkiSha256Hex(certificate.GetRawCertData());
|
|
}
|
|
catch (Exception)
|
|
{
|
|
LastPresented = null;
|
|
return false;
|
|
}
|
|
return Pins.Contains(LastPresented);
|
|
}
|
|
|
|
// Walks the DER: Certificate > TBSCertificate > [0] version (optional),
|
|
// serialNumber, signature, issuer, validity, subject, subjectPublicKeyInfo.
|
|
public static string SpkiSha256Hex(byte[] der)
|
|
{
|
|
int length;
|
|
int position = EnterSequence(der, 0, out length);
|
|
position = EnterSequence(der, position, out length);
|
|
if (der[position] == 0xA0) { position = Skip(der, position); }
|
|
for (int field = 0; field < 5; field++) { position = Skip(der, position); }
|
|
if (der[position] != 0x30) { throw new FormatException("SubjectPublicKeyInfo not found"); }
|
|
int end = Skip(der, position);
|
|
using (SHA256 sha = SHA256.Create())
|
|
{
|
|
byte[] hash = sha.ComputeHash(der, position, end - position);
|
|
return BitConverter.ToString(hash).Replace("-", "").ToLowerInvariant();
|
|
}
|
|
}
|
|
|
|
private static int ReadLength(byte[] der, int position, out int length)
|
|
{
|
|
int first = der[position];
|
|
if (first < 0x80) { length = first; return position + 1; }
|
|
int count = first & 0x7F;
|
|
if (count == 0 || count > 4) { throw new FormatException("Unsupported DER length"); }
|
|
length = 0;
|
|
for (int i = 1; i <= count; i++) { length = (length << 8) | der[position + i]; }
|
|
return position + 1 + count;
|
|
}
|
|
|
|
private static int EnterSequence(byte[] der, int position, out int length)
|
|
{
|
|
if (der[position] != 0x30) { throw new FormatException("Expected SEQUENCE"); }
|
|
return ReadLength(der, position + 1, out length);
|
|
}
|
|
|
|
private static int Skip(byte[] der, int position)
|
|
{
|
|
int length;
|
|
int content = ReadLength(der, position + 1, out length);
|
|
return content + length;
|
|
}
|
|
}
|
|
'@
|
|
|
|
function Get-ShopDbServerPins {
|
|
# Both registry views, like CollectorKey. Anything not 64 hex chars is dropped.
|
|
$pins = @()
|
|
foreach ($view in @([Microsoft.Win32.RegistryView]::Registry64, [Microsoft.Win32.RegistryView]::Registry32)) {
|
|
try {
|
|
$base = [Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $view)
|
|
try {
|
|
$key = $base.OpenSubKey('SOFTWARE\GE\ShopDB')
|
|
if ($key) {
|
|
try {
|
|
foreach ($value in @($key.GetValue('ServerPins'))) {
|
|
if ($null -eq $value) { continue }
|
|
$pin = ([string]$value -replace '[\s:]', '').ToLowerInvariant()
|
|
if ($pin -match '^[0-9a-f]{64}$' -and $pins -notcontains $pin) { $pins += $pin }
|
|
}
|
|
} finally { $key.Dispose() }
|
|
}
|
|
} finally { $base.Dispose() }
|
|
} catch {}
|
|
}
|
|
return ,$pins
|
|
}
|
|
|
|
function Enable-ShopDbServerPins([string[]]$Pins) {
|
|
# True when pinning is active. False means pins are set but could not be
|
|
# enforced; the caller must not send anything then.
|
|
if ($PSVersionTable.PSEdition -eq 'Core') {
|
|
# PowerShell 7 web cmdlets ignore ServicePointManager, so the check
|
|
# would silently not happen.
|
|
Log 'ERROR ServerPins is set; pin checking needs Windows PowerShell 5.1 (powershell.exe), not pwsh'
|
|
return $false
|
|
}
|
|
try {
|
|
if (-not ('ShopDbServerPinValidator' -as [type])) {
|
|
Add-Type -TypeDefinition $ShopDbPinSource -ErrorAction Stop
|
|
}
|
|
[ShopDbServerPinValidator]::Install($Pins)
|
|
return $true
|
|
} catch {
|
|
Log "ERROR ServerPins is set but pin checking could not be enabled: $($_.Exception.Message)"
