feat(template): add Assert-Step validation to all provisioning steps
Setup-TemplateVM.ps1: - Added Assert-Step validation after each install step (WinRM, Firewall, User, UAC, Defender, .NET, Python, VS Build Tools, Toolchain, Cleanup) - Final pre-snapshot gate: all checks must pass before snapshot is allowed - Disabled Windows Defender + Firewall before installs (saves 5-15 min) - Disabled UAC (EnableLUA=0, LocalAccountTokenFilterPolicy=1) Prepare-TemplateSetup.ps1: - Pre-flight checks: IP validation, TCP/5985 reachability, script presence - Host WinRM: AllowUnencrypted, TrustedHosts config - Guest prep: C:\CI exists, file copied, size match - Post-setup remote validation (9 checks): WinRM, user+admin, UAC, firewall, .NET, Python, MSBuild, CI dirs - StoreCredential flow: New-StoredCredential for BuildVMGuest target
This commit is contained in:
Simone
+666
-193
@@ -1,4 +1,4 @@
|
||||
#Requires -RunAsAdministrator
|
||||
#Requires -RunAsAdministrator
|
||||
#Requires -Version 5.1
|
||||
<#
|
||||
.SYNOPSIS
|
||||
@@ -8,13 +8,68 @@
|
||||
This script is run ONE TIME inside the template VM before taking the
|
||||
"BaseClean" snapshot. After the snapshot is taken, never modify the VM.
|
||||
|
||||
Installs and configures:
|
||||
- Windows Updates (all available, via COM API — no external module needed)
|
||||
- WinRM with basic authentication (for PSSession from host)
|
||||
- A dedicated local build user account
|
||||
- Visual Studio Build Tools 2026 (MSBuild, MSVC, .NET desktop targets)
|
||||
- .NET SDK 10.x
|
||||
- Firewall rules for WinRM
|
||||
Installs and configures (each step followed by Assert-Step validation):
|
||||
Step 1 — Firewall: all profiles disabled first — removes any block on subsequent steps
|
||||
Validation: Domain/Private/Public all Enabled=False
|
||||
Step 2 — Defender & Antimalware disabled — before WinRM and Windows Update
|
||||
Set-MpPreference + GPO registry keys; exclusions C:\CI, C:\dotnet, C:\Python
|
||||
Validation: 6 GPO keys + MpPreference (if WinDefend service present)
|
||||
Rationale: WU downloads + VS/Python/dotnet installers run unscanned;
|
||||
saves 5-15 min; WinRM traffic not inspected
|
||||
Step 3 — WinRM: Basic auth, AllowUnencrypted, MaxMemoryPerShellMB=2048, 2h timeout
|
||||
Firewall + Defender already off — no interference during config
|
||||
Validation: service Running+Automatic, AllowUnencrypted, Auth/Basic, memory
|
||||
Step 4 — Local build user account ($BuildUsername, PasswordNeverExpires, Administrators)
|
||||
Validation: user exists, enabled, PasswordNeverExpires, admin membership
|
||||
Step 4b — UAC disabled (EnableLUA=0, LocalAccountTokenFilterPolicy=1)
|
||||
Validation: both registry values verified
|
||||
Step 5 — CI working directories: C:\CI\build, C:\CI\output, C:\CI\scripts
|
||||
Must run before Windows Update — WU worker writes temp files to C:\CI
|
||||
Validation: each path exists as Container
|
||||
Step 5b — Explorer LaunchTo=1 (This PC) for current user + Default profile hive
|
||||
Validation: HKCU LaunchTo=1
|
||||
Step 5c — CI UX hardening (all UI tweaks before the long-running WU step):
|
||||
Server Manager auto-start off (machine policy + HKCU Administrator +
|
||||
Default User hive → ci_build inherits at first logon)
|
||||
Ctrl+Alt+Del at login disabled (DisableCAD=1) — CI VMs never need it
|
||||
OOBE privacy/telemetry prompt suppressed (DisablePrivacyExperience=1,
|
||||
AllowTelemetry=0) — prevents first-logon interactive prompt in clones
|
||||
Validation: machine policy key, HKCU key, DisableCAD, OOBE policy, telemetry
|
||||
Step 6 — Windows Update via Scheduled Task as SYSTEM (avoids WinRM token limit)
|
||||
Runs with Firewall + Defender off, C:\CI present — faster, no scan overhead
|
||||
Validation: result code 0/2/3, no reboot required (else exit 3010)
|
||||
Step 6b — Windows Update permanently disabled (post-update lockdown)
|
||||
wuauserv + UsoSvc set to Disabled; GPO keys NoAutoUpdate=1,
|
||||
DisableWindowsUpdateAccess=1; WU scheduled tasks disabled
|
||||
Runs unconditionally (even with -SkipWindowsUpdate) so snapshot
|
||||
captures WU off — linked clones never trigger background updates
|
||||
Validation: wuauserv StartType=Disabled, GPO keys present
|
||||
Step 7 — .NET SDK (channel $DotNetSdkVersion) via dotnet-install.ps1
|
||||
Validation: dotnet resolvable, version channel match, machine PATH
|
||||
Step 8 — Python $PythonVersion (all users, C:\Python, PrependPath)
|
||||
Validation: binary present, exact version match, PATH
|
||||
Step 9 — Visual Studio Build Tools 2026 via Scheduled Task as SYSTEM
|
||||
Validation: MSBuild.exe exists, executes, PATH, VC dir present
|
||||
Step 10 — Toolchain cross-check (dotnet, python, msbuild)
|
||||
Throws on any missing tool (was: warn-only)
|
||||
Cleanup — Disk cleanup: cleanmgr, SoftwareDistribution, CBS, TEMP, Prefetch, DISM
|
||||
wuauserv already Disabled (Step 6b) — not restarted after cache clear
|
||||
SoftwareDistribution\Download cleared best-effort (WaaSMedicSvc may repopulate)
|
||||
Validation: wuauserv StartType Disabled (SoftwareDistribution check removed —
|
||||
WaaSMedicSvc tamper-protection restores files immediately)
|
||||
Final — Pre-snapshot gate: 7 cross-cutting checks across all steps
|
||||
Throws if any check fails — prevents snapshot of broken state
|
||||
|
||||
Step ordering rationale:
|
||||
Firewall first — removes any network block before WinRM config and WU downloads
|
||||
Defender second — eliminates scan overhead before WinRM, WU, and installer downloads
|
||||
WinRM third — configured clean with no Firewall/Defender interference
|
||||
User + UAC — quick registry ops; UAC off before dirs/tools avoids elevation prompts
|
||||
CI dirs — C:\CI must exist before WU worker writes temp files there
|
||||
UI tweaks — all fast registry writes batched before the slow WU step
|
||||
WU sixth — all prereqs (dirs, user, tweaks) done; Firewall+Defender off
|
||||
WU disable — immediately after WU completes; snapshot captures WU permanently off
|
||||
Toolchain — .NET / Python / VS last; WU done, no scan on installer payloads
|
||||
|
||||
NOTE: Git is NOT installed. The host clones the repository and copies
|
||||
the source tree into the VM via WinRM (Option B isolation model).
|
||||
@@ -27,13 +82,27 @@
|
||||
║ for pip/nuget downloads at runtime). ║
|
||||
╚══════════════════════════════════════════════════════════════════════╝
|
||||
|
||||
After this script completes:
|
||||
After this script completes (exit 0, all Assert-Step checks passed):
|
||||
1. Shut down the VM (Start → Shut down)
|
||||
The VM stays on VMnet8 (NAT) — internet access is required for builds.
|
||||
2. In VMware Workstation: VM → Snapshot → Take Snapshot
|
||||
Name it exactly: BaseClean
|
||||
3. Power off the VM and leave it powered off permanently
|
||||
|
||||
.PARAMETER BuildUsername
|
||||
Local username for the CI build account. Default: ci_build.
|
||||
|
||||
.PARAMETER BuildPassword
|
||||
Password for the build account. Mandatory — supplied by Prepare-TemplateSetup.ps1
|
||||
(which prompts interactively). Store the same value in Windows Credential Manager
|
||||
on the HOST as target "BuildVMGuest".
|
||||
|
||||
.PARAMETER DotNetSdkVersion
|
||||
.NET SDK channel to install. Default: 10.0 (matches host SDK).
|
||||
|
||||
.PARAMETER PythonVersion
|
||||
Exact Python release to install (x.y.z, must exist on python.org). Default: 3.13.3.
