Conversation
…il steps Audit of the deployment scripts turned up several bugs that break a zero-touch run, plus a hardening baseline that both did too much in one place and too little in another. Bugs fixed: - Docs/autounattend.xml never launched WinDeploy. The first-logon script was generated as unattend-02.cmd but contained PowerShell, which cmd.exe cannot run. Made it a .ps1 and corrected the generator URL. - Harden-Windows.ps1 set SMB2=0, which disables SMB2 *and* SMB3 and breaks all file and printer sharing. Removed; replaced with SMB signing and guest-logon hardening. - Test-IntuneEnrollment and Deploy.ps1 both crashed under StrictMode ($null.Count, and $LASTEXITCODE before it is ever set). $LASTEXITCODE also leaked between steps, marking later steps as failed. - Screen lock was written to HKCU, which during deployment is the deployment account rather than the end user, and SCRNSAVE.EXE was empty so the secure lock never triggered. Now machine-wide policy. - winget installs were missing --silent, and Office used Display Level="Full", so both could show UI mid-deployment. - Windows updates without a KB number (drivers, definitions) were silently skipped by the per-KB install loop. - Seven winget font error codes were typed -1979335xxx, not -1978335xxx. - HP detection matched "*hp*", which also matches "Sharp"; HPCMSL was installed without bootstrapping NuGet/PSGallery so it stalled. - Remove-Bloat logged to %TEMP% instead of C:\WinDeploy\Logs, used a PowerShell 6+ escape in a 5.1 script, and never implemented the "prevents reinstall" its header promised. - Exit prompts now time out instead of blocking unattended runs. BitLocker previously created only a TPM protector while telling the operator to "export your BitLocker recovery key" that never existed, leaving the drive unrecoverable after a TPM clear or mainboard swap. It now asks Y/N, creates a recovery password, saves it to the operator's Documents folder and prints it on screen with a warning to store it. Added Apply-Tweaks.ps1, an opt-in step that applies a ChrisTitusTech WinUtil preset after a Y/N confirmation, and extended the hardening baseline with LSA protection, WDigest, SMB signing, LLMNR, HVCI and Defender ASR rules. Both prompts default to No after 90s, and -NonInteractive skips them entirely for the autounattend path. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pt5Q3XvjMT6HMdubvkyLMW
…s properly
Smoke-testing the new confirmation prompts turned up two problems in the
code added in the previous commit.
Read-YesNoWithTimeout used Write-Output for its "no console" message.
Write-Output goes to the same stream as the return value, so the caller
got @("...message...", $false) instead of $false. A 2-element array is
truthy, so `if (-not $enableBitLocker)` took the wrong branch and
answering No would have ENABLED BitLocker. Switched to Write-Host, which
does not touch the output stream, and added a test asserting the return
value is a clean [bool].
The non-interactive short-circuit also never fired. [Environment]::
UserInteractive is $true for any process in a user session, including one
with redirected stdin, so the helper fell through to the polling loop and
sat there for the full 90-second timeout instead of returning the default
immediately. Now also checks [Console]::IsInputRedirected, and Deploy.ps1's
Wait-ForExit got the same guard.
While there: the countdown repainted once a second, which fills the
Start.ps1 transcript with 90 redraw lines per prompt. It now repaints
every 5 seconds.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pt5Q3XvjMT6HMdubvkyLMW
DevSkim reported three errors on this PR, all "A potentially weak cipher mode of operation was used". Fetched the check-run annotations rather than guessing: all three are the literal prose string "XTS-AES-256" in a console message, a summary label and a docs-link key. DS187371 word-matches XTS from a list of cipher modes. The hyphens in "XTS-AES-256" form word boundaries, which is why the prose matches while the actual code (-EncryptionMethod XtsAes256) does not. The finding is wrong on the merits: XTS is the mode Microsoft recommends for BitLocker, and it is what this script configures. Rewording cannot fix it either, since any text naming the mode matches, and dropping the name would hide information the operator wants. Suppressed inline with a justification, which is DevSkim's own mechanism for this. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pt5Q3XvjMT6HMdubvkyLMW
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pt5Q3XvjMT6HMdubvkyLMW
Adds a Hugo landing page (src/, EN+NL) for windeploy.thectic.nl, deployed to Bunny.net, mirroring the structure already applied to BypassNRO. Scripts/ and Docs/ keep their location and behaviour — GitHub Releases stays the distribution mechanism, so a run stays pinned to one release tag throughout, unlike BypassNRO where the Bunny CDN became the file source itself. CI: swapped codeql.yml/dependency-review.yml/security.yml/stale.yml for the org's leaner set (config-validation, pr-checks, pr-title, trivy-scan, update-checksums, deploy-bunny), matching what already happened to BypassNRO. This drops DevSkim/Semgrep/CodeQL-for-Actions/ dependency-review/stale-bot coverage - noted in the CHANGELOG since it's a real reduction, not just a rename. validate.yml's PowerShell syntax and helper-function checks are kept (bypassnro didn't need their own equivalent; this repo does) and merged into one job. All Stensel8/WinDeploy references updated to Thectic-NL/WinDeploy across README, SECURITY.md, autounattend.xml (plain and URL-encoded forms in the generator header comment), Start.ps1, Deploy.ps1 and the changelog's release links. windeploy.stensel.nl (an external redirect, not part of this repo) is flagged in the README as needing separate attention. Verified before pushing: PSScriptAnalyzer (0 findings), actionlint (0 findings) and a full Hugo build against the real go.mod/go.sum - both generated via `go mod download` and checksum-matched against BypassNRO's identical hextra v0.12.3 dependency. The build only fails in this sandbox on two outbound fetches this environment blocks (go.dev's toolchain download, cdn.jsdelivr.net for search) - neither is a defect in the added content, and BypassNRO's own build depends on the identical jsdelivr fetch already. What this does NOT do, and can't from here: the actual GitHub repo transfer to Thectic-NL (no transfer API available, and this session can't attach Thectic-NL/WinDeploy - cross-tier repo access is blocked once Stensel8 repos are already attached), and adding the project card to Thectic-NL/THectic.nl's homepage (same cross-tier block). Both need to happen from the user's own side or a separate session. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pt5Q3XvjMT6HMdubvkyLMW
Stensel8
changed the title
Stensel8
changed the base branch from
claude/repo-audit-modernization-7byt68
to
main
September 2, 2026 22:58
markdownlint (MD024, siblings_only) caught this once .markdownlint.yml was added: two "### Fixed" sections existed under the same [0.5.0] version heading, pre-dating this restructuring. Merged into one. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pt5Q3XvjMT6HMdubvkyLMW
…API) Checked api.github.com/search/repositories?q=repo:THectic-NL/BypassNRO directly: owner.login is "THectic-NL" (capital T-H), not "Thectic-NL". My own earlier commit had it wrong in src/go.mod, and BypassNRO's own repo (hugo.toml, go.mod, README, content pages) has the same imprecise casing throughout - harmless since GitHub resolves logins case- insensitively, but real drift from the account's actual stored name. Corrected everywhere in this repo; BypassNRO's own instances are unchanged since fixing another repo wasn't asked for. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pt5Q3XvjMT6HMdubvkyLMW
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All
Stensel8/WinDeployreferences updated toThectic-NL/WinDeployacross README,SECURITY.md,autounattend.xml(both the plain and URL-encoded forms in the generator's header comment),Start.ps1,Deploy.ps1, and the changelog's release links.windeploy.stensel.nl(the "Option 3" one-liner) is an external redirect outside this repo — flagged in the README as needing separate attention rather than silently repointed to something that wouldn't actually work the same way.