From 5ed24a5b22396e9d1301779d5649ce57397e6300 Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Tue, 5 Nov 2024 17:58:08 +0000
Subject: [PATCH 01/23] onr client file downloads, join domain, move OU

---
 .../Scripts/UserDataScripts/OnrClient.ps1     | 394 +++++++++++++++---
 1 file changed, 345 insertions(+), 49 deletions(-)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index 27d5ebdc9..bd372f525 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -3,47 +3,116 @@ $GlobalConfig = @{
          "BOEWindowsClientS3Bucket" = "mod-platform-image-artefact-bucket20230203091453221500000001"
          "BOEWindowsClientS3Folder" = "hmpps/onr"
          "BOEWindowsClientS3File" = "51048121.ZIP"
+         "Oracle11g64bitClientS3File" = "V20609-01.zip"
+         "Oracle19c64bitClientS3File" = "WINDOWS.X64_193000_client.zip" # Oracle 19c client SW, install 1st"
+         "ORACLE_19C_HOME"       = "E:\app\oracle\product\19.0.0\client_1"
+         "ORACLE_11G_HOME"       = "E:\app\oracle\product\11.2.0\client_1"
+         "ORACLE_BASE"           = "E:\app\oracle"
          "RegistryPath" = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\winlogon"
          "LegalNoticeCaption" = "IMPORTANT"
          "LegalNoticeText" = "This system is restricted to authorized users only. Individuals who attempt unauthorized access will be prosecuted. If you are unauthorized terminate access now. Click OK to indicate your acceptance of this information"
     }
+    "oasys-national-reporting-dev" = @{
+      "OnrShortcuts" = @{
+      }
+    }
     "oasys-national-reporting-test"  = @{
+      "serviceUser"     = "svc_nart"
+      "nartComputersOU" = "OU=Nart,OU=MODERNISATION_PLATFORM_SERVERS,DC=AZURE,DC=NOMS,DC=ROOT"
+      "domain"          = "AZURE"
       "OnrShortcuts" = @{
         "Onr CmcApp" = "http://t2-onr-web-1-a.oasys-national-reporting.hmpps-test.modernisation-platform.service.justice.gov.uk:7777/CmcApp"
-
       }
     }
     "oasys-national-reporting-preproduction" = @{
-      "OnrShortcuts" = @{
-
+        "serviceUser"     = "svc_nart"
+        "nartComputersOU" = "OU=Nart,OU=MODERNISATION_PLATFORM_SERVERS,DC=AZURE,DC=HMPP,DC=ROOT"
+        "domain"          = "HMPP"
+        "OnrShortcuts" = @{
       }
     }
     "oasys-national-reporting-production" = @{
-      "OnrShortcuts" = @{
-
+        "serviceUser"     = "svc_nart"
+        "nartComputersOU" = "OU=Nart,OU=MODERNISATION_PLATFORM_SERVERS,DC=AZURE,DC=HMPP,DC=ROOT"
+        "domain"          = "HMPP"
+        "OnrShortcuts" = @{
       }
-    }   
- }
-  
- function Get-Config {
-   $Token = Invoke-RestMethod -TimeoutSec 10 -Headers @{"X-aws-ec2-metadata-token-ttl-seconds"=3600} -Method PUT -Uri http://169.254.169.254/latest/api/token
-   $InstanceId = Invoke-RestMethod -TimeoutSec 10 -Headers @{"X-aws-ec2-metadata-token" = $Token} -Method GET -Uri http://169.254.169.254/latest/meta-data/instance-id
-   $TagsRaw = aws ec2 describe-tags --filters "Name=resource-id,Values=$InstanceId"
-   $Tags = "$TagsRaw" | ConvertFrom-Json
-   $EnvironmentNameTag = ($Tags.Tags | Where-Object  {$_.Key -eq "environment-name"}).Value
- 
-   if (-not $GlobalConfig.Contains($EnvironmentNameTag)) {
-     Write-Error "Unexpected environment-name tag value $EnvironmentNameTag"
-   }
-   Return $GlobalConfig.all + $GlobalConfig[$EnvironmentNameTag]
+    }
  }
- 
+
+ $tempPath = ([System.IO.Path]::GetTempPath())
+
+ $ConfigurationManagementRepo = "$tempPath\modernisation-platform-configuration-management"
+ $ErrorActionPreference = "Stop"
+ $WorkingDirectory = "C:\Software"
+ $AppDirectory = "C:\App"
+
+ New-Item -ItemType Directory -Path $WorkingDirectory -Force
+ New-Item -ItemType Directory -Path $AppDirectory -Force
+
+# {{{ functions
+
+function Get-Config {
+    $tokenParams = @{
+        TimeoutSec = 10
+        Headers    = @{"X-aws-ec2-metadata-token-ttl-seconds" = 3600}
+        Method     = 'PUT'
+        Uri        = 'http://169.254.169.254/latest/api/token'
+    }
+    $Token = Invoke-RestMethod @tokenParams
+
+    $instanceIdParams = @{
+        TimeoutSec = 10
+        Headers    = @{"X-aws-ec2-metadata-token" = $Token}
+        Method     = 'GET'
+        Uri        = 'http://169.254.169.254/latest/meta-data/instance-id'
+    }
+    $InstanceId = Invoke-RestMethod @instanceIdParams
+
+    $awsParams = @(
+        'ec2',
+        'describe-tags',
+        '--filters',
+        "Name=resource-id,Values=$InstanceId"
+    )
+
+    $TagsRaw = & aws @awsParams
+
+    $Tags = $TagsRaw | ConvertFrom-Json
+    $EnvironmentNameTag = ($Tags.Tags | Where-Object { $_.Key -eq "environment-name" }).Value
+
+    if (-not $GlobalConfig.Contains($EnvironmentNameTag)) {
+        Write-Error "Unexpected environment-name tag value $EnvironmentNameTag"
+    }
+
+    Return $GlobalConfig.all + $GlobalConfig[$EnvironmentNameTag]
+}
+
+function Get-Installer {
+    param (
+        [Parameter(Mandatory)]
+        [string]$Key,
+
+        [Parameter(Mandatory)]
+        [string]$Destination
+    )
+
+    $s3Params = @{
+        BucketName = $Config.WindowsClientS3Bucket
+        Key        = ($Config.WindowsClientS3Folder + "/" + $Key)
+        File       = $Destination
+        Verbose    = $true
+    }
+
+    Read-S3Object @s3Params
+}
+
  function Add-BOEWindowsClient {
    [CmdletBinding()]
    param (
      [hashtable]$Config
    )
- 
+
    $ErrorActionPreference = "Stop"
    if (Test-Path (([System.IO.Path]::GetTempPath()) + "\BOE\setup.exe")) {
      Write-Output "BOE Windows Client already installed"
@@ -51,13 +120,13 @@ $GlobalConfig = @{
      Write-Output "Add BOE Windows Client"
      Set-Location -Path ([System.IO.Path]::GetTempPath())
      Read-S3Object -BucketName $Config.BOEWindowsClientS3Bucket -Key ($Config.BOEWindowsClientS3Folder + "/" + $Config.BOEWindowsClientS3File) -File (".\" + $Config.BOEWindowsClientS3File) -Verbose | Out-Null
- 
+
      # Extract BOE Client Installer - there is no installer for this application
      Expand-Archive -Path (".\" + $Config.BOEWindowsClientS3File) -DestinationPath  (([System.IO.Path]::GetTempPath()) + "\BOE") -Force | Out-Null
 
