From ad39aa5cf41c2494602e9682befe574abd668ff8 Mon Sep 17 00:00:00 2001 From: Simone Date: Sun, 10 May 2026 07:11:03 +0200 Subject: [PATCH] =?UTF-8?q?docs(todo):=20=C2=A77=20=E2=80=94=20replace=20e?= =?UTF-8?q?moji=20with=20[x]/[=20]=20checkboxes,=20reformat=20items?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Convert §7.1/7.2/7.3 from emoji ✅ + prose into standard [x] checkbox lists. §7.4 items converted to [ ] open checkboxes. Consistent with rest of TODO. Co-Authored-By: Claude Sonnet 4.6 --- TODO.md | 107 ++++++++++++++++---------------------------------------- 1 file changed, 30 insertions(+), 77 deletions(-) diff --git a/TODO.md b/TODO.md index 2040c39..21a1498 100644 --- a/TODO.md +++ b/TODO.md @@ -619,95 +619,48 @@ duplicazioni; ogni concern ha **una sola** sorgente di verità. **Stato attuale (duplicati)**: UAC, Explorer LaunchTo, Server Manager off, DisableCAD, OOBE telemetry, WU services disable — entrambi gli script li toccano. -### 7.1 [P1] Spostare base OS hardening da Setup a Deploy ✅ codice fatto 2026-05-10 +### 7.1 [P1] Spostare base OS hardening da Setup a Deploy File: [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1), [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1). -**Implementato**: Firewall disable + WinRM MaxMemory/IdleTimeout/MaxProcesses spostati in -Deploy post-install.ps1. Aggiunti anche lock screen, SM GPO policy key, SM scheduled task -disable, DisableCAD Winlogon, OOBE non-policy key (mancanti vs Setup 5c). -Setup Step 1/3/4b/5b/5c convertiti a Assert-Step only — nessun Set. -Pending §7.4 per e2e validation su VM reale. +- [x] Aggiungere `Set-NetFirewallProfile -Enabled False` (tutti i profili) in Deploy post-install.ps1 +- [x] Aggiungere `MaxMemoryPerShellMB=2048`, `IdleTimeOut=7200000`, `MaxProcessesPerShell=25`, `StartupType=Automatic` in Deploy dopo Enable-PSRemoting +- [x] Aggiungere in Deploy items mancanti rispetto a Setup 5c: lock screen (`NoLockScreen`), SM GPO policy key (`DoNotOpenAtLogon`), SM scheduled task disable, `DisableCAD` in Winlogon, OOBE non-policy key +- [x] Setup Step 1 (Firewall) → Assert-Step only +- [x] Setup Step 2 (Defender) → già validation-only (refactor 2026-05-09) +- [x] Setup Step 3 (WinRM tuning) → Assert-Step only (rimuovi Enable-PSRemoting, winrm set, Set-Item, Set-Service) +- [x] Setup Step 4b (UAC) → Assert-Step only +- [x] Setup Step 5b (Explorer LaunchTo) → Assert-Step only +- [x] Setup Step 5c (Server Manager / DisableCAD / OOBE) → Assert-Step only +- [ ] E2e validation — vedi §7.4 -**Da MUOVERE Setup → Deploy**: - -| Concern Setup | Step attuale Setup | Azione Deploy | -| ---------------------------- | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- | -| Firewall off all profiles | Step 1 | Aggiungere `Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled False` in post-install (ora Deploy aggiunge solo regole RDP/ICMP) | -| WinRM tuning memoria/timeout | Step 3 (parziale) | Aggiungere `MaxMemoryPerShellMB=2048`, `IdleTimeOut=7200000`, `MaxProcessesPerShell=25` in post-install dopo Enable-PSRemoting | - -**Da CONVERTIRE in Setup a Assert-Step (validation-only)**: - -| Step Setup | Diventa | -| ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------- | -| Step 1 Firewall | `Assert-Step` 