|
||||
|
||||
.PARAMETER SkipWindowsUpdate
|
||||
Skip the Windows Update step (useful if updates were already applied).
|
||||
|
||||
@@ -41,7 +110,7 @@
|
||||
Invoke via Prepare-TemplateSetup.ps1 from the HOST (recommended), or
|
||||
run manually from an elevated PowerShell session INSIDE the VM:
|
||||
Set-ExecutionPolicy Bypass -Scope Process -Force
|
||||
.\Setup-TemplateVM.ps1
|
||||
.\Setup-TemplateVM.ps1 -BuildPassword 'YourPassword'
|
||||
#>
|
||||
[CmdletBinding()]
|
||||
param(
|
||||
@@ -61,7 +130,10 @@ param(
|
||||
[string] $PythonVersion = '3.13.3',
|
||||
|
||||
# Skip Windows Update (useful when updates already applied or no internet)
|
||||
[switch] $SkipWindowsUpdate
|
||||
[switch] $SkipWindowsUpdate,
|
||||
|
||||
# Skip disk cleanup step (cleanmgr + DISM + cache clear) — speeds up re-runs during dev/debug
|
||||
[switch] $SkipCleanup
|
||||
)
|
||||
|
||||
Set-StrictMode -Version Latest
|
||||
@@ -72,7 +144,382 @@ function Write-Step {
|
||||
Write-Host "`n=== $Message ===" -ForegroundColor Cyan
|
||||
}
|
||||
|
||||
# ── Step 0: Windows Update ────────────────────────────────────────────────────
|
||||
function Assert-Step {
|
||||
param(
|
||||
[Parameter(Mandatory)] [string] $StepName,
|
||||
[Parameter(Mandatory)] [string] $Description,
|
||||
[Parameter(Mandatory)] [scriptblock] $Test
|
||||
)
|
||||
$ok = $false
|
||||
try { $ok = [bool](& $Test) }
|
||||
catch { throw "[$StepName] Validation threw on '$Description': $_" }
|
||||
if (-not $ok) {
|
||||
throw "[$StepName] Validation failed: $Description"
|
||||
}
|
||||
Write-Host " [OK] $Description" -ForegroundColor Green
|
||||
}
|
||||
|
||||
# ── Pre-flight: remove temp files from any previous partial run ───────────────
|
||||
# These files are normally deleted at the end of each step that creates them.
|
||||
# A previous interrupted run may have left them behind — remove before starting.
|
||||
$knownTempFiles = @(
|
||||
'C:\CI\wu_worker.ps1', 'C:\CI\wu_result.txt', 'C:\CI\wu_reboot.txt', 'C:\CI\wu_log.txt',
|
||||
'C:\CI\vs_worker.ps1', 'C:\CI\vs_result.txt', 'C:\CI\vs_BuildTools.exe',
|
||||
'C:\CI\python_installer.exe'
|
||||
)
|
||||
foreach ($f in $knownTempFiles) {
|
||||
if (Test-Path $f) {
|
||||
Remove-Item $f -Force -ErrorAction SilentlyContinue
|
||||
Write-Host "[PreFlight] Removed leftover temp file: $f"
|
||||
}
|
||||
}
|
||||
|
||||
# ── Step 1: Firewall ──────────────────────────────────────────────────────────
|
||||
Write-Step "Disabling Windows Firewall (all profiles) — isolated lab VM"
|
||||
|
||||
# Disable first: removes any block on subsequent WinRM config and WU downloads.
|
||||
# This VM lives on VMnet8 NAT behind the VMware NAT gateway — no inbound exposure
|
||||
# from outside the host, so full disable is acceptable.
|
||||
Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled False
|
||||
Write-Host "Windows Firewall disabled on all profiles."
|
||||
|
||||
# Validation
|
||||
foreach ($p in 'Domain','Private','Public') {
|
||||
Assert-Step 'Firewall' "$p profile disabled" {
|
||||
(Get-NetFirewallProfile -Profile $p -ErrorAction Stop).Enabled -eq $false
|
||||
}
|
||||
}
|
||||
|
||||
# ── Step 2: Disable Windows Defender & Antimalware ───────────────────────────
|
||||
Write-Step "Disabling Windows Defender & Antimalware"
|
||||
|
||||
# Disabled before WinRM config and Windows Update so that:
|
||||
# - WU downloads/installs are not scanned (saves 5-15 min on update-heavy runs)
|
||||
# - WinRM traffic is not intercepted by network inspection
|
||||
# On an isolated CI template VM this trade-off is acceptable.
|
||||
$defSvc = Get-Service -Name WinDefend -ErrorAction SilentlyContinue
|
||||
if ($defSvc) {
|
||||
Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue 3>$null
|
||||
Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue 3>$null
|
||||
Set-MpPreference -DisableIOAVProtection $true -ErrorAction SilentlyContinue 3>$null
|
||||
Set-MpPreference -DisableScriptScanning $true -ErrorAction SilentlyContinue 3>$null
|
||||
# Exclude CI build paths from any remaining scanning
|
||||
Add-MpPreference -ExclusionPath 'C:\CI' -ErrorAction SilentlyContinue 3>$null
|
||||
Add-MpPreference -ExclusionPath 'C:\dotnet' -ErrorAction SilentlyContinue 3>$null
|
||||
Add-MpPreference -ExclusionPath 'C:\Python' -ErrorAction SilentlyContinue 3>$null
|
||||
Write-Host "Windows Defender real-time protection disabled."
|
||||
}
|
||||
else {
|
||||
Write-Host "Windows Defender service not found — skipping."
|
||||
}
|
||||
|
||||
# Disable via Group Policy registry key — survives Defender auto-updates and reboots.
|
||||
# This is the same key that SCCM/GPO uses in enterprise environments.
|
||||
$defenderKey = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender'
|
||||
if (-not (Test-Path $defenderKey)) {
|
||||
New-Item -Path $defenderKey -Force | Out-Null
|
||||
}
|
||||
Set-ItemProperty -Path $defenderKey -Name 'DisableAntiSpyware' -Value 1 -Type DWord -Force
|
||||
Set-ItemProperty -Path $defenderKey -Name 'DisableAntiVirus' -Value 1 -Type DWord -Force
|
||||
# Also disable via the Windows Security Center policy subkey
|
||||
$rtKey = "$defenderKey\Real-Time Protection"
|
||||
if (-not (Test-Path $rtKey)) {
|
||||
New-Item -Path $rtKey -Force | Out-Null
|
||||
}
|
||||
Set-ItemProperty -Path $rtKey -Name 'DisableRealtimeMonitoring' -Value 1 -Type DWord -Force
|
||||
Set-ItemProperty -Path $rtKey -Name 'DisableBehaviorMonitoring' -Value 1 -Type DWord -Force
|
||||
Set-ItemProperty -Path $rtKey -Name 'DisableIOAVProtection' -Value 1 -Type DWord -Force
|
||||
Set-ItemProperty -Path $rtKey -Name 'DisableScriptScanning' -Value 1 -Type DWord -Force
|
||||
Write-Host "Defender GPO registry keys written (persistent across updates)."
|
||||
|
||||
# Validation — GPO registry keys (always applicable, survives Defender presence)
|
||||
Assert-Step 'Defender' "GPO DisableAntiSpyware=1" {
|
||||
(Get-ItemProperty -Path $defenderKey -Name DisableAntiSpyware -ErrorAction Stop).DisableAntiSpyware -eq 1
|
||||
}
|
||||
Assert-Step 'Defender' "GPO DisableAntiVirus=1" {
|
||||
(Get-ItemProperty -Path $defenderKey -Name DisableAntiVirus -ErrorAction Stop).DisableAntiVirus -eq 1
|
||||
}
|
||||
foreach ($rtName in 'DisableRealtimeMonitoring','DisableBehaviorMonitoring','DisableIOAVProtection','DisableScriptScanning') {
|
||||
Assert-Step 'Defender' "GPO Real-Time Protection $rtName=1" {
|
||||
(Get-ItemProperty -Path $rtKey -Name $rtName -ErrorAction Stop).$rtName -eq 1
|
||||
}
|
||||
}
|
||||
# Validation — Defender preferences (only if service exists)
|
||||
if ($defSvc) {
|
||||
$mp = Get-MpPreference -ErrorAction SilentlyContinue
|
||||
if ($mp) {
|
||||
Assert-Step 'Defender' 'Set-MpPreference DisableRealtimeMonitoring=true' { $mp.DisableRealtimeMonitoring }
|
||||
Assert-Step 'Defender' "ExclusionPath contains 'C:\CI'" { $mp.ExclusionPath -contains 'C:\CI' }
|
||||
}
|
||||
}
|
||||
|
||||
# ── Step 3: WinRM ─────────────────────────────────────────────────────────────
|
||||
Write-Step "Configuring WinRM"