      # Install BOE Windows Client
-     Start-Process -FilePath (([System.IO.Path]::GetTempPath()) + "\BOE\setup.exe") -ArgumentList "-r", "C:\Users\Administrator\AppData\Local\Temp\modernisation-platform-configuration-management\powershell\Configs\OnrClientResponse.ini" -Wait -NoNewWindow
-     
+     Start-Process -FilePath (([System.IO.Path]::GetTempPath()) + "\BOE\setup.exe") -ArgumentList "-r", "$ConfigurationManagementRepo\powershell\Configs\OnrClientResponse.ini" -Wait -NoNewWindow
+
      # Create a desktop shortcut for BOE Client Tools
     $WScriptShell = New-Object -ComObject WScript.Shell
     $targetPath = [System.IO.Path]::Combine([environment]::GetFolderPath("CommonStartMenu"), "Programs\BusinessObjects XI 3.1\BusinessObjects Enterprise Client Tools")
@@ -70,6 +139,37 @@ $GlobalConfig = @{
    }
  }
 
+ function Get-SecretValue {
+     param (
+         [Parameter(Mandatory)]
+         [string]$SecretId,
+         [Parameter(Mandatory)]
+         [string]$SecretKey
+     )
+
+     try {
+         $secretJson = aws secretsmanager get-secret-value --secret-id $SecretId --query SecretString --output text
+
+         if ($null -eq $secretJson -or $secretJson -eq '') {
+             Write-Host "The SecretId '$SecretId' does not exist or returned no value."
+             return $null
+         }
+
+         $secretObject = $secretJson | ConvertFrom-Json
+
+         if (-not $secretObject.PSObject.Properties.Name -contains $SecretKey) {
+             Write-Host "The SecretKey '$SecretKey' does not exist in the secret."
+             return $null
+         }
+
+         return $secretObject.$SecretKey
+     }
+     catch {
+         Write-Host "An error occurred while retrieving the secret: $_"
+         return $null
+     }
+ }
+
  function Add-Shortcuts {
   [CmdletBinding()]
   param (
@@ -93,43 +193,239 @@ $GlobalConfig = @{
   }
 }
 
+function Clear-PendingFileRenameOperations {
+    $regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager"
+    $regKey = "PendingFileRenameOperations"
+
+    if (Get-ItemProperty -Path $regPath -Name $regKey -ErrorAction SilentlyContinue) {
+        try {
+            Remove-ItemProperty -Path $regPath -Name $regKey -Force -ErrorAction Stop
+            Write-Host "Successfully removed $regKey from the registry."
+        }
+        catch {
+            Write-Warning "Failed to remove $regKey. Error: $_"
+        }
+    }
+    else {
+        Write-Host "$regKey does not exist in the registry. No action needed."
+    }
+}
+
+# Commented this out 'cause these will end up on the domain
 # Apply to all environments that aren't on the domain
-function Add-LoginText {
-  [CmdletBinding()]
-  param (
-    [hashtable]$Config
-  )
+# function Add-LoginText {
+#   [CmdletBinding()]
+#   param (
+#     [hashtable]$Config
+#   )
 
-  $ErrorActionPreference = "Stop"
-  Write-Output "Add Legal Notice"
-  
-  if (-NOT (Test-Path $Config.RegistryPath)) {
-    Write-Output " - Registry path does not exist, creating"
-    New-Item -Path $Config.RegistryPath -Force | Out-Null
+#   $ErrorActionPreference = "Stop"
+#   Write-Output "Add Legal Notice"
+
+#   if (-NOT (Test-Path $Config.RegistryPath)) {
+#     Write-Output " - Registry path does not exist, creating"
+#     New-Item -Path $Config.RegistryPath -Force | Out-Null
+#   }
+
+#   $RegistryPath = $Config.RegistryPath
+#   $LegalNoticeCaption = $Config.LegalNoticeCaption
+#   $LegalNoticeText = $Config.LegalNoticeText
+
+#   Write-Output " - Set Legal Notice Caption"
+#   New-ItemProperty -Path $RegistryPath -Name LegalNoticeCaption -Value $LegalNoticeCaption -PropertyType String -Force
+
+#   Write-Output " - Set Legal Notice Text"
+#   New-ItemProperty -Path $RegistryPath -Name LegalNoticeText -Value $LegalNoticeText -PropertyType String -Force
+# }
+
+function Move-ModPlatformADComputer {
+    [CmdletBinding()]
+    param (
+      [Parameter(Mandatory=$true)][System.Management.Automation.PSCredential]$ModPlatformADCredential,
+      [Parameter(Mandatory=$true)][string]$NewOU
+    )
+
+    $ErrorActionPreference = "Stop"
+
+      # Do nothing if host not part of domain
+  if (-not (Get-WmiObject -Class Win32_ComputerSystem).PartOfDomain) {
+    Return $false
+  }
+
+  # Install powershell features if missing
+  if (-not (Get-Module -ListAvailable -Name "ActiveDirectory")) {
+    Write-Host "INFO: Installing RSAT-AD-PowerShell feature"
+    Install-WindowsFeature -Name "RSAT-AD-PowerShell" -IncludeAllSubFeature
   }
 
