 Simone
|
260e275b89
|
refactor(template): §7 — move OS hardening to Deploy, Setup becomes validation-only
§7.1 — Setup Steps 1/3/4b/5b/5c converted to Assert-Step only:
- Deploy post-install.ps1 now owns: Firewall (all profiles disabled),
WinRM MaxMemory=2048MB/IdleTimeout=2h/MaxProcesses=25/StartupType=Automatic,
lock screen (NoLockScreen), SM GPO policy key + scheduled task disable,
DisableCAD in Winlogon, OOBE non-policy key.
- Setup no longer re-applies these — validates them, throws if Deploy missed any.
§7.2 — WU lifecycle Strategy B:
- Deploy: replaces sc.exe disable with GPO locks only (NoAutoUpdate=1,
DisableWindowsUpdateAccess=1); services remain Manual (Windows default).
- Setup Step 6 Step A already clears these locks before COM API; Step 6b
permanently disables services post-update. No Setup changes needed.
§7.3 — Docs updated:
- Deploy .DESCRIPTION reflects full hardening ownership.
- Setup .DESCRIPTION marks validation-only steps, updates step ordering rationale.
- WINDOWS-TEMPLATE-SETUP.md: three-script architecture table, CI-WinBuild.vmx
path, Fase C step list + rationale + validation table updated.
TODO: §7.1/7.2/7.3 marked done. §7.4 e2e pending (requires new VM snapshot).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-05-10 01:27:29 +02:00 |
|
|
Simone
|
644258f59c
|
refactor(template): rename Setup-TemplateVM.ps1 -> Setup-WinBuild2025.ps1
- git mv Setup-TemplateVM.ps1 Setup-WinBuild2025.ps1
- git mv Prepare-TemplateSetup.ps1 -> Prepare-WinBuild2025.ps1 (name already in place)
- Updated all references across the workspace:
template/Prepare-WinBuild2025.ps1 (script copy, assertions, comments)
template/Setup-WinBuild2025.ps1 (self-references in docblock and final message)
README.md (directory tree)
TODO.md (all inline links and task descriptions)
docs/WINDOWS-TEMPLATE-SETUP.md (table, step descriptions, phase header, troubleshooting)
docs/LINUX-TEMPLATE-SETUP.md (Windows equivalent reference)
|
2026-05-09 23:28:36 +02:00 |
|