Reorganize: scripts under scripts/, add README disclaimer

- Move _template.ps1 and cg-disable.ps1 into scripts/ - Update all fetch/run URLs and doc links to scripts/ paths - Rework README layout/naming section; add as-is/no-warranty disclaimer Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-07 15:56:02 -07:00
parent 314f6cf7f8
commit 6df8a53196
5 changed files with 20 additions and 12 deletions
@@ -0,0 +1,60 @@
+<#
+.SYNOPSIS
+  One-line description of what this runbook script does.
+
+.DESCRIPTION
+  Longer context: symptom it addresses, what it changes, whether it reboots.
+
+.NOTES
+  Convention for scripts in this repo — designed to run via:
+      irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/<file>.ps1 | iex
+
+  Because `irm | iex` runs in the caller's session:
+    - No param() block — you can't pass args through the pipe. Prompt with
+      Read-Host instead.
+    - #Requires is NOT enforced under iex — check for admin manually below.
+    - Keep it self-contained: no external module installs, no dot-sourcing.
+
+  PUBLIC REPO: placeholders only. Never hard-code a client, host, user, or
+  secret. Prompt for them at run time.
+#>
+
+$ErrorActionPreference = 'Stop'
+
+# --- Admin check (do not rely on #Requires under iex) ---
+$isAdmin = ([Security.Principal.WindowsPrincipal] `
+    [Security.Principal.WindowsIdentity]::GetCurrent()
+  ).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
+if (-not $isAdmin) {
+    Write-Warning 'This script needs an elevated PowerShell session. Re-run as Administrator.'
+    return
+}
+
+Write-Host '== <SCRIPT TITLE> ==' -ForegroundColor Cyan
+
+# --- Prompt for placeholders (no param block; iex-safe) ---
+$server    = Read-Host 'Server hostname   <SERVER>'
+$shareUser = Read-Host 'Share account     <SHARE_USER>'
+# For secrets, use -AsSecureString and never echo or persist them:
+# $secure  = Read-Host 'Password        <PASSWORD>' -AsSecureString
+
+# --- Confirm before destructive / disruptive actions ---
+Write-Host ''
+Write-Host "About to: <describe the change> on $server" -ForegroundColor Yellow
+if ((Read-Host 'Proceed? (y/N)') -ne 'y') {
+    Write-Host 'Aborted. No changes made.'
+    return
+}
+
+# --- Do the work ---
+try {
+    # ... the actual commands ...
+    Write-Host 'Done.' -ForegroundColor Green
+}
+catch {
+    Write-Warning "Failed: $($_.Exception.Message)"
+    return
+}
+
+# --- If a reboot is required, confirm separately ---
+# if ((Read-Host 'Reboot now to apply? (y/N)') -eq 'y') { shutdown /r /t 0 }
@@ -0,0 +1,59 @@
+<#
+.SYNOPSIS
+  Disable Windows Credential Guard, then reboot (prompts to confirm).
+
+.DESCRIPTION
+  Credential Guard blocks replay of saved Credential Manager entries — the
+  classic "works after a manual Explorer connect, breaks on restart" SMB
+  symptom. This clears the VBS/Credential Guard flags and reboots to apply.
+
+  Enabled by default on Windows 11 22H2+ on entitled SKUs (Enterprise /
+  Business), not plain Pro.
+
+.NOTES
+  Run via:  irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/cg-disable.ps1 | iex
+  Referenced by od-smb-cred.md, Step 3.
+
+  If Credential Guard is still running after reboot, it was enabled with a
+  UEFI lock (needs the bcdedit / physical-presence removal), or MDM policy is
+  re-enabling it — align with the environment baseline instead of fighting it
+  locally.
+#>
+
+$ErrorActionPreference = 'Stop'
+
+$isAdmin = ([Security.Principal.WindowsPrincipal] `
+    [Security.Principal.WindowsIdentity]::GetCurrent()
+  ).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
+if (-not $isAdmin) {
+    Write-Warning 'This script needs an elevated PowerShell session. Re-run as Administrator.'
+    return
+}
+
+Write-Host '== Disable Credential Guard ==' -ForegroundColor Cyan
+Write-Host 'This clears the LsaCfgFlags / DeviceGuard Credential Guard flags and reboots.' -ForegroundColor Yellow
+if ((Read-Host 'Proceed? (y/N)') -ne 'y') {
+    Write-Host 'Aborted. No changes made.'
+    return
+}
+
+try {
+    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" `
+        /v LsaCfgFlags /t REG_DWORD /d 0 /f | Out-Null
+    reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" `
+        /v Enabled /t REG_DWORD /d 0 /f | Out-Null
+    Write-Host 'Flags cleared.' -ForegroundColor Green
+}
+catch {
+    Write-Warning "Failed to write registry: $($_.Exception.Message)"
+    return
+}
+
+Write-Host ''
+Write-Host 'A reboot is required. After reboot, re-run msinfo32 and confirm' -ForegroundColor Yellow
+Write-Host 'Credential Guard is no longer listed under Virtualization-based security.' -ForegroundColor Yellow
+if ((Read-Host 'Reboot now? (y/N)') -eq 'y') {
+    shutdown /r /t 0
+} else {
+    Write-Host 'Skipped reboot. Changes apply on next restart.'
+}