|
|
return $false
|
|
}
|
|
}
|
|
|
|
function Get-ShopDbEndpointCredential([string]$TargetUrl) {
|
|
# Empty when there is none or it cannot be used for this URL.
|
|
if (-not (Test-Path -LiteralPath $ShopDbCredentialFile)) { return '' }
|
|
try {
|
|
Add-Type -AssemblyName System.Security -ErrorAction Stop
|
|
$protected = [System.IO.File]::ReadAllBytes($ShopDbCredentialFile)
|
|
$plain = [System.Security.Cryptography.ProtectedData]::Unprotect(
|
|
$protected, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
|
|
$record = [System.Text.Encoding]::UTF8.GetString($plain) | ConvertFrom-Json
|
|
} catch {
|
|
Log "WARN could not read the endpoint credential ($ShopDbCredentialFile): $($_.Exception.Message)"
|
|
return ''
|
|
}
|
|
$credential = [string]$record.credential
|
|
if (-not $credential.StartsWith('sdbe_')) {
|
|
Log 'WARN endpoint credential file has no usable credential; ignoring it'
|
|
return ''
|
|
}
|
|
if (-not $TargetUrl.StartsWith('https://', [System.StringComparison]::OrdinalIgnoreCase)) {
|
|
Log "WARN not sending the endpoint credential over a non-https URL ($TargetUrl)"
|
|
return ''
|
|
}
|
|
# Never hand a credential to a server other than the one that issued it.
|
|
$issuer = ([string]$record.baseurl).Trim().TrimEnd('/')
|
|
if ($issuer -and -not ($TargetUrl.TrimEnd('/') + '/').StartsWith($issuer + '/', [System.StringComparison]::OrdinalIgnoreCase)) {
|
|
Log "WARN endpoint credential was issued by $issuer, not the target $TargetUrl; not sending it"
|
|
return ''
|
|
}
|
|
return $credential
|
|
}
|
|
|
|
function Get-ShopDbHttpFailure($ErrorRecord) {
|
|
# Status and error envelope code (data.error.code) from a failed request.
|
|
$status = 0
|
|
$code = ''
|
|
$text = ''
|
|
try { $status = [int]$ErrorRecord.Exception.Response.StatusCode } catch {}
|
|
if ($ErrorRecord.ErrorDetails -and $ErrorRecord.ErrorDetails.Message) {
|
|
$text = $ErrorRecord.ErrorDetails.Message
|
|
} else {
|
|
try {
|
|
$reader = New-Object System.IO.StreamReader($ErrorRecord.Exception.Response.GetResponseStream())
|
|
$text = $reader.ReadToEnd()
|
|
$reader.Dispose()
|
|
} catch {}
|
|
}
|
|
if ($text) {
|
|
try { $code = [string](($text | ConvertFrom-Json).data.error.code) } catch {}
|
|
}
|
|
$presented = ''
|
|
if ('ShopDbServerPinValidator' -as [type]) { $presented = [string][ShopDbServerPinValidator]::LastPresented }
|
|
return @{ Status = $status; Code = $code; PresentedPin = $presented }
|
|
}
|
|
|
|
function Write-ShopDbAuthFailure($Failure) {
|
|
switch ($Failure.Code) {
|
|
'CREDENTIAL_INVALID' {
|
|
Log ('ERROR 401 CREDENTIAL_INVALID: the server does not accept this PC''s endpoint credential ' +
|
|
'(revoked or unknown). The endpoint agent deletes it and re-enrolls on its own.')
|
|
}
|
|
'SHARED_KEY_REFUSED' {
|
|
Log ('ERROR 401 SHARED_KEY_REFUSED: the server refuses the shared key for this PC, because ' +
|
|
'the PC is enrolled or the shared key is switched off. Reports need the endpoint agent ' +
|
|
"credential: check agent 1.20+ is installed, running and enrolled ($ShopDbCredentialFile).")
|
|
}
|
|
'ASSET_MISMATCH' {
|
|
Log ('ERROR 403 ASSET_MISMATCH: this PC''s credential belongs to a different asset than the ' +
|
|
'hostname in the report. Check the hostname and the enrollment in ShopDB.')