|
||||
|
||||
# Firewall and Defender already off — no interference during WinRM hardening.
|
||||
Enable-PSRemoting -Force -SkipNetworkProfileCheck 3>$null | Out-Null
|
||||
|
||||
# Allow unencrypted (HTTP/5985) — acceptable for an isolated lab network.
|
||||
# Migrate to HTTPS/5986 with a self-signed cert for hardened environments.
|
||||
winrm set winrm/config/service '@{AllowUnencrypted="true"}' | Out-Null
|
||||
winrm set winrm/config/service/auth '@{Basic="true"}' | Out-Null
|
||||
|
||||
# Increase shell memory and timeout limits for long builds
|
||||
winrm set winrm/config/winrs '@{MaxProcessesPerShell="25"}' | Out-Null
|
||||
Set-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB 2048 -Force 3>$null
|
||||
Set-Item WSMan:\localhost\Shell\IdleTimeOut 7200000 -Force 3>$null # 2 hours
|
||||
|
||||
# Ensure WinRM starts automatically
|
||||
Set-Service -Name WinRM -StartupType Automatic 3>$null
|
||||
Start-Service WinRM 3>$null
|
||||
|
||||
Write-Host "WinRM configured."
|
||||
|
||||
# Validation
|
||||
Assert-Step 'WinRM' 'service Running' {
|
||||
(Get-Service WinRM -ErrorAction Stop).Status -eq 'Running'
|
||||
}
|
||||
Assert-Step 'WinRM' 'service StartType Automatic' {
|
||||
(Get-Service WinRM -ErrorAction Stop).StartType -eq 'Automatic'
|
||||
}
|
||||
Assert-Step 'WinRM' 'AllowUnencrypted=true' {
|
||||
(Get-Item WSMan:\localhost\Service\AllowUnencrypted).Value -eq 'true'
|
||||
}
|
||||
Assert-Step 'WinRM' 'Auth/Basic=true' {
|
||||
(Get-Item WSMan:\localhost\Service\Auth\Basic).Value -eq 'true'
|
||||
}
|
||||
Assert-Step 'WinRM' 'MaxMemoryPerShellMB >= 2048' {
|
||||
[int](Get-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB).Value -ge 2048
|
||||
}
|
||||
|
||||
# ── Step 4: Build user account ───────────────────────────────────────────────
|
||||
Write-Step "Creating build user account: $BuildUsername"
|
||||
|
||||
$existingUser = Get-LocalUser -Name $BuildUsername -ErrorAction SilentlyContinue
|
||||
if ($existingUser) {
|
||||
Write-Host "User '$BuildUsername' already exists — skipping creation."
|
||||
}
|
||||
else {
|
||||
# Convert to SecureString locally (inside the VM session) to avoid exposing
|
||||
# the password as a process argument visible in audit log event 4688.
|
||||
$secPwd = ConvertTo-SecureString $BuildPassword -AsPlainText -Force
|
||||
try {
|
||||
New-LocalUser -Name $BuildUsername -Password $secPwd `
|
||||
-PasswordNeverExpires -Description 'CI build account' `
|
||||
-ErrorAction Stop | Out-Null
|
||||
}
|
||||
catch {
|
||||
throw "Failed to create user '$BuildUsername': $_"
|
||||
}
|
||||
Write-Host "User '$BuildUsername' created."
|
||||
}
|
||||
|
||||
# Always ensure password policy and Administrators membership (idempotent)
|
||||
& net user $BuildUsername /passwordchg:no | Out-Null
|
||||
Set-LocalUser -Name $BuildUsername -PasswordNeverExpires $true
|
||||
|
||||
$isMember = & net localgroup Administrators 2>&1 | Select-String -SimpleMatch $BuildUsername
|
||||
if (-not $isMember) {
|
||||
& net localgroup Administrators $BuildUsername /add | Out-Null
|
||||
Write-Host "User '$BuildUsername' added to Administrators."
|
||||
}
|
||||
else {
|
||||
Write-Host "User '$BuildUsername' already in Administrators."
|
||||
}
|
||||
|
||||
# Validation
|
||||
Assert-Step 'User' "user '$BuildUsername' exists" {
|
||||
[bool](Get-LocalUser -Name $BuildUsername -ErrorAction SilentlyContinue)
|
||||
}
|
||||
Assert-Step 'User' "user '$BuildUsername' enabled" {
|
||||
(Get-LocalUser -Name $BuildUsername -ErrorAction Stop).Enabled
|
||||
}
|
||||
Assert-Step 'User' "user '$BuildUsername' password never expires" {
|
||||
# Property name varies across LocalAccounts module versions:
|
||||
# - Newer (Server 2022+, some SKUs): bool 'PasswordNeverExpires'
|
||||
# - Older / WS2025 PS 5.1: nullable datetime 'PasswordExpires' ($null = never)
|
||||
$u = Get-LocalUser -Name $BuildUsername -ErrorAction Stop
|
||||
$hasFlag = $u.PSObject.Properties.Name -contains 'PasswordNeverExpires'
|
||||
if ($hasFlag) { [bool]$u.PasswordNeverExpires } else { $null -eq $u.PasswordExpires }
|
||||
}
|
||||
Assert-Step 'User' "user '$BuildUsername' member of Administrators" {
|
||||
[bool](& net localgroup Administrators 2>&1 | Select-String -SimpleMatch $BuildUsername)
|
||||
}
|
||||
|
||||
# ── Step 4b: Disable UAC ─────────────────────────────────────────────────────
|
||||
Write-Step "Disabling UAC (isolated lab VM)"
|
||||
|
||||
# EnableLUA=0 disables UAC entirely — admin processes get full token without prompt.
|
||||
# LocalAccountTokenFilterPolicy=1 ensures remote admin connections (WinRM) also
|
||||
# get an elevated token (avoids the filtered-token issue with runProgramInGuest).
|
||||
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' `
|
||||
-Name EnableLUA -Value 0 -Type DWord -Force
|
||||
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' `
|
||||
-Name LocalAccountTokenFilterPolicy -Value 1 -Type DWord -Force
|
||||
Write-Host "UAC disabled."
|
||||
|
||||
# Validation
|
||||
$uacPolicyKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
|
||||
Assert-Step 'UAC' 'EnableLUA=0' {
|
||||
(Get-ItemProperty -Path $uacPolicyKey -Name EnableLUA -ErrorAction Stop).EnableLUA -eq 0
|
||||
}
|
||||
Assert-Step 'UAC' 'LocalAccountTokenFilterPolicy=1' {
|
||||
(Get-ItemProperty -Path $uacPolicyKey -Name LocalAccountTokenFilterPolicy -ErrorAction Stop).LocalAccountTokenFilterPolicy -eq 1
|
||||
}
|
||||
|
||||
# ── Step 5: CI working directories ───────────────────────────────────────────
|
||||
Write-Step "Creating CI working directories"
|
||||
|
||||
# Must run before Windows Update (Step 6): the WU worker script writes temp files
|
||||
# to C:\CI\ (wu_worker.ps1, wu_result.txt, wu_reboot.txt, wu_log.txt).
|
||||
$ciDirs = @('C:\CI\build', 'C:\CI\output', 'C:\CI\scripts')
|
||||
foreach ($dir in $ciDirs) {
|
||||
if (-not (Test-Path $dir)) {
|
||||
New-Item -ItemType Directory -Path $dir -Force | Out-Null
|
||||
Write-Host "Created: $dir"
|
||||
}
|
||||
}
|
||||
|
||||
# Validation
|
||||
foreach ($dir in $ciDirs) {
|
||||
Assert-Step 'CIDirs' "$dir exists (Container)" {
|
||||
Test-Path -Path $dir -PathType Container
|
||||
}
|
||||
}
|
||||
|
||||
# ── Step 5b: Explorer settings ───────────────────────────────────────────────
|
||||
Write-Step "Configuring Explorer defaults"
|
||||
|
||||
# Open Explorer to 'This PC' (Devices and Drives) instead of Quick Access.
|
||||
# LaunchTo=1 = This PC, LaunchTo=2 = Quick Access (default)
|
||||
$explorerAdvKey = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced'
|
||||
Set-ItemProperty -Path $explorerAdvKey -Name 'LaunchTo' -Value 1 -Type DWord -Force
|
||||
|
||||
# Also apply to the Default User profile so ci_build and any new user inherits it.
|
||||
$defaultHive = 'C:\Users\Default\NTUSER.DAT'
|
||||
$mountName = 'TempDefaultUser'
|
||||
if (Test-Path $defaultHive) {
|
||||
reg load "HKU\$mountName" $defaultHive | Out-Null
|
||||
$defKey = "Registry::HKU\$mountName\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
|
||||
if (-not (Test-Path $defKey)) { New-Item -Path $defKey -Force | Out-Null }
|
||||
Set-ItemProperty -Path $defKey -Name 'LaunchTo' -Value 1 -Type DWord -Force
|
||||
[gc]::Collect()
|
||||
reg unload "HKU\$mountName" | Out-Null
|
||||
Write-Host "Explorer: 'This PC' set for current user and default profile."