3 profili Enabled=False (richiede prima la riga "Da MUOVERE" → Deploy: Set-NetFirewallProfile -Enabled False) | -| Step 2 Defender | Già validation-only (refactor 2026-05-09) | -| Step 3 WinRM tuning | `Assert-Step` MaxMemoryPerShellMB, IdleTimeOut, AllowUnencrypted, Basic | -| Step 4b UAC | `Assert-Step` EnableLUA=0, LocalAccountTokenFilterPolicy=1 | -| Step 5b Explorer LaunchTo | `Assert-Step` HKCU LaunchTo=1 | -| Step 5c Server Manager / DisableCAD / OOBE | `Assert-Step` HKLM machine policy + DisableCAD=1 + OOBE policy | - -**Da MANTENERE in Setup (build env, non base OS)**: -- Step 4: build user `ci_build` + admin -- Step 5: `C:\CI\{build,output,scripts}` dirs -- Step 7-9: .NET SDK, Python, VS Build Tools -- Step 10: Toolchain cross-check -- Cleanup, Final pre-snapshot gate - -**Test acceptance**: -- Deploy stand-alone produce VM con tutte le validation Setup che passano (no Setup run) -- Setup run dopo Deploy: tutte Assert-Step pass `[OK]` immediato (no work) -- Test `--Skip` orthogonali (no regressione) - -### 7.2 [P1] WU lifecycle — strategia B (Deploy: GPO + Manual; Setup: lifecycle) ✅ codice fatto 2026-05-10 +### 7.2 [P1] WU lifecycle — strategia B (Deploy: GPO + Manual; Setup: lifecycle) File: [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1), [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1). -**Implementato**: Deploy sostituisce `sc.exe config start= disabled` con -`NoAutoUpdate=1` + `DisableWindowsUpdateAccess=1` GPO (servizi rimangono Manual). -Setup Step 6 Step A/D già gestisce reset + restart servizi (idempotente). -Pending §7.4 per e2e validation. +Strategia B: Deploy lascia servizi WU `start=demand` (Manual, default Windows) e scrive solo +GPO `NoAutoUpdate=1` + `DisableWindowsUpdateAccess=1`. Setup Step 6 clears i GPO locks (Step A), +avvia WU via SchTask SYSTEM, poi Step 6b disabilita servizi permanentemente post-update. -**Stato attuale (conflitto ordering)**: -- Deploy: `sc.exe config wuauserv start= disabled` + `sc.exe stop wuauserv` (idem UsoSvc, WaaSMedicSvc) + GPO `NoAutoUpdate=1` -- Setup Step 6: necessita servizi UP per SchTask SYSTEM run WU -- Setup Step 6b: re-disabilita servizi → doppio lavoro, fragile +- [x] Deploy: rimuovere `sc.exe config wuauserv start= disabled` (e UsoSvc, WaaSMedicSvc) +- [x] Deploy: aggiungere GPO `DisableWindowsUpdateAccess=1` (era mancante; `NoAutoUpdate=1` già presente) +- [x] Setup Step 6 Step A: già rimuove `DisableWindowsUpdateAccess` + `NoAutoUpdate` prima del COM API — nessuna modifica necessaria +- [x] Setup Step 6 Step D: già fa `Set-Service start=Manual` + `Start-Service` — idempotente con servizi già Manual +- [x] Setup Step 6b: già disabilita wuauserv/UsoSvc + GPO keys — nessuna modifica necessaria +- [ ] E2e validation — vedi §7.4 -**Strategia B — separazione pulita**: +### 7.3 [P2] Update header docs di entrambi gli script -**Deploy** (post-install.ps1): -- Lascia servizi WU `start=demand` (Manual, default Windows) — NON `disabled`, NON `stop` -- Setta solo GPO `NoAutoUpdate=1`, `DisableWindowsUpdateAccess=1` → no background scheduled WU -- Risultato: WU è invocabile on-demand ma non parte mai da solo - -**Setup** (Step 6 / 6b): -- Step 6 (skip se `-SkipWindowsUpdate`): `sc.exe config wuauserv