-  $RegistryPath = $Config.RegistryPath
-  $LegalNoticeCaption = $Config.LegalNoticeCaption
-  $LegalNoticeText = $Config.LegalNoticeText
+  # Move the computer to the new OU
+  (Get-ADComputer -Credential $ModPlatformADCredential -Identity $env:COMPUTERNAME).objectGUID | Move-ADObject -TargetPath $NewOU -Credential $ModPlatformADCredential
+}
+
+# function Add-OracleClient {
+#     [CmdletBinding()]
+#     params(
+#         [string]$OracleClientPath,
+#         [hashtable]$Config
+#     )
+# }
 
-  Write-Output " - Set Legal Notice Caption"
-  New-ItemProperty -Path $RegistryPath -Name LegalNoticeCaption -Value $LegalNoticeCaption -PropertyType String -Force
+# }}} end of functions
 
-  Write-Output " - Set Legal Notice Text"
-  New-ItemProperty -Path $RegistryPath -Name LegalNoticeText -Value $LegalNoticeText -PropertyType String -Force
+# {{{ Prep the server for installation
+# Install PowerShell 5.1 if running on PowerShell 4 or below
+if ( $PSVersionTable.PSVersion.Major -le 4 ) {
+   choco install powershell -y
+   # reboot when run from ssm doc
+   exit 3010
 }
 
- # Install PowerShell 5.1 if running on PowerShell 4 or below
- if ( $PSVersionTable.PSVersion.Major -le 4 ) {
-    choco install powershell -y
-    # reboot when run from ssm doc
-    exit 3010
- }
+# Set the registry key to prefer IPv4 over IPv6
+Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" -Name "DisabledComponents" -Value 0x20 -Type DWord
+
+# Output a message to confirm the change
+Write-Host "Registry updated to prefer IPv4 over IPv6. A system restart is required for changes to take effect."
+
+# Turn off the firewall as this will possibly interfere with Sia Node creation
+# Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
+
+# Disable antivirus and other security during installation
+
+function Test-WindowsServer2012R2 {
+    $osVersion = (Get-WmiObject -Class Win32_OperatingSystem).Version
+    return $osVersion -like "6.3*"
+}
+
+if (-not (Test-WindowsServer2012R2)) {
+    # Disable real-time monitoring
+    Set-MpPreference -DisableRealtimeMonitoring $true
+
+    # Disable intrusion prevention system
+    Set-MpPreference -DisableIntrusionPreventionSystem $true
+
+    # Disable script scanning
+    Set-MpPreference -DisableScriptScanning $true
+
+    # Disable behavior monitoring
+    Set-MpPreference -DisableBehaviorMonitoring $true
+
+    Write-Host "Windows Security antivirus has been disabled. Please re-enable it as soon as possible for security reasons."
+} else {
+    Write-Host "Running on Windows Server 2012 R2. Skipping antivirus configuration."
+}
+
+# Set local time zone to UK although this should now be set by Group Policy objects
+Set-TimeZone -Name "GMT Standard Time"
+
+# }}} complete - add prerequisites to server
+#
+# {{{ join domain if domain-name tag is set
+# Join domain and reboot is needed before installers run
+$ErrorActionPreference = "Continue"
+Import-Module ModPlatformAD -Force
+$ADConfig = Get-ModPlatformADConfig
+if ($null -ne $ADConfig) {
+  $ADCredential = Get-ModPlatformADJoinCredential -ModPlatformADConfig $ADConfig
+  if (Add-ModPlatformADComputer -ModPlatformADConfig $ADConfig -ModPlatformADCredential $ADCredential) {
+    Exit 3010 # triggers reboot if running from SSM Doc
+  }
+} else {
+  Write-Output "No domain-name tag found so apply Local Group Policy"
+  . .\LocalGroupPolicy.ps1
+}
+# }}}
+
+# {{{ Get the config and tags for the instance
+$Config = Get-Config
+$Tags = Get-InstanceTags
+# }}}
+
+# {{{ Add computer to the correct OU
+Import-Module ModPlatformAD -Force
+$ADConfig = Get-ModPlatformADConfig
+
+# Get the AD Admin credentials
+$ADAdminCredential = Get-ModPlatformADAdminCredential -ModPlatformADConfig $ADConfig
+
+# Move the computer to the correct OU
+Move-ModPlatformADComputer -ModPlatformADCredential $ADAdminCredential -NewOU $($Config.nartComputersOU)
+
+# ensure computer is in the correct OU
+gpupdate /force
+
+# }}}
+
+# {{{ prepare assets
+Set-Location -Path $WorkingDirectory
+Get-Installer -Key $Config.Oracle11g64bitClientS3File -Destination (".\" + $Config.Oracle11g64bitClientS3File)
+Get-Installer -Key $Config.Oracle19c64bitClientS3File -Destination (".\" + $Config.Oracle19c64bitClientS3File)
+
+Expand-Archive ( ".\" + $Config.Oracle11g64bitClientS3File) -Destination ".\Oracle11g64bitClient"
+Expand-Archive ( ".\" + $Config.Oracle19c64bitClientS3File) -Destination ".\Oracle19c64bitClient"
+# }}}
+
+# {{{
+# TODO: Add Oracle client installation for 11g and 19c
+#
+# Create svc_nart credential object
+$service_user_password = Get-SecretValue -SecretId $bodsSecretName -SecretKey "svc_nart" -ErrorAction SilentlyContinue
+$credential = New-Object System.Management.Automation.PSCredential ("$($Config.domain)\$($Config.serviceUser)", $service_user_password)
+
+$response11gFileContent = @"
+oracle.install.responseFileVersion=/oracle/install/rspfmt_clientinstall_response_schema_v19.0.0
+ORACLE_HOME=$($Config.ORACLE_11G_HOME)
+ORACLE_BASE=$($Config.ORACLE_BASE)
+oracle.install.IsBuiltInAccount=false
+oracle.install.client.installType=Administrator
+"@
+
+$response11gFileContent | | Out-File -FilePath "$WorkingDirectory\Oracle11g64bitClient\client11g64bitinstall.rsp" -Force -Encoding ascii
+
+$response19cFileContent = @"
+oracle.install.responseFileVersion=/oracle/install/rspfmt_clientinstall_response_schema_v19.0.0
+ORACLE_HOME=$($Config.ORACLE_19C_HOME)
+ORACLE_BASE=$($Config.ORACLE_BASE)
+oracle.install.IsBuiltInAccount=false
+oracle.install.client.installType=Administrator
+"@
+
+$response19cFileContent | | Out-File -FilePath "$WorkingDirectory\Oracle11g64bitClient\client19c64bitinstall.rsp" -Force -Encoding ascii
+
+$oracle11gParams = @{
+    FilePath = ".\Oracle11g64bitClient\client\setup.exe"
+    ArgumentList = "-silent -noconfig -nowait -responseFile $WorkingDirectory\Oracle11g64bitClient\client11g64bitinstall.rsp"
+    Wait = $true
+    NoNewWindow = $true
+    Credential = $credential
+}
+
+# Start-Process @oracle11gParams
+
+# }}}
 