|
||||
}
|
||||
else {
|
||||
Write-Host "Explorer: 'This PC' set for current user (default hive not found)."
|
||||
}
|
||||
|
||||
# Validation
|
||||
Assert-Step 'Explorer' "LaunchTo=1 (HKCU current user)" {
|
||||
(Get-ItemProperty -Path $explorerAdvKey -Name LaunchTo -ErrorAction Stop).LaunchTo -eq 1
|
||||
}
|
||||
|
||||
# ── Step 5c: CI UX hardening ─────────────────────────────────────────────────
|
||||
Write-Step "CI UX hardening (lock screen off, Server Manager off, no CAD, no OOBE)"
|
||||
|
||||
# All UI tweaks batched here — fast registry writes before the slow WU step.
|
||||
|
||||
# 1 — Lock screen: disable entirely (CI VMs never need a lock screen)
|
||||
# NoLockScreen=1 suppresses the lock screen shown before login on console sessions.
|
||||
$personPolicyKey = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization'
|
||||
if (-not (Test-Path $personPolicyKey)) { New-Item -Path $personPolicyKey -Force | Out-Null }
|
||||
Set-ItemProperty -Path $personPolicyKey -Name 'NoLockScreen' -Value 1 -Type DWord -Force
|
||||
Write-Host "Lock screen disabled."
|
||||
|
||||
# 2 — Server Manager: do not auto-open at logon
|
||||
# Three layers needed on WS2025:
|
||||
# a) Machine policy key (GPO path — read by ServerManager policy check)
|
||||
# b) HKLM non-policy key (read directly by ServerManager.exe on WS2025)
|
||||
# c) Scheduled Task '\Microsoft\Windows\Server Manager\ServerManager'
|
||||
# — this is the actual launcher; registry alone is insufficient on WS2025
|
||||
# d) HKCU + Default hive for per-user belt-and-suspenders
|
||||
$smPolicyKey = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\ServerManager'
|
||||
if (-not (Test-Path $smPolicyKey)) { New-Item -Path $smPolicyKey -Force | Out-Null }
|
||||
Set-ItemProperty -Path $smPolicyKey -Name 'DoNotOpenAtLogon' -Value 1 -Type DWord -Force
|
||||
|
||||
$smHKLMKey = 'HKLM:\SOFTWARE\Microsoft\ServerManager'
|
||||
if (-not (Test-Path $smHKLMKey)) { New-Item -Path $smHKLMKey -Force | Out-Null }
|
||||
Set-ItemProperty -Path $smHKLMKey -Name 'DoNotOpenServerManagerAtLogon' -Value 1 -Type DWord -Force
|
||||
|
||||
Disable-ScheduledTask -TaskPath '\Microsoft\Windows\Server Manager\' `
|
||||
-TaskName 'ServerManager' -ErrorAction SilentlyContinue | Out-Null
|
||||
|
||||
# Current session user (Administrator)
|
||||
$smUserKey = 'HKCU:\SOFTWARE\Microsoft\ServerManager'
|
||||
if (-not (Test-Path $smUserKey)) { New-Item -Path $smUserKey -Force | Out-Null }
|
||||
Set-ItemProperty -Path $smUserKey -Name 'DoNotOpenServerManagerAtLogon' -Value 1 -Type DWord -Force
|
||||
|
||||
# Default User hive — ci_build and any future account inherits at first logon
|
||||
$smDefaultHive = 'C:\Users\Default\NTUSER.DAT'
|
||||
$smMountName = 'TempDefaultUserSM'
|
||||
if (Test-Path $smDefaultHive) {
|
||||
reg load "HKU\$smMountName" $smDefaultHive | Out-Null
|
||||
$smDefKey = "Registry::HKU\$smMountName\SOFTWARE\Microsoft\ServerManager"
|
||||
if (-not (Test-Path $smDefKey)) { New-Item -Path $smDefKey -Force | Out-Null }
|
||||
Set-ItemProperty -Path $smDefKey -Name 'DoNotOpenServerManagerAtLogon' -Value 1 -Type DWord -Force
|
||||
[gc]::Collect()
|
||||
reg unload "HKU\$smMountName" | Out-Null
|
||||
Write-Host "Server Manager: policy + HKLM + task + Administrator HKCU + Default hive set."
|
||||
}
|
||||
else {
|
||||
Write-Host "Server Manager: policy + HKLM + task + Administrator HKCU set (Default hive not found)."
|
||||
}
|
||||
|
||||
# 3 — Disable Ctrl+Alt+Del at interactive login
|
||||
# Set in both locations: Winlogon (classic) + Policies\System (policy, authoritative on WS2025).
|
||||
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' `
|
||||
-Name 'DisableCAD' -Value 1 -Type DWord -Force
|
||||
$systemPolicyKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
|
||||
Set-ItemProperty -Path $systemPolicyKey -Name 'DisableCAD' -Value 1 -Type DWord -Force
|
||||
Write-Host "Ctrl+Alt+Del at login disabled (Winlogon + Policies\System)."
|
||||
|
||||
# 4 — Suppress OOBE privacy/telemetry prompt
|
||||
$oobePolicyKey = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\OOBE'
|
||||
if (-not (Test-Path $oobePolicyKey)) { New-Item -Path $oobePolicyKey -Force | Out-Null }
|
||||
Set-ItemProperty -Path $oobePolicyKey -Name 'DisablePrivacyExperience' -Value 1 -Type DWord -Force
|
||||
|
||||
$oobeKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE'
|
||||
if (-not (Test-Path $oobeKey)) { New-Item -Path $oobeKey -Force | Out-Null }
|
||||
Set-ItemProperty -Path $oobeKey -Name 'DisablePrivacyExperience' -Value 1 -Type DWord -Force
|
||||
|
||||
$dcKey = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection'
|
||||
if (-not (Test-Path $dcKey)) { New-Item -Path $dcKey -Force | Out-Null }
|
||||
Set-ItemProperty -Path $dcKey -Name 'AllowTelemetry' -Value 0 -Type DWord -Force
|
||||
Write-Host "OOBE privacy prompt and telemetry disabled."
|
||||
|
||||
# Validation
|
||||
Assert-Step 'CIUX' 'lock screen disabled (NoLockScreen=1)' {
|
||||
(Get-ItemProperty -Path $personPolicyKey -Name NoLockScreen -ErrorAction Stop).NoLockScreen -eq 1
|
||||
}
|
||||
Assert-Step 'CIUX' 'Server Manager policy DoNotOpenAtLogon=1' {
|
||||
(Get-ItemProperty -Path $smPolicyKey -Name DoNotOpenAtLogon -ErrorAction Stop).DoNotOpenAtLogon -eq 1
|
||||
}
|
||||
Assert-Step 'CIUX' 'Server Manager HKLM DoNotOpenServerManagerAtLogon=1' {
|
||||
(Get-ItemProperty -Path $smHKLMKey -Name DoNotOpenServerManagerAtLogon -ErrorAction Stop).DoNotOpenServerManagerAtLogon -eq 1
|
||||
}
|
||||
Assert-Step 'CIUX' 'Server Manager scheduled task disabled' {
|
||||
$t = Get-ScheduledTask -TaskPath '\Microsoft\Windows\Server Manager\' `
|
||||
-TaskName 'ServerManager' -ErrorAction SilentlyContinue
|
||||
(-not $t) -or ($t.State -eq 'Disabled')
|
||||
}
|
||||
Assert-Step 'CIUX' 'Server Manager HKCU DoNotOpenServerManagerAtLogon=1 (Administrator)' {
|
||||
(Get-ItemProperty -Path $smUserKey -Name DoNotOpenServerManagerAtLogon -ErrorAction Stop).DoNotOpenServerManagerAtLogon -eq 1
|
||||
}
|
||||
Assert-Step 'CIUX' 'DisableCAD=1 in Policies\System' {
|
||||
(Get-ItemProperty -Path $systemPolicyKey -Name DisableCAD -ErrorAction Stop).DisableCAD -eq 1
|
||||
}
|
||||
Assert-Step 'CIUX' 'OOBE policy DisablePrivacyExperience=1' {
|
||||
(Get-ItemProperty -Path $oobePolicyKey -Name DisablePrivacyExperience -ErrorAction Stop).DisablePrivacyExperience -eq 1
|
||||
}
|
||||
Assert-Step 'CIUX' 'DataCollection AllowTelemetry=0' {
|
||||
(Get-ItemProperty -Path $dcKey -Name AllowTelemetry -ErrorAction Stop).AllowTelemetry -eq 0