|
|
}
|
|
default {
|
|
if ($Failure.Status -eq 0 -and $Failure.PresentedPin) {
|
|
Log "ERROR TLS refused: server key pin $($Failure.PresentedPin) is not in ServerPins"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
# Server from the GE-Enforce config hive when not passed via Args. Any site
|
|
# running this script is running the enforcement client, which cannot work
|
|
# without BaseUrl, so it is present wherever this is deployed.
|
|
if (-not $ApiUrl) {
|
|
foreach ($regPath in @('HKLM:\SOFTWARE\GE\ShopDB', 'HKLM:\SOFTWARE\WOW6432Node\GE\ShopDB')) {
|
|
try {
|
|
if (Test-Path $regPath) {
|
|
$base = [string](Get-ItemProperty -Path $regPath -Name BaseUrl -ErrorAction Stop).BaseUrl
|
|
if ($base -and $base.Trim()) {
|
|
$ApiUrl = $base.Trim().TrimEnd('/') + '/api/collector/computers'
|
|
break
|
|
}
|
|
}
|
|
} catch {}
|
|
}
|
|
}
|
|
if (-not $ApiUrl) {
|
|
Log 'ERROR no ShopDB URL (HKLM:\SOFTWARE\GE\ShopDB BaseUrl or -ApiUrl). Skipping.'
|
|
exit 0
|
|
}
|
|
|
|
# collector key from the GE-Enforce secret store when not passed via Args.
|
|
if (-not $ApiKey) {
|
|
foreach ($regPath in @('HKLM:\SOFTWARE\GE\ShopDB', 'HKLM:\SOFTWARE\WOW6432Node\GE\ShopDB')) {
|
|
try {
|
|
if (Test-Path $regPath) {
|
|
$v = [string](Get-ItemProperty -Path $regPath -Name CollectorKey -ErrorAction Stop).CollectorKey
|
|
if ($v -and $v.Trim()) { $ApiKey = $v.Trim(); break }
|
|
}
|
|
} catch {}
|
|
}
|
|
}
|
|
$EndpointCredential = Get-ShopDbEndpointCredential $ApiUrl
|
|
if (-not $EndpointCredential -and -not $ApiKey) {
|
|
Log 'ERROR no endpoint credential and no collector key (HKLM:\SOFTWARE\GE\ShopDB CollectorKey or -ApiKey). Skipping.'
|
|
exit 0
|
|
}
|
|
|
|
$serverPins = Get-ShopDbServerPins
|
|
if ($serverPins.Count -gt 0) {
|
|
if (-not (Enable-ShopDbServerPins $serverPins)) {
|
|
Log 'ERROR refusing to report without the server pin check. Skipping.'
|
|
exit 0
|
|
}
|
|
Log "server pin check on ($($serverPins.Count) pin(s))"
|
|
}
|
|
|
|
# -AllowedRanges and the CollectorRanges registry value are ACCEPTED AND
|
|
# IGNORED. Deciding which NIC is the PC's address moved to the server, where
|
|
# the site's addressing actually lives: this script now reports every NIC and
|
|
# takes no view. The parameter stays so a scheduled task still passing it does
|
|
# not fail on an unknown argument.
|
|
if ($AllowedRanges) {
|
|
Log 'NOTE -AllowedRanges is ignored; set collector_corporate_ranges in ShopDB settings instead.'
|
|
}
|
|
|
|
Log '=== Report asset to ShopDB (collector) ==='
|
|
|
|
# hostname - the collector identity field. required.
|
|
$hostname = $env:COMPUTERNAME
|
|
|
|
# BIOS serial - optional now (collector keys on hostname). Sent when present.
|
|
$serialNumber = ''
|
|
try {
|
|
$serialNumber = (Get-CimInstance -ClassName Win32_BIOS -ErrorAction Stop).SerialNumber
|
|
if ($serialNumber) { $serialNumber = $serialNumber.Trim() }
|
|
} catch {
|
|
Log "WARN could not read BIOS serial: $($_.Exception.Message)"
