alexrg/SGU-CredentialProvider
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 31 Wiki Activity

Default all users to local Windows profiles

Browse Source
This commit is contained in:
alexrg
2026-09-18 12:06:15 -06:00
parent 01e0ee5ac4
commit 106be26e7c
11 changed files with 442 additions and 167 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/UserRoaming.Tests.ps1
+33 -2
View File
@@ -2,6 +2,7 @@ $repositoryRoot = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path
$bicepPath = Join-Path $repositoryRoot 'infra\azure\main.bicep'
$deploymentPath = Join-Path $repositoryRoot 'scripts\Deploy-SguAzureInfrastructure.ps1'
$configurationPath = Join-Path $repositoryRoot 'scripts\Enable-SguAzureUserRoaming.ps1'
$rollbackPath = Join-Path $repositoryRoot 'scripts\Disable-SguAzureUserRoaming.ps1'
$installerPath = Join-Path $repositoryRoot 'scripts\Install-SguFsLogix.ps1'
$gpoDeploymentPath = Join-Path $repositoryRoot 'scripts\Publish-SguFsLogixClientDeployment.ps1'
$clientBootstrapPath = Join-Path $repositoryRoot 'scripts\Invoke-SguClientBootstrap.ps1'
@@ -11,6 +12,7 @@ $packagePath = Join-Path $repositoryRoot 'scripts\New-SguBootstrapPackages.ps1'
foreach ($scriptPath in @(
$deploymentPath,
$configurationPath,
$rollbackPath,
$installerPath,
$gpoDeploymentPath,
$clientBootstrapPath,
@@ -40,9 +42,9 @@ $samFunction = $configurationAst.Find({
Invoke-Expression $samFunction.Extent.Text
Describe 'SGU Azure user-roaming infrastructure' {
It 'deploys dedicated private Azure Files resources by default' {
It 'keeps roaming disabled by default while retaining optional private Azure Files resources' {
$source = Get-Content -LiteralPath $bicepPath -Raw
$source | Should Match 'param deployUserRoaming bool = true'
$source | Should Match 'param deployUserRoaming bool = false'
$source | Should Match "purpose: 'SGU-user-roaming'"
$source | Should Match "publicNetworkAccess: 'Disabled'"
$source | Should Match "privateLinkServiceId: userRoamingStorageAccount.id"
@@ -63,6 +65,8 @@ Describe 'SGU Azure user-roaming infrastructure' {
$source = Get-Content -LiteralPath $deploymentPath -Raw
$source | Should Match '\$DeployUserRoaming -and -not \$DeployVpnGateway'
$source | Should Match 'private Azure Files endpoint'
$source | Should Match '\$DeployUserRoaming -and -not \$AcknowledgeUserRoamingRisks'
$source | Should Match '\[bool\]\$DeployUserRoaming = \$false'
}
It 'returns every post-domain setup value from the Azure deployment' {
@@ -79,6 +83,12 @@ Describe 'SGU Azure user-roaming infrastructure' {
}
Describe 'SGU role-specific roaming policies' {
It 'requires an explicit risk acknowledgement before enabling roaming' {
$source = Get-Content -LiteralPath $configurationPath -Raw
$source | Should Match '\[switch\]\$AcknowledgeUserRoamingRisks'
$source | Should Match 'optional high-risk feature'
}
It 'supports an explicitly selected public SMB endpoint while keeping private as the default' {
(((Get-Command $configurationPath).Parameters['EndpointAccess'].Attributes |
Where-Object { $_ -is [Management.Automation.ValidateSetAttribute] }).ValidValues -join ',') |
@@ -181,6 +191,7 @@ Describe 'SGU FSLogix image enrollment' {
It 'packages both roaming setup scripts' {
$source = Get-Content -LiteralPath $packagePath -Raw
$source | Should Match "'Install-SguFsLogix\.ps1'"
$source | Should Match "'Disable-SguAzureUserRoaming\.ps1'"
$source | Should Match "'Enable-SguAzureUserRoaming\.ps1'"
$source | Should Match "'Publish-SguFsLogixClientDeployment\.ps1'"
}
@@ -196,3 +207,23 @@ Describe 'SGU FSLogix image enrollment' {
$source | Should Match 'Install-SguFsLogix-Startup\.ps1'
}
}
Describe 'SGU local-profile rollback' {
It 'disables FSLogix containers and their services through computer policy' {
$source = Get-Content -LiteralPath $rollbackPath -Raw
$source | Should Match "'HKLM\\SOFTWARE\\FSLogix\\Profiles'"
$source | Should Match "'HKLM\\SOFTWARE\\FSLogix\\ODFC'"
$source | Should Match '-ValueName Enabled -Type DWord -Value 0'
$source | Should Match "'frxsvc','frxccds'"
$source | Should Match '-ValueName Start -Type DWord -Value 4'
$source | Should Match 'StaffProfileStorageMode[\s\S]*-Value Disabled'
}
It 'restores student shell folders to the local profile and disables deployment' {
$source = Get-Content -LiteralPath $rollbackPath -Raw
$source | Should Match '%USERPROFILE%\\Desktop'
$source | Should Match '%USERPROFILE%\\Documents'
$source | Should Match "-LinkEnabled No"
$source | Should Match 'profilePath,homeDirectory,homeDrive'
}
}