|
||||
}
|
||||
|
||||
# ── Step 6: Windows Update ────────────────────────────────────────────────────
|
||||
# Firewall + Defender already off: WU downloads and installs run without scanning.
|
||||
# C:\CI exists (Step 5): worker temp files write successfully.
|
||||
# NOTE: The Windows Update COM API (Microsoft.Update.Session) raises E_ACCESSDENIED
|
||||
# when called from a WinRM/network-logon session. We work around this by running
|
||||
# the actual download+install inside a Scheduled Task (SYSTEM account, full token).
|
||||
@@ -93,14 +540,18 @@ $ErrorActionPreference = 'Stop'
|
||||
try {
|
||||
$s = New-Object -ComObject Microsoft.Update.Session
|
||||
$q = $s.CreateUpdateSearcher()
|
||||
$found = $q.Search("IsInstalled=0 and Type='Software' and IsHidden=0")
|
||||
$q.Online = $true # force live query — skip stale client cache
|
||||
$q.ServerSelection = 2 # 2=ssWindowsUpdate — bypass WSUS, query WU servers directly
|
||||
$found = $q.Search("IsInstalled=0 and Type='Software'")
|
||||
$count = $found.Updates.Count
|
||||
if ($count -eq 0) {
|
||||
"0" | Set-Content C:\CI\wu_result.txt
|
||||
"False" | Set-Content C:\CI\wu_reboot.txt
|
||||
"No updates needed." | Set-Content C:\CI\wu_log.txt
|
||||
"No updates needed (0 updates found by COM API)." | Set-Content C:\CI\wu_log.txt
|
||||
} else {
|
||||
"Downloading $count update(s)..." | Set-Content C:\CI\wu_log.txt
|
||||
$names = ($found.Updates | ForEach-Object { " - $($_.Title)" }) -join "`n"
|
||||
"Found $count update(s):`n$names" | Set-Content C:\CI\wu_log.txt
|
||||
"Downloading $count update(s)..." | Add-Content C:\CI\wu_log.txt
|
||||
$dl = $s.CreateUpdateDownloader()
|
||||
$dl.Updates = $found.Updates
|
||||
$dl.Download() | Out-Null
|
||||
@@ -108,8 +559,8 @@ try {
|
||||
$inst = $s.CreateUpdateInstaller()
|
||||
$inst.Updates = $found.Updates
|
||||
$r = $inst.Install()
|
||||
[string]$r.ResultCode | Set-Content C:\CI\wu_result.txt
|
||||
[string]$r.RebootRequired | Set-Content C:\CI\wu_reboot.txt
|
||||
[string]$r.ResultCode | Set-Content C:\CI\wu_result.txt
|
||||
[string]$r.RebootRequired | Set-Content C:\CI\wu_reboot.txt
|
||||
"Done. ResultCode=$($r.ResultCode) RebootRequired=$($r.RebootRequired)" | Add-Content C:\CI\wu_log.txt
|
||||
}
|
||||
} catch {
|
||||
@@ -120,6 +571,38 @@ try {
|
||||
'@
|
||||
$wuWorker | Set-Content -Path $wuWorkerPath -Encoding UTF8
|
||||
|
||||
# Re-enable WU fully before launching the COM API worker.
|
||||
# A previous run of this script (Step 6b) leaves: wuauserv=Disabled, UsoSvc=Disabled,
|
||||
# DisableWindowsUpdateAccess=1, stale DataStore metadata.
|
||||
# Microsoft.Update.Session.Search() silently returns 0 results if any of these are set.
|
||||
$wuPolicyKey = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate'
|
||||
$wuPolicyAUKey = "$wuPolicyKey\AU"
|
||||
|
||||
# Step A: clear GPO policy blocks
|
||||
Remove-ItemProperty -Path $wuPolicyKey -Name 'DisableWindowsUpdateAccess' -ErrorAction SilentlyContinue
|
||||
Remove-ItemProperty -Path $wuPolicyAUKey -Name 'NoAutoUpdate' -ErrorAction SilentlyContinue
|
||||
Remove-ItemProperty -Path $wuPolicyAUKey -Name 'AUOptions' -ErrorAction SilentlyContinue
|
||||
|
||||
# Step B: stop WU-adjacent services cleanly before resetting state
|
||||
foreach ($svc in 'wuauserv', 'UsoSvc', 'bits') {
|
||||
Stop-Service -Name $svc -Force -ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
# Step C: delete WU client database — forces fresh online detection on next start.
|
||||
# Without this, the COM API reuses stale cached metadata from the previous run
|
||||
# and reports 0 available updates even when updates exist.
|
||||
Remove-Item 'C:\Windows\SoftwareDistribution\DataStore\*' -Recurse -Force -ErrorAction SilentlyContinue
|
||||
|
||||
# Step D: re-enable and start all services the COM API depends on
|
||||
foreach ($svc in 'cryptsvc', 'bits', 'wuauserv', 'UsoSvc') {
|
||||
Set-Service -Name $svc -StartupType Manual -ErrorAction SilentlyContinue
|
||||
Start-Service -Name $svc -ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
# Step E: wait for WU service to fully initialize and build fresh DataStore
|
||||
Start-Sleep -Seconds 20
|
||||
Write-Host "Windows Update services started. DataStore reset. GPO blocks cleared."
|
||||
|
||||
# Remove any leftover result files from a previous run
|
||||
Remove-Item $wuResultPath, $wuRebootPath -ErrorAction SilentlyContinue
|
||||
|
||||
@@ -175,160 +658,58 @@ try {
|
||||
}
|
||||
}
|
||||
|
||||
# ── Step 6b: Disable Windows Update permanently (post-update lockdown) ───────
|
||||
Write-Step "Disabling Windows Update permanently (post-update snapshot lockdown)"
|
||||
|
||||
# ── Step 1: WinRM ─────────────────────────────────────────────────────────────
|
||||
Write-Step "Configuring WinRM"
|
||||
# WU has completed (or was skipped via -SkipWindowsUpdate). Disable now so that
|
||||
# every linked clone spawned from the BaseClean snapshot never triggers background
|
||||
# updates, spurious reboots, or download lock contention on the shared NVMe.
|
||||
|
||||
Enable-PSRemoting -Force -SkipNetworkProfileCheck 3>$null | Out-Null
|
||||
# Stop + disable main WU service
|
||||
Stop-Service -Name wuauserv -Force -ErrorAction SilentlyContinue
|
||||
Set-Service -Name wuauserv -StartupType Disabled
|
||||
|
||||
# Allow unencrypted (HTTP/5985) — acceptable for an isolated lab network.
|
||||
# Migrate to HTTPS/5986 with a self-signed cert for hardened environments.
|
||||
winrm set winrm/config/service '@{AllowUnencrypted="true"}' | Out-Null
|
||||
winrm set winrm/config/service/auth '@{Basic="true"}' | Out-Null
|
||||
# Stop + disable Update Orchestrator Service (UsoSvc) — WU client in Server 2025
|
||||
Stop-Service -Name UsoSvc -Force -ErrorAction SilentlyContinue
|
||||
Set-Service -Name UsoSvc -StartupType Disabled -ErrorAction SilentlyContinue
|
||||
|
||||
# Increase shell memory and timeout limits for long builds
|
||||
winrm set winrm/config/winrs '@{MaxProcessesPerShell="25"}' | Out-Null
|
||||
Set-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB 2048 -Force 3>$null
|
||||
Set-Item WSMan:\localhost\Shell\IdleTimeOut 7200000 -Force 3>$null # 2 hours
|
||||
Write-Host "wuauserv and UsoSvc set to Disabled."
