igodwin
cb0c5b4614
od-db-backup.md becomes od/db-backup.md -- the hyphen becomes a slash, so the fetch command is exactly as long to type as before. That mattered: the length of a hand-typed command is the constraint this repo is organized around, and a reorganization that lengthened it would have been a net loss. Scripts deliberately stay flat in scripts/ with their domain prefix. Everything executable in one directory is the set worth reading before it runs, and nesting five files by domain would add characters without adding clarity. Updates every reference: README Contents (now grouped by directory), the layout section, both fetch examples, inter-runbook links, and the .NOTES headers in all five scripts. Verified every markdown link resolves on disk and that Contents and the filesystem agree in both directions. Records the naming rule in CONTRIBUTING so the next file lands correctly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7
64 lines
2.3 KiB
PowerShell
64 lines
2.3 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
Disable Windows Credential Guard, then reboot (prompts to confirm).
|
|
|
|
.DESCRIPTION
|
|
Credential Guard blocks replay of saved Credential Manager entries — the
|
|
classic "works after a manual Explorer connect, breaks on restart" SMB
|
|
symptom. This clears the VBS/Credential Guard flags and reboots to apply.
|
|
|
|
Enabled by default on Windows 11 22H2+ on entitled SKUs (Enterprise /
|
|
Business), not plain Pro.
|
|
|
|
.NOTES
|
|
Run via: irm rb.godwinsystems.com/scripts/cg-disable.ps1 | iex
|
|
Referenced by od/smb-cred.md, Step 3.
|
|
|
|
If Credential Guard is still running after reboot, it was enabled with a
|
|
UEFI lock (needs the bcdedit / physical-presence removal), or MDM policy is
|
|
re-enabling it — align with the environment baseline instead of fighting it
|
|
locally.
|
|
|
|
Provided as-is, without warranty. This runs in your session via `iex` —
|
|
read it before you run it. You are responsible for the systems you run
|
|
it on. See LICENSE.
|
|
#>
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
|
|
$isAdmin = ([Security.Principal.WindowsPrincipal] `
|
|
[Security.Principal.WindowsIdentity]::GetCurrent()
|
|
).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
|
|
if (-not $isAdmin) {
|
|
Write-Warning 'This script needs an elevated PowerShell session. Re-run as Administrator.'
|
|
return
|
|
}
|
|
|
|
Write-Host '== Disable Credential Guard ==' -ForegroundColor Cyan
|
|
Write-Host 'This clears the LsaCfgFlags / DeviceGuard Credential Guard flags and reboots.' -ForegroundColor Yellow
|
|
if ((Read-Host 'Proceed? (y/N)') -ne 'y') {
|
|
Write-Host 'Aborted. No changes made.'
|
|
return
|
|
}
|
|
|
|
try {
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" `
|
|
/v LsaCfgFlags /t REG_DWORD /d 0 /f | Out-Null
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" `
|
|
/v Enabled /t REG_DWORD /d 0 /f | Out-Null
|
|
Write-Host 'Flags cleared.' -ForegroundColor Green
|
|
}
|
|
catch {
|
|
Write-Warning "Failed to write registry: $($_.Exception.Message)"
|
|
return
|
|
}
|
|
|
|
Write-Host ''
|
|
Write-Host 'A reboot is required. After reboot, re-run msinfo32 and confirm' -ForegroundColor Yellow
|
|
Write-Host 'Credential Guard is no longer listed under Virtualization-based security.' -ForegroundColor Yellow
|
|
if ((Read-Host 'Reboot now? (y/N)') -eq 'y') {
|
|
shutdown /r /t 0
|
|
} else {
|
|
Write-Host 'Skipped reboot. Changes apply on next restart.'
|
|
}
|