  choco install winscp.install -y
-  
+
  $ErrorActionPreference = "Stop"
  $Config = Get-Config
  Add-LoginText $Config
  Add-BOEWindowsClient $Config
  Add-Shortcuts $Config
+
+ # Re-enable antivirus settings if not Windows Server 2012 R2
+ if (-not (Test-WindowsServer2012R2)) {
+     # Re-enable real-time monitoring
+     Set-MpPreference -DisableRealtimeMonitoring $false
+
+     # Re-enable intrusion prevention system
+     Set-MpPreference -DisableIntrusionPreventionSystem $false
+
+     # Re-enable script scanning
+     Set-MpPreference -DisableScriptScanning $false
+
+     # Re-enable behavior monitoring
+     Set-MpPreference -DisableBehaviorMonitoring $false
+
+     Write-Host "Windows Security antivirus has been re-enabled."
+ } else {
+     Write-Host "Running on Windows Server 2012 R2. Antivirus configuration was not changed."
+ }

From d6090856bd37f6855bc7f7f50e369c560dd10330 Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Wed, 6 Nov 2024 14:54:38 +0000
Subject: [PATCH 02/23] remove syntax error from script

---
 .../Scripts/UserDataScripts/OnrClient.ps1     | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index bd372f525..8ef0f64c3 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -371,7 +371,7 @@ Expand-Archive ( ".\" + $Config.Oracle19c64bitClientS3File) -Destination ".\Orac
 $service_user_password = Get-SecretValue -SecretId $bodsSecretName -SecretKey "svc_nart" -ErrorAction SilentlyContinue
 $credential = New-Object System.Management.Automation.PSCredential ("$($Config.domain)\$($Config.serviceUser)", $service_user_password)
 
-$response11gFileContent = @"
+$11gResponseFileContent = @"
 oracle.install.responseFileVersion=/oracle/install/rspfmt_clientinstall_response_schema_v19.0.0
 ORACLE_HOME=$($Config.ORACLE_11G_HOME)
 ORACLE_BASE=$($Config.ORACLE_BASE)
@@ -379,9 +379,9 @@ oracle.install.IsBuiltInAccount=false
 oracle.install.client.installType=Administrator
 "@
 
-$response11gFileContent | | Out-File -FilePath "$WorkingDirectory\Oracle11g64bitClient\client11g64bitinstall.rsp" -Force -Encoding ascii
+$11gResponseFileContent | Out-File -FilePath "$WorkingDirectory\Oracle11g64bitClient\11gClient64bitinstall.rsp" -Force -Encoding ascii
 
-$response19cFileContent = @"
+$19cResponseFileContent = @"
 oracle.install.responseFileVersion=/oracle/install/rspfmt_clientinstall_response_schema_v19.0.0
 ORACLE_HOME=$($Config.ORACLE_19C_HOME)
 ORACLE_BASE=$($Config.ORACLE_BASE)
@@ -389,17 +389,27 @@ oracle.install.IsBuiltInAccount=false
 oracle.install.client.installType=Administrator
 "@
 
-$response19cFileContent | | Out-File -FilePath "$WorkingDirectory\Oracle11g64bitClient\client19c64bitinstall.rsp" -Force -Encoding ascii
+$19cResponseFileContent | Out-File -FilePath "$WorkingDirectory\Oracle11g64bitClient\19cClient64bitinstall.rsp" -Force -Encoding ascii
 
-$oracle11gParams = @{
+$11gClientParams = @{
     FilePath = ".\Oracle11g64bitClient\client\setup.exe"
-    ArgumentList = "-silent -noconfig -nowait -responseFile $WorkingDirectory\Oracle11g64bitClient\client11g64bitinstall.rsp"
+    ArgumentList = "-silent -noconfig -nowait -responseFile $WorkingDirectory\Oracle11g64bitClient\11gClient64bitinstall.rsp"
     Wait = $true
     NoNewWindow = $true
     Credential = $credential
 }
 
-# Start-Process @oracle11gParams
+$19cClientParams = @{
+    FilePath = ".\Oracle19c64bitClient\client\setup.exe"
+    ArgumentList = "-silent -noconfig -nowait -responseFile $WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp"
+    Wait = $true
+    NoNewWindow = $true
+    Credential = $credential
+}
+
+# Start-Process @11gClientParams
+
+# Start-Process @19cClientParams
 
 # }}}
 

From 7d9a0c0c0b93e3c70f796b047895ebf28e22d232 Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Wed, 6 Nov 2024 16:04:12 +0000
Subject: [PATCH 03/23] add missing function

---
 powershell/Scripts/UserDataScripts/OnrClient.ps1 | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index 8ef0f64c3..55fd7423e 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -88,6 +88,14 @@ function Get-Config {
     Return $GlobalConfig.all + $GlobalConfig[$EnvironmentNameTag]
 }
 