|
||||
|
||||
# Ensure WinRM starts automatically
|
||||
Set-Service -Name WinRM -StartupType Automatic 3>$null
|
||||
Start-Service WinRM 3>$null
|
||||
# GPO registry keys — survive service self-healing and future WU self-repair attempts
|
||||
$wuKey = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate'
|
||||
$wuAUKey = "$wuKey\AU"
|
||||
if (-not (Test-Path $wuKey)) { New-Item -Path $wuKey -Force | Out-Null }
|
||||
if (-not (Test-Path $wuAUKey)) { New-Item -Path $wuAUKey -Force | Out-Null }
|
||||
|
||||
Write-Host "WinRM configured."
|
||||
# Block WU API + UI access entirely
|
||||
Set-ItemProperty -Path $wuKey -Name 'DisableWindowsUpdateAccess' -Value 1 -Type DWord -Force
|
||||
# AutoUpdate policy: AUOptions=1 = disabled; NoAutoUpdate=1 = no background check
|
||||
Set-ItemProperty -Path $wuAUKey -Name 'NoAutoUpdate' -Value 1 -Type DWord -Force
|
||||
Set-ItemProperty -Path $wuAUKey -Name 'AUOptions' -Value 1 -Type DWord -Force
|
||||
|
||||
# ── Step 2: Firewall ──────────────────────────────────────────────────────────
|
||||
Write-Step "Disabling Windows Firewall (all profiles) — isolated lab VM"
|
||||
Write-Host "Windows Update GPO policy keys written."
|
||||
|
||||
# Disable all firewall profiles entirely. This VM lives on VMnet8 NAT behind
|
||||
# the VMware NAT gateway with no inbound exposure from outside the host, so
|
||||
# full disable is acceptable and avoids profile-classification issues blocking
|
||||
# WinRM/ICMP from the host.
|
||||
Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled False
|
||||
Write-Host "Windows Firewall disabled on all profiles."
|
||||
|
||||
# ── Step 3: Build user account ────────────────────────────────────────────────
|
||||
Write-Step "Creating build user account: $BuildUsername"
|
||||
|
||||
$existingUser = Get-LocalUser -Name $BuildUsername -ErrorAction SilentlyContinue
|
||||
if ($existingUser) {
|
||||
Write-Host "User '$BuildUsername' already exists — skipping creation."
|
||||
# Disable WU scheduled tasks (best-effort — some may not exist on every SKU)
|
||||
$wuTaskPath = '\Microsoft\Windows\WindowsUpdate\'
|
||||
foreach ($taskName in @('Scheduled Start', 'WakeTimer', 'Automatic App Update',
|
||||
'sih', 'sihboot', 'USO_UxBroker')) {
|
||||
Disable-ScheduledTask -TaskPath $wuTaskPath -TaskName $taskName `
|
||||
-ErrorAction SilentlyContinue | Out-Null
|
||||
}
|
||||
else {
|
||||
# Convert to SecureString locally (inside the VM session) to avoid exposing
|
||||
# the password as a process argument visible in audit log event 4688.
|
||||
$secPwd = ConvertTo-SecureString $BuildPassword -AsPlainText -Force
|
||||
try {
|
||||
New-LocalUser -Name $BuildUsername -Password $secPwd `
|
||||
-PasswordNeverExpires -Description 'CI build account' `
|
||||
-ErrorAction Stop | Out-Null
|
||||
}
|
||||
catch {
|
||||
throw "Failed to create user '$BuildUsername': $_"
|
||||
}
|
||||
Write-Host "User '$BuildUsername' created."
|
||||
Write-Host "Windows Update scheduled tasks disabled (best-effort)."
|
||||
|
||||
# Validation
|
||||
Assert-Step 'WUDisable' 'wuauserv StartType Disabled' {
|
||||
(Get-Service wuauserv -ErrorAction Stop).StartType -eq 'Disabled'
|
||||
}
|
||||
Assert-Step 'WUDisable' 'NoAutoUpdate=1 GPO key' {
|
||||
(Get-ItemProperty -Path $wuAUKey -Name NoAutoUpdate -ErrorAction Stop).NoAutoUpdate -eq 1
|
||||
}
|
||||
Assert-Step 'WUDisable' 'DisableWindowsUpdateAccess=1 GPO key' {
|
||||
(Get-ItemProperty -Path $wuKey -Name DisableWindowsUpdateAccess -ErrorAction Stop).DisableWindowsUpdateAccess -eq 1
|
||||
}
|
||||
|
||||
# Always ensure password policy and Administrators membership (idempotent)
|
||||
& net user $BuildUsername /passwordchg:no | Out-Null
|
||||
Set-LocalUser -Name $BuildUsername -PasswordNeverExpires $true
|
||||
|
||||
$isMember = & net localgroup Administrators 2>&1 | Select-String -SimpleMatch $BuildUsername
|
||||
if (-not $isMember) {
|
||||
& net localgroup Administrators $BuildUsername /add | Out-Null
|
||||
Write-Host "User '$BuildUsername' added to Administrators."
|
||||
}
|
||||
else {
|
||||
Write-Host "User '$BuildUsername' already in Administrators."
|
||||
}
|
||||
|
||||
# ── Step 3b: Disable UAC ──────────────────────────────────────────────────────
|
||||
Write-Step "Disabling UAC (isolated lab VM)"
|
||||
|
||||
# EnableLUA=0 disables UAC entirely — admin processes get full token without prompt.
|
||||
# LocalAccountTokenFilterPolicy=1 ensures remote admin connections (WinRM) also
|
||||
# get an elevated token (avoids the filtered-token issue with runProgramInGuest).
|
||||
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' `
|
||||
-Name EnableLUA -Value 0 -Type DWord -Force
|
||||
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' `
|
||||
-Name LocalAccountTokenFilterPolicy -Value 1 -Type DWord -Force
|
||||
Write-Host "UAC disabled."
|
||||
|
||||
# ── Step 4: CI working directories ───────────────────────────────────────────
|
||||
Write-Step "Creating CI working directories"
|
||||
|
||||
foreach ($dir in @('C:\CI\build', 'C:\CI\output', 'C:\CI\scripts')) {
|
||||
if (-not (Test-Path $dir)) {
|
||||
New-Item -ItemType Directory -Path $dir -Force | Out-Null
|
||||
Write-Host "Created: $dir"
|
||||
}
|
||||
}
|
||||
|
||||
# ── Step 4b: Explorer settings ───────────────────────────────────────────────
|
||||
Write-Step "Configuring Explorer defaults"
|
||||
|
||||
# Open Explorer to 'This PC' (Devices and Drives) instead of Quick Access.
|
||||
# LaunchTo=1 = This PC, LaunchTo=2 = Quick Access (default)
|
||||
$explorerAdvKey = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced'
|
||||
Set-ItemProperty -Path $explorerAdvKey -Name 'LaunchTo' -Value 1 -Type DWord -Force
|
||||
|
||||
# Also apply to the Default User profile so ci_build and any new user inherits it.
|
||||
$defaultHive = 'C:\Users\Default\NTUSER.DAT'
|
||||
$mountName = 'TempDefaultUser'
|
||||
if (Test-Path $defaultHive) {
|
||||
reg load "HKU\$mountName" $defaultHive | Out-Null
|
||||
$defKey = "Registry::HKU\$mountName\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
|
||||
if (-not (Test-Path $defKey)) { New-Item -Path $defKey -Force | Out-Null }
|
||||
Set-ItemProperty -Path $defKey -Name 'LaunchTo' -Value 1 -Type DWord -Force
|
||||
[gc]::Collect()
|
||||
reg unload "HKU\$mountName" | Out-Null
|
||||
Write-Host "Explorer: 'This PC' set for current user and default profile."
|
||||
}
|
||||
else {
|
||||
Write-Host "Explorer: 'This PC' set for current user (default hive not found)."
|
||||
}
|
||||
|
||||
# ── Step 5: Disable Windows Defender ────────────────────────────────────────
|
||||
Write-Step "Disabling Windows Defender real-time protection"
|
||||
|
||||
# Defender scanning significantly slows compilation and NuGet restore.
|
||||
# On an isolated CI template VM this trade-off is acceptable.
|
||||
$defSvc = Get-Service -Name WinDefend -ErrorAction SilentlyContinue
|
||||
if ($defSvc) {
|
||||
Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue 3>$null
|
||||
Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue 3>$null
|
||||
Set-MpPreference -DisableIOAVProtection $true -ErrorAction SilentlyContinue 3>$null
|
||||
Set-MpPreference -DisableScriptScanning $true -ErrorAction SilentlyContinue 3>$null
|
||||
# Exclude CI build paths from any remaining scanning
|
||||
Add-MpPreference -ExclusionPath 'C:\CI' -ErrorAction SilentlyContinue 3>$null
|
||||
Add-MpPreference -ExclusionPath 'C:\dotnet' -ErrorAction SilentlyContinue 3>$null
|
||||
Add-MpPreference -ExclusionPath 'C:\Python' -ErrorAction SilentlyContinue 3>$null
|
||||
Write-Host "Windows Defender real-time protection disabled."
