igodwin
f2a979f047
The repo is public and files are fetched by raw URL, so a reader who lands on one runbook never sees the README -- the repo's context does not travel with the file. Each .md now carries two lines under the title, each .ps1 the equivalent at the end of its .NOTES block. Deliberately two lines, not a paragraph. These files are read through `| more` on a client console mid-incident, and the top of the file is where the procedure-specific warnings live -- never a live chart, stop the service before copying, confirm authorization before acting. A legal preamble above those competes with them and trains people to skip past. Wording aims at a stranger who found the repo, not at the quality of the procedure: these double as documented-procedure evidence for E&O, and language implying the content is unreliable works against that. MIT rather than no license: the warranty and liability disclaimer is the part that does the work, and leaving it unlicensed makes reuse ambiguous rather than disclaimed. Also fixes 5 stale ops/rb URLs in scripts/*.ps1 that the previous commit missed -- it only swept the .md files. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7
64 lines
2.3 KiB
PowerShell
64 lines
2.3 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
Disable Windows Credential Guard, then reboot (prompts to confirm).
|
|
|
|
.DESCRIPTION
|
|
Credential Guard blocks replay of saved Credential Manager entries — the
|
|
classic "works after a manual Explorer connect, breaks on restart" SMB
|
|
symptom. This clears the VBS/Credential Guard flags and reboots to apply.
|
|
|
|
Enabled by default on Windows 11 22H2+ on entitled SKUs (Enterprise /
|
|
Business), not plain Pro.
|
|
|
|
.NOTES
|
|
Run via: irm rb.godwinsystems.com/scripts/cg-disable.ps1 | iex
|
|
Referenced by od-smb-cred.md, Step 3.
|
|
|
|
If Credential Guard is still running after reboot, it was enabled with a
|
|
UEFI lock (needs the bcdedit / physical-presence removal), or MDM policy is
|
|
re-enabling it — align with the environment baseline instead of fighting it
|
|
locally.
|
|
|
|
Provided as-is, without warranty. This runs in your session via `iex` —
|
|
read it before you run it. You are responsible for the systems you run
|
|
it on. See LICENSE.
|
|
#>
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
|
|
$isAdmin = ([Security.Principal.WindowsPrincipal] `
|
|
[Security.Principal.WindowsIdentity]::GetCurrent()
|
|
).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
|
|
if (-not $isAdmin) {
|
|
Write-Warning 'This script needs an elevated PowerShell session. Re-run as Administrator.'
|
|
return
|
|
}
|
|
|
|
Write-Host '== Disable Credential Guard ==' -ForegroundColor Cyan
|
|
Write-Host 'This clears the LsaCfgFlags / DeviceGuard Credential Guard flags and reboots.' -ForegroundColor Yellow
|
|
if ((Read-Host 'Proceed? (y/N)') -ne 'y') {
|
|
Write-Host 'Aborted. No changes made.'
|
|
return
|
|
}
|
|
|
|
try {
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" `
|
|
/v LsaCfgFlags /t REG_DWORD /d 0 /f | Out-Null
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" `
|
|
/v Enabled /t REG_DWORD /d 0 /f | Out-Null
|
|
Write-Host 'Flags cleared.' -ForegroundColor Green
|
|
}
|
|
catch {
|
|
Write-Warning "Failed to write registry: $($_.Exception.Message)"
|
|
return
|
|
}
|
|
|
|
Write-Host ''
|
|
Write-Host 'A reboot is required. After reboot, re-run msinfo32 and confirm' -ForegroundColor Yellow
|
|
Write-Host 'Credential Guard is no longer listed under Virtualization-based security.' -ForegroundColor Yellow
|
|
if ((Read-Host 'Reboot now? (y/N)') -eq 'y') {
|
|
shutdown /r /t 0
|
|
} else {
|
|
Write-Host 'Skipped reboot. Changes apply on next restart.'
|
|
}
|