start= demand` (idempotent), avvia SchTask SYSTEM, attende exit code, parse 0/2/3/3010 -- Step 6b (sempre, anche con `-Skip`): `sc.exe config wuauserv start= disabled` + `sc.exe stop wuauserv` (idem UsoSvc, WaaSMedicSvc), conferma GPO presenti — snapshot capture WU permanently off - -**Pattern run periodico patches** (allineato §2.5 snapshot versionato): -- Re-deploy template `BaseClean_` ogni N mesi via Deploy + Prepare (no `-Skip`) → patch applicate al template fresh - -**Validazione finale** (Setup Final gate): -- `wuauserv.StartType == Disabled` -- `UsoSvc.StartType == Disabled` -- GPO `NoAutoUpdate=1`, `DisableWindowsUpdateAccess=1` - -**Test acceptance**: -- Deploy stand-alone: `Get-Service wuauserv | Select StartType` → `Manual`, `Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name NoAutoUpdate` → 1 -- Setup `-SkipWindowsUpdate`: Final gate vede `StartType=Disabled` (impostato da Step 6b) -- Setup senza `-Skip`: WU runs, exit 0/2/3, poi servizi disabled - -### 7.3 [P2] Update header docs di entrambi gli script ✅ fatto 2026-05-10 -- [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1) `.DESCRIPTION`: aggiornato con tutte le hardening voci (firewall, WinRM tuning, WU GPO strategy B, lock screen, SM, OOBE). -- [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1) `.DESCRIPTION`: Steps 1/3/4b/5b/5c marcati "validation-only — set by Deploy"; step ordering rationale aggiornato. -- [docs/WINDOWS-TEMPLATE-SETUP.md](docs/WINDOWS-TEMPLATE-SETUP.md): architettura "tre script", VMX path corretti, Fase C step list + razionale + tabella validazioni aggiornati. +- [x] [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1) `.DESCRIPTION`: aggiornato con tutte le hardening voci (firewall, WinRM tuning, WU GPO strategy B, lock screen, SM, OOBE) +- [x] [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1) `.DESCRIPTION`: Steps 1/3/4b/5b/5c marcati "validation-only — set by Deploy"; step ordering rationale aggiornato +- [x] [docs/WINDOWS-TEMPLATE-SETUP.md](docs/WINDOWS-TEMPLATE-SETUP.md): architettura "tre script", VMX path `CI-WinBuild.vmx`, Fase C step list + razionale + tabella validazioni aggiornati ### 7.4 [P2] Test e2e refactor -- Run Deploy stand-alone su VM test → verifica tutte le hardening voci presenti - (`reg query` per chiavi UAC/OOBE/Server Manager, `Get-NetFirewallProfile`, `Get-Service WMUauserv`) -- Run Prepare-WinBuild2025 dopo Deploy → tutti `Assert-Step` pass `[OK]` senza work -- Run Prepare con `-SkipWindowsUpdate` → comportamento invariato -- Run Prepare senza `-Skip` → WU runs, services lifecycled correttamente + +- [ ] Deploy stand-alone su VM test → `Get-NetFirewallProfile` tutti `Enabled=False`, `Get-Service wuauserv | Select StartType` → `Manual`, `NoAutoUpdate=1` GPO presente +- [ ] Prepare dopo Deploy con `-SkipWindowsUpdate` → tutti `Assert-Step` passano `[OK]` senza eseguire Set (log mostra solo validation output) +- [ ] Prepare senza `-SkipWindowsUpdate` → WU gira via SchTask SYSTEM, exit code 0/2/3, Step 6b disabilita wuauserv/UsoSvc (`StartType=Disabled`) +- [ ] Final gate del guest passa su tutti e 7 i check ### 7.5 [P3] Rinomina Setup → Setup-CITools (opzionale, futuro) Una volta che Setup fa solo build customization, nome `Setup-WinBuild2025` è impreciso —