+function Get-InstanceTags {
+  $Token = Invoke-RestMethod -TimeoutSec 10 -Headers @{"X-aws-ec2-metadata-token-ttl-seconds"=3600} -Method PUT -Uri http://169.254.169.254/latest/api/token
+  $InstanceId = Invoke-RestMethod -TimeoutSec 10 -Headers @{"X-aws-ec2-metadata-token" = $Token} -Method GET -Uri http://169.254.169.254/latest/meta-data/instance-id
+  $TagsRaw = aws ec2 describe-tags --filters "Name=resource-id,Values=$InstanceId"
+  $Tags = $TagsRaw | ConvertFrom-Json
+  $Tags.Tags
+}
+
 function Get-Installer {
     param (
         [Parameter(Mandatory)]
@@ -389,7 +397,7 @@ oracle.install.IsBuiltInAccount=false
 oracle.install.client.installType=Administrator
 "@
 
-$19cResponseFileContent | Out-File -FilePath "$WorkingDirectory\Oracle11g64bitClient\19cClient64bitinstall.rsp" -Force -Encoding ascii
+$19cResponseFileContent | Out-File -FilePath "$WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp" -Force -Encoding ascii
 
 $11gClientParams = @{
     FilePath = ".\Oracle11g64bitClient\client\setup.exe"
@@ -417,7 +425,7 @@ $19cClientParams = @{
 
  $ErrorActionPreference = "Stop"
  $Config = Get-Config
- Add-LoginText $Config
+ # Add-LoginText $Config - not needed as this is now set by Group Policy
  Add-BOEWindowsClient $Config
  Add-Shortcuts $Config
 

From 47dbbc0e4cfa76d53c2650ff07b1f1f0176c0019 Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Wed, 6 Nov 2024 16:28:45 +0000
Subject: [PATCH 04/23] make sure the module is available on reboot

---
 powershell/Scripts/UserDataScripts/OnrClient.ps1 | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index 55fd7423e..8e6bf6a9b 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -43,6 +43,7 @@ $GlobalConfig = @{
  $tempPath = ([System.IO.Path]::GetTempPath())
 
  $ConfigurationManagementRepo = "$tempPath\modernisation-platform-configuration-management"
+ $ModulesRepo = "$ConfigurationManagementRepo\powershell\Modules"
  $ErrorActionPreference = "Stop"
  $WorkingDirectory = "C:\Software"
  $AppDirectory = "C:\App"
@@ -348,7 +349,10 @@ $Config = Get-Config
 $Tags = Get-InstanceTags
 # }}}
 
+
 # {{{ Add computer to the correct OU
+$env:PSModulePath = "$ModulesRepo;$env:PSModulePath"
+
 Import-Module ModPlatformAD -Force
 $ADConfig = Get-ModPlatformADConfig
 

From bb56ca9618c4c0eadd4fecf70c106599d4ae824e Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Wed, 6 Nov 2024 16:49:33 +0000
Subject: [PATCH 05/23] change config values as these are hardcoded elsewhere

---
 .../Scripts/UserDataScripts/OnrClient.ps1     | 35 +++----------------
 1 file changed, 5 insertions(+), 30 deletions(-)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index 8e6bf6a9b..e2a7cffcd 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -1,7 +1,7 @@
 $GlobalConfig = @{
     "all" = @{
-         "BOEWindowsClientS3Bucket" = "mod-platform-image-artefact-bucket20230203091453221500000001"
-         "BOEWindowsClientS3Folder" = "hmpps/onr"
+         "WindowsClientS3Bucket" = "mod-platform-image-artefact-bucket20230203091453221500000001"
+         "WindowsClientS3Folder" = "hmpps/onr"
          "BOEWindowsClientS3File" = "51048121.ZIP"
          "Oracle11g64bitClientS3File" = "V20609-01.zip"
          "Oracle19c64bitClientS3File" = "WINDOWS.X64_193000_client.zip" # Oracle 19c client SW, install 1st"
@@ -220,33 +220,6 @@ function Clear-PendingFileRenameOperations {
     }
 }
 
-# Commented this out 'cause these will end up on the domain
-# Apply to all environments that aren't on the domain
-# function Add-LoginText {
-#   [CmdletBinding()]
-#   param (
-#     [hashtable]$Config
-#   )
-
-#   $ErrorActionPreference = "Stop"
-#   Write-Output "Add Legal Notice"
-
-#   if (-NOT (Test-Path $Config.RegistryPath)) {
-#     Write-Output " - Registry path does not exist, creating"
-#     New-Item -Path $Config.RegistryPath -Force | Out-Null
-#   }
-
-#   $RegistryPath = $Config.RegistryPath
-#   $LegalNoticeCaption = $Config.LegalNoticeCaption
-#   $LegalNoticeText = $Config.LegalNoticeText
-
-#   Write-Output " - Set Legal Notice Caption"
-#   New-ItemProperty -Path $RegistryPath -Name LegalNoticeCaption -Value $LegalNoticeCaption -PropertyType String -Force
-
-#   Write-Output " - Set Legal Notice Text"
-#   New-ItemProperty -Path $RegistryPath -Name LegalNoticeText -Value $LegalNoticeText -PropertyType String -Force
-# }
-
 function Move-ModPlatformADComputer {
     [CmdletBinding()]
     param (
@@ -380,6 +353,9 @@ Expand-Archive ( ".\" + $Config.Oracle19c64bitClientS3File) -Destination ".\Orac
 # TODO: Add Oracle client installation for 11g and 19c
 #
 # Create svc_nart credential object
+$dbenv = ($Tags | Where-Object { $_.Key -eq "oasys-national-reporting-environment" }).Value
+$bodsSecretName  = "/sap/bods/$dbenv/passwords"
+
 $service_user_password = Get-SecretValue -SecretId $bodsSecretName -SecretKey "svc_nart" -ErrorAction SilentlyContinue
 $credential = New-Object System.Management.Automation.PSCredential ("$($Config.domain)\$($Config.serviceUser)", $service_user_password)
 
@@ -429,7 +405,6 @@ $19cClientParams = @{
 
  $ErrorActionPreference = "Stop"
  $Config = Get-Config
- # Add-LoginText $Config - not needed as this is now set by Group Policy
  Add-BOEWindowsClient $Config
  Add-Shortcuts $Config
 

