af41dde33c
Root cause fix: runner.go passed config as unevaluated PS expression via -File mode - scripts received a literal string instead of parsed object. Changed to -ConfigPath; scripts load JSON themselves via shared common.ps1 (Write-Log, Get-Feature, Load-Config). GUI now regenerates runtime config before run so user selections actually reach the scripts. Merged 04-default-profile + 05-personalization into single script (one hive load/unload, no Explorer restart, no hive contention). Deleted Deploy-Windows.ps1 (xetup.exe is sole entry point), 06-scheduled-tasks.ps1 (tasks caused more harm than good), 07-desktop-info.ps1 (replaced by BackInfo long ago). Step ordering: activation moved early, pcIdentity before WU (exit 9 on rename only when rename actually happened). Edge policies split into mandatory (telemetry, first-run) vs recommended (UI preferences user can override). Atera install uses Start-Process -Wait instead of fragile sleep. Updated config.json, tests, DefaultConfig to match current state. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
106 lines
4.5 KiB
PowerShell
106 lines
4.5 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
Sets network profile to Private, enables ping, and enables Network Discovery.
|
|
|
|
.DESCRIPTION
|
|
Sets all connected network adapter profiles from Public to Private. Private
|
|
profile enables file sharing, network discovery, and other LAN features.
|
|
Enables ICMP echo (ping) via Windows Firewall for diagnostic purposes.
|
|
Enables the Network Discovery firewall rule group for the Private profile
|
|
so this PC is visible to other computers on the local network.
|
|
|
|
.ITEMS
|
|
nastavit-sitovy-profil-private: Sets all connected network profiles to Private via Set-NetConnectionProfile. Public profile blocks most LAN features. Private is required for file sharing, printer sharing, and network discovery. Applied to all currently connected adapters.
|
|
povolit-ping-icmp-firewall: Enables "File and Printer Sharing (Echo Request)" firewall rules for ICMPv4 and ICMPv6. ICMP echo is disabled by default on clean Windows. Required for network diagnostics, monitoring tools, and basic connectivity verification.
|
|
zapnout-network-discovery: Enables the Network Discovery firewall rule group (FPS-NB_Name-In-UDP, LLMNR, etc.) for Private and Domain profiles via Set-NetFirewallRule. Allows this PC to appear in Network Neighborhood and browse other machines.
|
|
#>
|
|
param(
|
|
[string]$ConfigPath,
|
|
[string]$LogFile
|
|
)
|
|
|
|
. "$PSScriptRoot\common.ps1"
|
|
$Config = Load-Config $ConfigPath
|
|
|
|
# -----------------------------------------------------------------------
|
|
# Set network profiles to Private
|
|
# -----------------------------------------------------------------------
|
|
Write-Log "Setting network profiles to Private" -Level INFO
|
|
|
|
try {
|
|
$profiles = Get-NetConnectionProfile -ErrorAction Stop
|
|
foreach ($profile in $profiles) {
|
|
if ($profile.NetworkCategory -ne "Private") {
|
|
Set-NetConnectionProfile -InterfaceIndex $profile.InterfaceIndex `
|
|
-NetworkCategory Private -ErrorAction SilentlyContinue
|
|
Write-Log " $($profile.Name): Public -> Private" -Level OK
|
|
} else {
|
|
Write-Log " $($profile.Name): already Private" -Level INFO
|
|
}
|
|
}
|
|
}
|
|
catch {
|
|
Write-Log " Failed to set network profiles: $_" -Level ERROR
|
|
}
|
|
|
|
# -----------------------------------------------------------------------
|
|
# Enable ICMP echo (ping) - ICMPv4 and ICMPv6
|
|
# -----------------------------------------------------------------------
|
|
Write-Log "Enabling ICMP echo (ping)" -Level INFO
|
|
|
|
$icmpRules = @(
|
|
"FPS-ICMP4-ERQ-In", # File and Printer Sharing (Echo Request - ICMPv4-In)
|
|
"FPS-ICMP6-ERQ-In", # File and Printer Sharing (Echo Request - ICMPv6-In)
|
|
"CoreNet-ICMP4-DU-In",
|
|
"CoreNet-ICMP6-DU-In"
|
|
)
|
|
|
|
foreach ($rule in $icmpRules) {
|
|
try {
|
|
$r = Get-NetFirewallRule -Name $rule -ErrorAction SilentlyContinue
|
|
if ($r) {
|
|
Enable-NetFirewallRule -Name $rule -ErrorAction SilentlyContinue
|
|
Write-Log " Enabled: $rule" -Level OK
|
|
}
|
|
}
|
|
catch {
|
|
Write-Log " Rule not found or error: $rule - $_" -Level WARN
|
|
}
|
|
}
|
|
|
|
# Also enable by display name for robustness across Windows versions
|
|
try {
|
|
Get-NetFirewallRule -DisplayGroup "File and Printer Sharing" -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.DisplayName -like "*Echo*" } |
|
|
Enable-NetFirewallRule -ErrorAction SilentlyContinue
|
|
Write-Log " Enabled File and Printer Sharing Echo rules" -Level OK
|
|
}
|
|
catch {
|
|
Write-Log " Could not enable Echo rules via DisplayGroup: $_" -Level WARN
|
|
}
|
|
|
|
# -----------------------------------------------------------------------
|
|
# Enable Network Discovery firewall rules
|
|
# -----------------------------------------------------------------------
|
|
Write-Log "Enabling Network Discovery" -Level INFO
|
|
|
|
try {
|
|
# Enable all Network Discovery rules for Private profile
|
|
Get-NetFirewallRule -DisplayGroup "Network Discovery" -ErrorAction Stop |
|
|
Where-Object { $_.Profile -match "Private|Any" } |
|
|
Enable-NetFirewallRule -ErrorAction SilentlyContinue
|
|
Write-Log " Network Discovery rules enabled (Private)" -Level OK
|
|
}
|
|
catch {
|
|
Write-Log " Failed to enable Network Discovery rules: $_" -Level ERROR
|
|
}
|
|
|
|
# Enable via netsh as fallback (covers older Windows builds)
|
|
$netshResult = & netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes 2>&1
|
|
if ($LASTEXITCODE -eq 0) {
|
|
Write-Log " Network Discovery enabled via netsh" -Level OK
|
|
} else {
|
|
Write-Log " netsh Network Discovery: $netshResult" -Level WARN
|
|
}
|
|
|
|
Write-Log "Step 10 complete" -Level OK
|