|
|
}
|
|
|
|
# Machine identifier - optional, sent only if found. Maps to Asset.assetnumber
|
|
# server-side (9999 placeholder skipped there and here).
|
|
# 1. eDNC registry (WOW6432Node, then native) - DNC/collections bays (2001...).
|
|
# 2. C:\Enrollment\cmm\cmmid.txt - CMM bay id (e.g. CMM3).
|
|
# 3. C:\Enrollment\machine-number.txt - imaging value.
|
|
# keyence / genspect / part-marker have no per-bay id -> no machineNo sent.
|
|
# Those bays name their DEVICE instead, in asset-id.txt below.
|
|
$machineNo = ''
|
|
foreach ($regPath in @(
|
|
'HKLM:\SOFTWARE\WOW6432Node\GE Aircraft Engines\DNC\General',
|
|
'HKLM:\SOFTWARE\GE Aircraft Engines\DNC\General'
|
|
)) {
|
|
if ($machineNo) { break }
|
|
try {
|
|
if (Test-Path $regPath) {
|
|
$v = [string](Get-ItemProperty -Path $regPath -Name MachineNo -ErrorAction Stop).MachineNo
|
|
if ($v -and $v.Trim() -ne '9999') { $machineNo = $v.Trim() }
|
|
}
|
|
} catch {
|
|
Log "WARN could not read MachineNo from ${regPath}: $($_.Exception.Message)"
|
|
}
|
|
}
|
|
if (-not $machineNo) {
|
|
$cmmFile = 'C:\Enrollment\cmm\cmmid.txt'
|
|
if (Test-Path -LiteralPath $cmmFile) {
|
|
try {
|
|
$v = ([string](Get-Content -LiteralPath $cmmFile -First 1 -ErrorAction Stop)).Trim()
|
|
if ($v -and $v -ne '9999') { $machineNo = $v; Log "machineNo from $cmmFile (CMM bay id): $machineNo" }
|
|
} catch { Log "WARN could not read ${cmmFile}: $($_.Exception.Message)" }
|
|
}
|
|
}
|
|
if (-not $machineNo) {
|
|
$mnFile = 'C:\Enrollment\machine-number.txt'
|
|
if (Test-Path -LiteralPath $mnFile) {
|
|
try {
|
|
$v = ([string](Get-Content -LiteralPath $mnFile -First 1 -ErrorAction Stop)).Trim()
|
|
if ($v -and $v -ne '9999') { $machineNo = $v; Log "machineNo from $mnFile (imaging value): $machineNo" }
|
|
} catch { Log "WARN could not read ${mnFile}: $($_.Exception.Message)" }
|
|
}
|
|
}
|
|
|
|
# OS name string (caption + feature-update + build), e.g.
|
|
# "Microsoft Windows 11 Enterprise 23H2 (build 22631)". Server upserts each
|
|
# distinct string into operatingsystems.
|
|
$osVersion = ''
|
|
$lastBootTime = ''
|
|
try {
|
|
$os = Get-CimInstance -ClassName Win32_OperatingSystem -ErrorAction Stop
|
|
$osVersion = "$($os.Caption)".Trim()
|
|
$displayVersion = ''
|
|
try {
|
|
$displayVersion = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name DisplayVersion -ErrorAction Stop).DisplayVersion
|
|
} catch {}
|
|
if ($displayVersion) { $osVersion += " $displayVersion" }
|
|
if ($os.BuildNumber) { $osVersion += " (build $($os.BuildNumber))" }
|
|
$osVersion = $osVersion.Trim()
|
|
# ISO 8601 - collector parses via datetime.fromisoformat.
|
|
try { $lastBootTime = $os.LastBootUpTime.ToString('yyyy-MM-ddTHH:mm:ss') } catch {}
|
|
} catch {}
|
|
|
|
# interactive console user. runs as SYSTEM, so use Win32_ComputerSystem.UserName
|
|
# (console session owner). empty when nobody logged on -> omitted so an
|
|
# unattended bay does not blank the last-known user.
|
|
$loggedInUser = ''
|
|
try {
|
|
$loggedInUser = (Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop).UserName
|
|
if ($loggedInUser) { $loggedInUser = ($loggedInUser -split '\\')[-1].Trim() }
|
|
} catch {
|
|
Log "WARN could not read logged-in user: $($_.Exception.Message)"