From 40358fb4d1e80df28809403f042353cc3aa94cf2 Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Wed, 6 Nov 2024 18:32:07 +0000
Subject: [PATCH 06/23] add response files ready for test

---
 powershell/Configs/11gClientResp.rsp          |  0
 powershell/Configs/19cClientResp.rsp          |  0
 .../Scripts/UserDataScripts/OnrClient.ps1     | 28 +++++++++++--------
 3 files changed, 17 insertions(+), 11 deletions(-)
 create mode 100644 powershell/Configs/11gClientResp.rsp
 create mode 100644 powershell/Configs/19cClientResp.rsp

diff --git a/powershell/Configs/11gClientResp.rsp b/powershell/Configs/11gClientResp.rsp
new file mode 100644
index 000000000..e69de29bb
diff --git a/powershell/Configs/19cClientResp.rsp b/powershell/Configs/19cClientResp.rsp
new file mode 100644
index 000000000..e69de29bb
diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index e2a7cffcd..98b359da5 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -3,9 +3,9 @@ $GlobalConfig = @{
          "WindowsClientS3Bucket" = "mod-platform-image-artefact-bucket20230203091453221500000001"
          "WindowsClientS3Folder" = "hmpps/onr"
          "BOEWindowsClientS3File" = "51048121.ZIP"
-         "Oracle11g64bitClientS3File" = "V20609-01.zip"
+         "Oracle11g32bitClientS3File" = "V20609-01.zip"
          "Oracle19c64bitClientS3File" = "WINDOWS.X64_193000_client.zip" # Oracle 19c client SW, install 1st"
-         "ORACLE_19C_HOME"       = "E:\app\oracle\product\19.0.0\client_1"
+         "ORACLE_19C_HOME"       = "C:\app\oracle\product\19.0.0\client_1"
          "ORACLE_11G_HOME"       = "E:\app\oracle\product\11.2.0\client_1"
          "ORACLE_BASE"           = "E:\app\oracle"
          "RegistryPath" = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\winlogon"
@@ -342,10 +342,10 @@ gpupdate /force
 
 # {{{ prepare assets
 Set-Location -Path $WorkingDirectory
-Get-Installer -Key $Config.Oracle11g64bitClientS3File -Destination (".\" + $Config.Oracle11g64bitClientS3File)
+Get-Installer -Key $Config.Oracle11g32bitClientS3File -Destination (".\" + $Config.Oracle11g32bitClientS3File)
 Get-Installer -Key $Config.Oracle19c64bitClientS3File -Destination (".\" + $Config.Oracle19c64bitClientS3File)
 
-Expand-Archive ( ".\" + $Config.Oracle11g64bitClientS3File) -Destination ".\Oracle11g64bitClient"
+Expand-Archive ( ".\" + $Config.Oracle11g32bitClientS3File) -Destination ".\Oracle11g32bitClient"
 Expand-Archive ( ".\" + $Config.Oracle19c64bitClientS3File) -Destination ".\Oracle19c64bitClient"
 # }}}
 
@@ -359,29 +359,35 @@ $bodsSecretName  = "/sap/bods/$dbenv/passwords"
 $service_user_password = Get-SecretValue -SecretId $bodsSecretName -SecretKey "svc_nart" -ErrorAction SilentlyContinue
 $credential = New-Object System.Management.Automation.PSCredential ("$($Config.domain)\$($Config.serviceUser)", $service_user_password)
 
+$DomainName = (Get-WmiObject -Class Win32_ComputerSystem).Domain
+
 $11gResponseFileContent = @"
-oracle.install.responseFileVersion=/oracle/install/rspfmt_clientinstall_response_schema_v19.0.0
+oracle.install.responseFileVersion=http://www.oracle.com/2007/install/rspfmt_clientinstall_response_schema_v11_2_0
+ORACLE_HOSTNAME=$($env:COMPUTERNAME).$DomainName
+INVENTORY_LOCATION=C:\Program Files\Oracle\Inventory
+SELECTED_LANGUAGES=en
 ORACLE_HOME=$($Config.ORACLE_11G_HOME)
 ORACLE_BASE=$($Config.ORACLE_BASE)
-oracle.install.IsBuiltInAccount=false
 oracle.install.client.installType=Administrator
+oracle.install.client.oramtsPortNumber=49157
 "@
 
-$11gResponseFileContent | Out-File -FilePath "$WorkingDirectory\Oracle11g64bitClient\11gClient64bitinstall.rsp" -Force -Encoding ascii
+$11gResponseFileContent | Out-File -FilePath "$WorkingDirectory\Oracle11g32bitClient\11gClient32bitinstall.rsp" -Force -Encoding ascii
 
 $19cResponseFileContent = @"
 oracle.install.responseFileVersion=/oracle/install/rspfmt_clientinstall_response_schema_v19.0.0
 ORACLE_HOME=$($Config.ORACLE_19C_HOME)
 ORACLE_BASE=$($Config.ORACLE_BASE)
 oracle.install.IsBuiltInAccount=false
+oracle.install.OracleHomeUserName=$($Config.domain)\$($Config.serviceUser)
 oracle.install.client.installType=Administrator
 "@
 
 $19cResponseFileContent | Out-File -FilePath "$WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp" -Force -Encoding ascii
 
 $11gClientParams = @{
-    FilePath = ".\Oracle11g64bitClient\client\setup.exe"
-    ArgumentList = "-silent -noconfig -nowait -responseFile $WorkingDirectory\Oracle11g64bitClient\11gClient64bitinstall.rsp"
+    FilePath = ".\Oracle11g32bitClient\client\setup.exe"
+    ArgumentList = "-silent","-noconfig","oracle.install.OracleHomeUserPassword=$service_user_password","-responseFile $WorkingDirectory\Oracle11g32bitClient\11gClient32bitinstall.rsp"
     Wait = $true
     NoNewWindow = $true
     Credential = $credential
@@ -395,9 +401,9 @@ $19cClientParams = @{
     Credential = $credential
 }
 
-# Start-Process @11gClientParams
+Start-Process @11gClientParams
 
-# Start-Process @19cClientParams
+Start-Process @19cClientParams
 
 # }}}
 

From 0988450c03dc98271a681051f75fe699a2314918 Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Wed, 6 Nov 2024 18:49:25 +0000
Subject: [PATCH 07/23] install 32 bit 11g client instead