|
||||
}
|
||||
else {
|
||||
Write-Host "Windows Defender service not found — skipping."
|
||||
}
|
||||
|
||||
# Disable via Group Policy registry key — survives Defender auto-updates and reboots.
|
||||
# This is the same key that SCCM/GPO uses in enterprise environments.
|
||||
$defenderKey = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender'
|
||||
if (-not (Test-Path $defenderKey)) {
|
||||
New-Item -Path $defenderKey -Force | Out-Null
|
||||
}
|
||||
Set-ItemProperty -Path $defenderKey -Name 'DisableAntiSpyware' -Value 1 -Type DWord -Force
|
||||
Set-ItemProperty -Path $defenderKey -Name 'DisableAntiVirus' -Value 1 -Type DWord -Force
|
||||
# Also disable via the Windows Security Center policy subkey
|
||||
$rtKey = "$defenderKey\Real-Time Protection"
|
||||
if (-not (Test-Path $rtKey)) {
|
||||
New-Item -Path $rtKey -Force | Out-Null
|
||||
}
|
||||
Set-ItemProperty -Path $rtKey -Name 'DisableRealtimeMonitoring' -Value 1 -Type DWord -Force
|
||||
Set-ItemProperty -Path $rtKey -Name 'DisableBehaviorMonitoring' -Value 1 -Type DWord -Force
|
||||
Set-ItemProperty -Path $rtKey -Name 'DisableIOAVProtection' -Value 1 -Type DWord -Force
|
||||
Set-ItemProperty -Path $rtKey -Name 'DisableScriptScanning' -Value 1 -Type DWord -Force
|
||||
Write-Host "Defender GPO registry keys written (persistent across updates)."
|
||||
|
||||
# ── Step 6: Install .NET SDK ─────────────────────────────────────────────────
|
||||
# ── Step 7: Install .NET SDK ──────────────────────────────────────────────────
|
||||
Write-Step "Installing .NET SDK $DotNetSdkVersion"
|
||||
|
||||
$dotnetInstalled = Get-Command dotnet -ErrorAction SilentlyContinue
|
||||
@@ -362,7 +743,20 @@ else {
|
||||
Write-Host ".NET SDK installed: $(dotnet --version)"
|
||||
}
|
||||
|
||||
# ── Step 7: Install Python ───────────────────────────────────────────────────
|
||||
# Validation
|
||||
Assert-Step 'DotNet' 'dotnet command resolvable' {
|
||||
[bool](Get-Command dotnet -ErrorAction SilentlyContinue)
|
||||
}
|
||||
Assert-Step 'DotNet' "SDK version starts with channel '$DotNetSdkVersion'" {
|
||||
$v = (& dotnet --version 2>&1 | Select-Object -First 1).ToString().Trim()
|
||||
$major = $DotNetSdkVersion.Split('.')[0]
|
||||
$v.StartsWith("$major.")
|
||||
}
|
||||
Assert-Step 'DotNet' 'machine PATH contains C:\dotnet' {
|
||||
[System.Environment]::GetEnvironmentVariable('PATH', 'Machine') -like '*C:\dotnet*'
|
||||
}
|
||||
|
||||
# ── Step 8: Install Python ───────────────────────────────────────────────────
|
||||
Write-Step "Installing Python $PythonVersion"
|
||||
|
||||
$pythonExe = 'C:\Python\python.exe'
|
||||
@@ -398,7 +792,21 @@ else {
|
||||
Write-Host "Python installed: $(python --version 2>&1)"
|
||||
}
|
||||
|
||||
# ── Step 8: Install Visual Studio Build Tools 2022 ───────────────────────────
|
||||
# Validation
|
||||
Assert-Step 'Python' 'C:\Python\python.exe present' {
|
||||
Test-Path 'C:\Python\python.exe' -PathType Leaf
|
||||
}
|
||||
Assert-Step 'Python' "version equals $PythonVersion" {
|
||||
$v = (& 'C:\Python\python.exe' --version 2>&1 | Select-Object -First 1).ToString().Trim()
|
||||
$v -match [regex]::Escape($PythonVersion)
|
||||
}
|
||||
Assert-Step 'Python' 'PATH contains C:\Python (machine or user)' {
|
||||
$combined = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
|
||||
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
|
||||
$combined -like '*C:\Python*'
|
||||
}
|
||||
|
||||
# ── Step 9: Install Visual Studio Build Tools 2026 ───────────────────────────
|
||||
Write-Step "Installing Visual Studio Build Tools 2026"
|
||||
|
||||
$msbuildPath = 'C:\Program Files (x86)\Microsoft Visual Studio\2026\BuildTools\MSBuild\Current\Bin\MSBuild.exe'
|
||||
@@ -513,7 +921,22 @@ if ($currentPath -notlike "*$msbuildDir*") {
|
||||
Write-Host "MSBuild added to system PATH."
|
||||
}
|
||||
|
||||
# ── Step 9: Verify toolchain ───────────────────────────────────────────────
|
||||
# Validation
|
||||
Assert-Step 'VSBuildTools' "MSBuild.exe exists at expected path" {
|
||||
Test-Path -Path $msbuildPath -PathType Leaf
|
||||
}
|
||||
Assert-Step 'VSBuildTools' 'MSBuild executes and reports version' {
|
||||
$out = & $msbuildPath -version 2>&1 | Select-Object -Last 1
|
||||
$out -match '^\d+\.\d+'
|
||||
}
|
||||
Assert-Step 'VSBuildTools' 'machine PATH contains MSBuild dir' {
|
||||
[System.Environment]::GetEnvironmentVariable('PATH', 'Machine') -like "*$msbuildDir*"
|
||||
}
|
||||
Assert-Step 'VSBuildTools' 'VC tools install dir present' {
|
||||
Test-Path 'C:\Program Files (x86)\Microsoft Visual Studio\2026\BuildTools\VC' -PathType Container
|
||||
}
|
||||
|
||||
# ── Step 10: Verify toolchain ─────────────────────────────────────────────────
|
||||
Write-Step "Verifying toolchain"
|
||||
|
||||
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
|
||||
@@ -536,9 +959,9 @@ function Resolve-Tool {
|
||||
$dotnetBin = Resolve-Tool '' 'dotnet'
|
||||
if ($dotnetBin) {
|
||||
$v = & $dotnetBin --version 2>&1 | Select-Object -First 1
|
||||
Write-Host " [OK] dotnet: $v ($dotnetBin)"
|
||||
Write-Host " [OK] dotnet: $v ($dotnetBin)" -ForegroundColor Green
|
||||
} else {
|
||||
Write-Warning " [FAIL] dotnet not found"
|
||||
Write-Host " [FAIL] dotnet not found" -ForegroundColor Red
|
||||
$allOk = $false
|
||||
}
|
||||
|
||||
@@ -546,9 +969,9 @@ if ($dotnetBin) {
|
||||
$pythonBin = Resolve-Tool 'C:\Python\python.exe' 'python'
|
||||
if ($pythonBin) {
|
||||
$v = & $pythonBin --version 2>&1 | Select-Object -First 1
|
||||
Write-Host " [OK] python: $v ($pythonBin)"
|
||||
Write-Host " [OK] python: $v ($pythonBin)" -ForegroundColor Green
|
||||
} else {
|
||||
Write-Warning " [FAIL] python not found"
|
||||
Write-Host " [FAIL] python not found" -ForegroundColor Red
|
||||
$allOk = $false
|
||||
}
|
||||
|
||||
@@ -556,17 +979,22 @@ if ($pythonBin) {
|
||||
$msbuildBin = Resolve-Tool $msbuildPath 'msbuild'
|
||||
if ($msbuildBin) {
|
||||
$v = & $msbuildBin -version 2>&1 | Select-Object -First 1
|
||||
Write-Host " [OK] msbuild: $v ($msbuildBin)"
|
||||
Write-Host " [OK] msbuild: $v ($msbuildBin)" -ForegroundColor Green
|
||||
} else {
|
||||
Write-Warning " [FAIL] msbuild not found at '$msbuildPath' and not in PATH"
|
||||
Write-Host " [FAIL] msbuild not found at '$msbuildPath' and not in PATH" -ForegroundColor Red
|
||||
$allOk = $false
|
||||
}
|
||||
|
||||
if (-not $allOk) {
|
||||
Write-Warning "Some tools failed verification. Review above and rerun if needed."