|
|
}
|
|
|
|
# The DEVICE hanging off this PC - the ONE enrollment file for every bay that
|
|
# has no NTLARS/eDNC MachineNo registry to identify it. It names the asset and
|
|
# nothing else: it does not say what kind of device that is, because the pc-type
|
|
# already does, so the same file serves a part marker, a Keyence, a Genspect or
|
|
# anything added later without a new file or a client change.
|
|
#
|
|
# Deliberately NOT machine-number.txt. machinenumber answers "which bay is
|
|
# this" and is what GE-Enforce TargetMachineNumbers gates on, so naming a device
|
|
# there would silently stop every bay-gated manifest entry from matching.
|
|
#
|
|
# WHY A FILE AT ALL: every other identity the server can fall back to is derived
|
|
# from the PC - a prior link from this PC, or an asset number built from this
|
|
# hostname - so none of them survive a PC SWAP. The replacement box mints a
|
|
# SECOND record for the same physical device while the first keeps its history
|
|
# under a dead PC's name. This file is what survives.
|
|
#
|
|
# The server ADOPTS the named asset, refuses a value it cannot resolve, and
|
|
# refuses one that resolves to the wrong kind of thing - so a typo warns instead
|
|
# of inventing a phantom device.
|
|
$deviceId = ''
|
|
$idFile = 'C:\Enrollment\asset-id.txt'
|
|
if (Test-Path -LiteralPath $idFile) {
|
|
try {
|
|
$deviceId = ([string](Get-Content -LiteralPath $idFile -First 1 -ErrorAction Stop)).Trim()
|
|
if ($deviceId) { Log "deviceId from ${idFile}: $deviceId" }
|
|
} catch { Log "WARN could not read ${idFile}: $($_.Exception.Message)" }
|
|
}
|
|
# 0.12.0 shipped measuringtool-id.txt before the file was generalised. Read it
|
|
# as a fallback so a bay already staged with one keeps reporting.
|
|
if (-not $deviceId) {
|
|
$mtFile = 'C:\Enrollment\measuringtool-id.txt'
|
|
if (Test-Path -LiteralPath $mtFile) {
|
|
try {
|
|
$deviceId = ([string](Get-Content -LiteralPath $mtFile -First 1 -ErrorAction Stop)).Trim()
|
|
if ($deviceId) { Log "deviceId from ${mtFile} (pre-0.13 name): $deviceId" }
|
|
} catch { Log "WARN could not read ${mtFile}: $($_.Exception.Message)" }
|
|
}
|
|
}
|
|
|
|
# imaging pc-type (gea-shopfloor-*), read from the enrollment file. Sent only
|
|
# when present; absent -> server leaves existing pctype untouched (a bare report
|
|
# never re-types a PC). Unmapped values return a warning, not an error.
|
|
$pcType = ''
|
|
$ptFile = 'C:\Enrollment\pc-type.txt'
|
|
if (Test-Path -LiteralPath $ptFile) {
|
|
try {
|
|
$pcType = (Get-Content -LiteralPath $ptFile -First 1 -ErrorAction Stop).Trim()
|
|
} catch { Log "WARN could not read ${ptFile}: $($_.Exception.Message)" }
|
|
}
|
|
|
|
# PC make/model from WMI. Server resolves/creates vendor + model. Sent only when
|
|
# present so a WMI read failure does not blank the model.
|
|
$manufacturer = ''
|
|
$model = ''
|
|
try {
|
|
$cs = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop
|
|
$manufacturer = "$($cs.Manufacturer)".Trim()
|
|
$model = "$($cs.Model)".Trim()
|
|
} catch {
|
|
Log "WARN could not read make/model: $($_.Exception.Message)"