---
 powershell/Scripts/UserDataScripts/OnrClient.ps1 | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index 98b359da5..30381f93c 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -3,7 +3,8 @@ $GlobalConfig = @{
          "WindowsClientS3Bucket" = "mod-platform-image-artefact-bucket20230203091453221500000001"
          "WindowsClientS3Folder" = "hmpps/onr"
          "BOEWindowsClientS3File" = "51048121.ZIP"
-         "Oracle11g32bitClientS3File" = "V20609-01.zip"
+         "Oracle11g32bitClientS3File" = "V20606-01.zip"
+         # "Oracle11g64bitClientS3File" = "V20609-01.zip"
          "Oracle19c64bitClientS3File" = "WINDOWS.X64_193000_client.zip" # Oracle 19c client SW, install 1st"
          "ORACLE_19C_HOME"       = "C:\app\oracle\product\19.0.0\client_1"
          "ORACLE_11G_HOME"       = "E:\app\oracle\product\11.2.0\client_1"

From 2175b9b080be6c09ef6e260f09d09ea4b16bae95 Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Thu, 7 Nov 2024 11:25:37 +0000
Subject: [PATCH 08/23] fix credential creation

---
 powershell/Scripts/UserDataScripts/OnrClient.ps1 | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index 30381f93c..3374f5fd5 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -358,7 +358,8 @@ $dbenv = ($Tags | Where-Object { $_.Key -eq "oasys-national-reporting-environmen
 $bodsSecretName  = "/sap/bods/$dbenv/passwords"
 
 $service_user_password = Get-SecretValue -SecretId $bodsSecretName -SecretKey "svc_nart" -ErrorAction SilentlyContinue
-$credential = New-Object System.Management.Automation.PSCredential ("$($Config.domain)\$($Config.serviceUser)", $service_user_password)
+$service_user_secure_password = ConvertTo-SecureString -String $service_user_password -AsPlainText -Force
+$credential = New-Object System.Management.Automation.PSCredential ("$($Config.domain)\$($Config.serviceUser)", $service_user_secure_password)
 
 $DomainName = (Get-WmiObject -Class Win32_ComputerSystem).Domain
 

From 176e126a7661af8bd8cabeab11afd0f8b409324c Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Thu, 7 Nov 2024 14:04:00 +0000
Subject: [PATCH 09/23] fix install params, remove credentials

---
 powershell/Scripts/UserDataScripts/OnrClient.ps1 | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index 3374f5fd5..3c8e59087 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -129,7 +129,7 @@ function Get-Installer {
    } else {
      Write-Output "Add BOE Windows Client"
      Set-Location -Path ([System.IO.Path]::GetTempPath())
-     Read-S3Object -BucketName $Config.BOEWindowsClientS3Bucket -Key ($Config.BOEWindowsClientS3Folder + "/" + $Config.BOEWindowsClientS3File) -File (".\" + $Config.BOEWindowsClientS3File) -Verbose | Out-Null
+     Read-S3Object -BucketName $Config.WindowsClientS3Bucket -Key ($Config.WindowsClientS3Folder + "/" + $Config.BOEWindowsClientS3File) -File (".\" + $Config.BOEWindowsClientS3File) -Verbose | Out-Null
 
      # Extract BOE Client Installer - there is no installer for this application
      Expand-Archive -Path (".\" + $Config.BOEWindowsClientS3File) -DestinationPath  (([System.IO.Path]::GetTempPath()) + "\BOE") -Force | Out-Null
@@ -389,18 +389,18 @@ $19cResponseFileContent | Out-File -FilePath "$WorkingDirectory\Oracle19c64bitCl
 
 $11gClientParams = @{
     FilePath = ".\Oracle11g32bitClient\client\setup.exe"
-    ArgumentList = "-silent","-noconfig","oracle.install.OracleHomeUserPassword=$service_user_password","-responseFile $WorkingDirectory\Oracle11g32bitClient\11gClient32bitinstall.rsp"
+    ArgumentList = "-silent","-noconfig","-responseFile $WorkingDirectory\Oracle11g32bitClient\11gClient32bitinstall.rsp"
     Wait = $true
     NoNewWindow = $true
-    Credential = $credential
+    # Credential = $credential
 }
 
 $19cClientParams = @{
     FilePath = ".\Oracle19c64bitClient\client\setup.exe"
-    ArgumentList = "-silent -noconfig -nowait -responseFile $WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp"
+    ArgumentList = "-silent","-noconfig","-nowait","oracle.install.OracleHomeUserPassword=$service_user_password","-responseFile $WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp"
     Wait = $true
     NoNewWindow = $true
-    Credential = $credential
+    # Credential = $credential
 }
 
 Start-Process @11gClientParams

From 93404793567149f840e82d4d48b2cdcb8e30d386 Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Thu, 7 Nov 2024 16:59:23 +0000
Subject: [PATCH 10/23] fix installer params

---
 powershell/Scripts/UserDataScripts/OnrClient.ps1 | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index 3c8e59087..f3793e35c 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -388,16 +388,16 @@ oracle.install.client.installType=Administrator
 $19cResponseFileContent | Out-File -FilePath "$WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp" -Force -Encoding ascii
 
 $11gClientParams = @{
-    FilePath = ".\Oracle11g32bitClient\client\setup.exe"
-    ArgumentList = "-silent","-noconfig","-responseFile $WorkingDirectory\Oracle11g32bitClient\11gClient32bitinstall.rsp"
+    FilePath = "$WorkingDirectory\Oracle11g32bitClient\client\setup.exe"
+    ArgumentList = "-silent","-nowelcome","-nowait","-noconfig","-responseFile $WorkingDirectory\Oracle11g32bitClient\11gClient32bitinstall.rsp"
     Wait = $true
     NoNewWindow = $true
     # Credential = $credential
 }
 