|
||||
throw "Toolchain verification failed. See [FAIL] entries above. Setup aborted."
|
||||
}
|
||||
Write-Host "All toolchain checks passed." -ForegroundColor Green
|
||||
|
||||
# ── Cleanup ───────────────────────────────────────────────────────────────────
|
||||
if ($SkipCleanup) {
|
||||
Write-Host "`n[Setup] Skipping disk cleanup (-SkipCleanup switch set)." -ForegroundColor Yellow
|
||||
}
|
||||
else {
|
||||
Write-Step "Cleaning up disk"
|
||||
|
||||
# 1. Windows Disk Cleanup (cleanmgr) — run with /sagerun:1 using preset flags
|
||||
@@ -610,10 +1038,22 @@ $proc = Start-Process -FilePath 'cleanmgr.exe' -ArgumentList "/sagerun:$sageset"
|
||||
Write-Host "cleanmgr exited (code $($proc.ExitCode))."
|
||||
|
||||
# 2. Clear Windows Update cache
|
||||
Write-Host "Stopping Windows Update service..."
|
||||
Stop-Service -Name wuauserv -Force -ErrorAction SilentlyContinue
|
||||
Remove-Item 'C:\Windows\SoftwareDistribution\Download\*' -Recurse -Force -ErrorAction SilentlyContinue
|
||||
Start-Service -Name wuauserv -ErrorAction SilentlyContinue
|
||||
# Stop all services that might hold file locks inside SoftwareDistribution:
|
||||
# wuauserv — Windows Update (already Disabled from Step 6b, stop is idempotent)
|
||||
# UsoSvc — Update Orchestrator (already Disabled from Step 6b)
|
||||
# bits — Background Intelligent Transfer Service (downloads WU payloads)
|
||||
# dosvc — Delivery Optimization (peer-to-peer WU cache)
|
||||
# TrustedInstaller — Windows Modules Installer (unpacks .cab/.msu update packages)
|
||||
Write-Host "Stopping WU-adjacent services before cache clear..."
|
||||
foreach ($svc in 'wuauserv', 'UsoSvc', 'bits', 'dosvc', 'TrustedInstaller') {
|
||||
Stop-Service -Name $svc -Force -ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
# Delete and recreate the Download folder — more reliable than 'Remove-Item *'
|
||||
# because locked files inside subdirectories silently fail with wildcard delete.
|
||||
$sdDownload = 'C:\Windows\SoftwareDistribution\Download'
|
||||
Remove-Item $sdDownload -Recurse -Force -ErrorAction SilentlyContinue
|
||||
New-Item -ItemType Directory -Path $sdDownload -Force | Out-Null
|
||||
Write-Host "Windows Update download cache cleared."
|
||||
|
||||
# 3. Clear CBS / component store logs
|
||||
@@ -635,25 +1075,58 @@ Write-Host "DISM exited (code $($dism.ExitCode))."
|
||||
|
||||
Write-Host "Disk cleanup complete."
|
||||
|
||||
# Validation — leftover artifacts from this run should be gone
|
||||
# Note: do NOT assert SoftwareDistribution\Download empty.
|
||||
# WaaSMedicSvc (Windows Update Medic Service) is tamper-protected — cannot be stopped —
|
||||
# and actively restores WU files immediately after deletion. Files reappearing here is
|
||||
# normal and harmless: WU is permanently disabled by Step 6b (service Disabled + GPO keys).
|
||||
# Report remaining size as informational only.
|
||||
$sdFiles = Get-ChildItem 'C:\Windows\SoftwareDistribution\Download' -Recurse -File -Force -ErrorAction SilentlyContinue
|
||||
$sdMB = [math]::Round(($sdFiles | Measure-Object -Property Length -Sum).Sum / 1MB, 1)
|
||||
Write-Host " SoftwareDistribution\Download: $($sdFiles.Count) file(s), ${sdMB} MB remaining (WaaSMedicSvc best-effort, WU is disabled)."
|
||||
|
||||
Assert-Step 'Cleanup' 'wuauserv StartType still Disabled after cache clear' {
|
||||
(Get-Service wuauserv -ErrorAction Stop).StartType -eq 'Disabled'
|
||||
}
|
||||
} # end if (-not $SkipCleanup)
|
||||
|
||||
# ── Final pre-snapshot validation ────────────────────────────────────────────
|
||||
Write-Step "Final pre-snapshot validation"
|
||||
|
||||
Assert-Step 'Final' 'WinRM service Running' { (Get-Service WinRM -ErrorAction Stop).Status -eq 'Running' }
|
||||
Assert-Step 'Final' 'all firewall profiles disabled' {
|
||||
-not (Get-NetFirewallProfile | Where-Object Enabled -eq $true)
|
||||
}
|
||||
Assert-Step 'Final' "user $BuildUsername present + admin" {
|
||||
(Get-LocalUser -Name $BuildUsername -ErrorAction Stop) -and
|
||||
(& net localgroup Administrators 2>&1 | Select-String -SimpleMatch $BuildUsername)
|
||||
}
|
||||
Assert-Step 'Final' 'UAC EnableLUA=0' {
|
||||
(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name EnableLUA).EnableLUA -eq 0
|
||||
}
|
||||
Assert-Step 'Final' 'dotnet, python, msbuild all resolvable' {
|
||||
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
|
||||
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
|
||||
(Get-Command dotnet -ErrorAction SilentlyContinue) -and
|
||||
(Test-Path 'C:\Python\python.exe' -PathType Leaf) -and
|
||||
(Test-Path $msbuildPath -PathType Leaf)
|
||||
}
|
||||
Assert-Step 'Final' 'Windows Update permanently disabled' {
|
||||
(Get-Service wuauserv -ErrorAction Stop).StartType -eq 'Disabled'
|
||||
}
|
||||
Assert-Step 'Final' 'no leftover installer scripts in C:\CI' {
|
||||
-not (Test-Path 'C:\CI\python_installer.exe') -and
|
||||
-not (Test-Path 'C:\CI\vs_BuildTools.exe') -and
|
||||
-not (Test-Path 'C:\CI\wu_worker.ps1') -and
|
||||
-not (Test-Path 'C:\CI\vs_worker.ps1')
|
||||
}
|
||||
|
||||
Write-Host "All pre-snapshot checks passed." -ForegroundColor Green
|
||||
|
||||
# ── Done ──────────────────────────────────────────────────────────────────────
|
||||
Write-Host ""
|
||||
Write-Host "============================================================" -ForegroundColor Green
|
||||
Write-Host " Template VM setup complete!" -ForegroundColor Green
|
||||
Write-Host "============================================================" -ForegroundColor Green
|
||||
Write-Host ""
|
||||
Write-Host " MANDATORY NEXT STEPS:"
|
||||
Write-Host ""
|
||||
Write-Host " 1. Shut down this VM: Start -> Shut down"
|
||||
Write-Host " (Keep NIC on VMnet8 NAT — internet is required for builds)"
|
||||
Write-Host ""
|
||||
Write-Host " 2. Take snapshot in VMware Workstation:"
|
||||
Write-Host " VM -> Snapshot -> Take Snapshot"
|
||||
Write-Host " Name it EXACTLY: BaseClean"
|
||||
Write-Host ""
|
||||
Write-Host " 3. Leave VM powered off permanently."
|
||||
Write-Host ""
|
||||
Write-Host " 4. On the HOST - store credentials in Windows Credential Manager:"
|
||||
Write-Host " New-StoredCredential -Target 'BuildVMGuest' -UserName '$BuildUsername' ``"
|
||||
Write-Host " -Password '<your-build-password>' -Persist LocalMachine"
|
||||
Write-Host " (Run in an elevated PowerShell with CredentialManager module)"
|
||||
Write-Host "Setup-TemplateVM.ps1 complete. All Assert-Step checks passed." -ForegroundColor Green
|
||||
# Full next-steps banner is printed by Prepare-TemplateSetup.ps1 on the host.
|
||||
# If running this script standalone (manually inside the VM), follow the steps
|
||||
# in docs/WINDOWS-TEMPLATE-SETUP.md (shut down → snapshot BaseClean → power off).
|
||||
Write-Host ""
|
||||
|
||||
Reference in New Issue
Block a user