|
|
}
|
|
|
|
# EVERY connected hardware NIC with a routable IPv4, and no opinion about
|
|
# which one matters. Choosing used to happen here and this was the wrong place
|
|
# for it: a bay cannot know a site's addressing. A CMM whose Marvell AQtion
|
|
# 10Gbit link to its controller sits on 100.0.0.1 reported THAT as the PC's
|
|
# address - the link carries a default route too - and the corporate address
|
|
# was never sent at all, so ShopDB could not even show it as a second row.
|
|
#
|
|
# The server picks the primary now, from the site's configured corporate
|
|
# ranges, and records the rest. Report what is here; let it decide.
|
|
$interfaces = @()
|
|
$defaultRouteIfIndexes = @()
|
|
try {
|
|
$defaultRouteIfIndexes = @(Get-NetRoute -DestinationPrefix '0.0.0.0/0' -ErrorAction Stop |
|
|
Select-Object -ExpandProperty InterfaceIndex -Unique)
|
|
} catch {
|
|
Log "WARN could not read the route table: $($_.Exception.Message)"
|
|
}
|
|
try {
|
|
$ipObjs = Get-NetIPAddress -AddressFamily IPv4 -ErrorAction Stop |
|
|
Where-Object { $_.IPAddress -notmatch '^169\.254' -and $_.IPAddress -ne '127.0.0.1' }
|
|
foreach ($ipo in $ipObjs) {
|
|
$adapter = $null
|
|
try { $adapter = Get-NetAdapter -InterfaceIndex $ipo.InterfaceIndex -ErrorAction Stop } catch {}
|
|
if (-not $adapter) { continue }
|
|
if (-not $adapter.HardwareInterface) { continue }
|
|
if ($adapter.Status -ne 'Up') { continue }
|
|
$interfaces += @{
|
|
ipaddress = $ipo.IPAddress
|
|
macaddress = $adapter.MacAddress
|
|
adaptername = $adapter.InterfaceDescription
|
|
isdefaultroute = [bool]($defaultRouteIfIndexes -contains $ipo.InterfaceIndex)
|
|
}
|
|
}
|
|
} catch {
|
|
Log "WARN interface enumeration failed: $($_.Exception.Message)"
|
|
}
|
|
if ($interfaces.Count -eq 0) {
|
|
Log 'WARN no routable IPv4 NIC found; posting identity without any interface.'
|
|
} else {
|
|
Log ("Reporting {0} NIC(s): {1}" -f $interfaces.Count,
|
|
(($interfaces | ForEach-Object { $_.ipaddress }) -join ', '))
|
|
}
|
|
|
|
# collector schema fields (lowercase concatenated). hostname is required; the
|
|
# rest are sent only when present so a partial read never blanks a good value.
|
|
$body = @{ hostname = $hostname }
|
|
if ($serialNumber) { $body['serialnumber'] = $serialNumber }
|
|
if ($machineNo) { $body['machinenumber'] = $machineNo }
|
|
if ($pcType) { $body['pctype'] = $pcType }
|
|
if ($deviceId) { $body['deviceid'] = $deviceId }
|
|
if ($manufacturer) { $body['vendorname'] = $manufacturer }
|
|
if ($model) { $body['modelnumber'] = $model }
|
|
if ($osVersion) { $body['osname'] = $osVersion }
|
|
if ($lastBootTime) { $body['lastboottime'] = $lastBootTime }
|
|
if ($loggedInUser) { $body['loggedinuser'] = $loggedInUser }
|
|
if ($interfaces.Count -gt 0) { $body['interfaces'] = $interfaces }
|
|
$body['lastcheckin'] = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss')
|
|
|
|
$json = $body | ConvertTo-Json -Compress -Depth 4
|
|
|
|
Log ("POST {0} host={1} serial={2} pcType={3} make={4} model={5} os={6} boot={7} machineNo={8} user={9} ip={10} deviceId={11}" -f `
|
|
$ApiUrl, $hostname, $serialNumber, $pcType, $manufacturer, $model, $osVersion, $lastBootTime, $machineNo, $loggedInUser, $corpIp, $deviceId)
|
|
|
|
# Credential first; the shared key only when there is no credential, or when
|
|
# the server has just refused the credential (revoked: the shared key is
|
|
# admitted again for this PC until the agent re-enrolls). Never both at once.
|
|
$attempts = @()
|
|
if ($EndpointCredential) { $attempts += ,@('credential', @{ 'X-Endpoint-Credential' = $EndpointCredential }) }
|
|
if ($ApiKey) { $attempts += ,@('shared key', @{ 'X-API-Key' = $ApiKey }) }
|
|
|
|
foreach ($attempt in $attempts) {
|
|
try {
|
|
$resp = Invoke-RestMethod -Uri $ApiUrl -Method Post -Body $json `
|
|
-ContentType 'application/json' `
|
|
-Headers $attempt[1] `
|
|
-TimeoutSec $TimeoutSec -ErrorAction Stop
|
|
Log ("RESPONSE ({0}) {1}" -f $attempt[0], ($resp | ConvertTo-Json -Compress -Depth 4))
|
|
break
|
|
} catch {
|
|
Log "ERROR POST with $($attempt[0]) failed: $($_.Exception.Message)"
|
|
$failure = Get-ShopDbHttpFailure $_
|
|
Write-ShopDbAuthFailure $failure
|
|
if ($failure.Code -ne 'CREDENTIAL_INVALID') { break }
|
|
}
|
|
}
|
|
|
|
exit 0
|