 $19cClientParams = @{
-    FilePath = ".\Oracle19c64bitClient\client\setup.exe"
-    ArgumentList = "-silent","-noconfig","-nowait","oracle.install.OracleHomeUserPassword=$service_user_password","-responseFile $WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp"
+    FilePath = "$WorkingDirectory\Oracle19c64bitClient\client\setup.exe"
+    ArgumentList = "-silent","oracle.install.OracleHomeUserPassword=$service_user_password","-noconfig","-nowait","-responseFile $WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp"
     Wait = $true
     NoNewWindow = $true
     # Credential = $credential

From 2c914c5008968c45ca2c939ff5a3ff6c39da914e Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Fri, 8 Nov 2024 12:57:59 +0000
Subject: [PATCH 11/23] install 64 bit installer and use RunAs

---
 powershell/Scripts/UserDataScripts/OnrClient.ps1 | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index f3793e35c..e571e5c6e 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -3,8 +3,8 @@ $GlobalConfig = @{
          "WindowsClientS3Bucket" = "mod-platform-image-artefact-bucket20230203091453221500000001"
          "WindowsClientS3Folder" = "hmpps/onr"
          "BOEWindowsClientS3File" = "51048121.ZIP"
-         "Oracle11g32bitClientS3File" = "V20606-01.zip"
-         # "Oracle11g64bitClientS3File" = "V20609-01.zip"
+         # "Oracle11g32bitClientS3File" = "V20606-01.zip"
+         "Oracle11g64bitClientS3File" = "V20609-01.zip"
          "Oracle19c64bitClientS3File" = "WINDOWS.X64_193000_client.zip" # Oracle 19c client SW, install 1st"
          "ORACLE_19C_HOME"       = "C:\app\oracle\product\19.0.0\client_1"
          "ORACLE_11G_HOME"       = "E:\app\oracle\product\11.2.0\client_1"
@@ -343,10 +343,10 @@ gpupdate /force
 
 # {{{ prepare assets
 Set-Location -Path $WorkingDirectory
-Get-Installer -Key $Config.Oracle11g32bitClientS3File -Destination (".\" + $Config.Oracle11g32bitClientS3File)
+Get-Installer -Key $Config.Oracle11g64bitClientS3File -Destination (".\" + $Config.Oracle11g64bitClientS3File)
 Get-Installer -Key $Config.Oracle19c64bitClientS3File -Destination (".\" + $Config.Oracle19c64bitClientS3File)
 
-Expand-Archive ( ".\" + $Config.Oracle11g32bitClientS3File) -Destination ".\Oracle11g32bitClient"
+Expand-Archive ( ".\" + $Config.Oracle11g64bitClientS3File) -Destination ".\Oracle11g64bitClient"
 Expand-Archive ( ".\" + $Config.Oracle19c64bitClientS3File) -Destination ".\Oracle19c64bitClient"
 # }}}
 
@@ -374,7 +374,7 @@ oracle.install.client.installType=Administrator
 oracle.install.client.oramtsPortNumber=49157
 "@
 
-$11gResponseFileContent | Out-File -FilePath "$WorkingDirectory\Oracle11g32bitClient\11gClient32bitinstall.rsp" -Force -Encoding ascii
+$11gResponseFileContent | Out-File -FilePath "$WorkingDirectory\Oracle11g64bitClient\11gClient64bitinstall.rsp" -Force -Encoding ascii
 
 $19cResponseFileContent = @"
 oracle.install.responseFileVersion=/oracle/install/rspfmt_clientinstall_response_schema_v19.0.0
@@ -388,10 +388,11 @@ oracle.install.client.installType=Administrator
 $19cResponseFileContent | Out-File -FilePath "$WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp" -Force -Encoding ascii
 
 $11gClientParams = @{
-    FilePath = "$WorkingDirectory\Oracle11g32bitClient\client\setup.exe"
-    ArgumentList = "-silent","-nowelcome","-nowait","-noconfig","-responseFile $WorkingDirectory\Oracle11g32bitClient\11gClient32bitinstall.rsp"
+    FilePath = "$WorkingDirectory\Oracle11g64bitClient\client\setup.exe"
+    ArgumentList = "-silent","-nowelcome","-nowait","-noconfig","-responseFile $WorkingDirectory\Oracle11g64bitClient\11gClient64bitinstall.rsp"
     Wait = $true
     NoNewWindow = $true
+    Verb = "RunAs"
     # Credential = $credential
 }
 
@@ -400,6 +401,7 @@ $19cClientParams = @{
     ArgumentList = "-silent","oracle.install.OracleHomeUserPassword=$service_user_password","-noconfig","-nowait","-responseFile $WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp"
     Wait = $true
     NoNewWindow = $true
+    Verb = "RunAs"
     # Credential = $credential
 }
 

From 155976de2879aef53f757fa2af512c0ab3102c07 Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Fri, 8 Nov 2024 13:09:10 +0000
Subject: [PATCH 12/23] run as elevated

---
 powershell/Scripts/UserDataScripts/OnrClient.ps1 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index e571e5c6e..6ea0ca58e 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -391,7 +391,7 @@ $11gClientParams = @{
     FilePath = "$WorkingDirectory\Oracle11g64bitClient\client\setup.exe"
     ArgumentList = "-silent","-nowelcome","-nowait","-noconfig","-responseFile $WorkingDirectory\Oracle11g64bitClient\11gClient64bitinstall.rsp"
     Wait = $true
-    NoNewWindow = $true
+    # NoNewWindow = $true
     Verb = "RunAs"
     # Credential = $credential
 }
@@ -400,7 +400,7 @@ $19cClientParams = @{
     FilePath = "$WorkingDirectory\Oracle19c64bitClient\client\setup.exe"
     ArgumentList = "-silent","oracle.install.OracleHomeUserPassword=$service_user_password","-noconfig","-nowait","-responseFile $WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp"
     Wait = $true
-    NoNewWindow = $true
+    # NoNewWindow = $true
     Verb = "RunAs"
     # Credential = $credential
 }

From d025e262716560e90c22f3c0dfa51f7d8051a221 Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Fri, 8 Nov 2024 17:11:59 +0000
Subject: [PATCH 13/23] moar debug and do a reboot after moving the server

---
 .../Scripts/UserDataScripts/OnrClient.ps1     | 48 +++++++++++++++----
 1 file changed, 40 insertions(+), 8 deletions(-)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index 6ea0ca58e..38166609b 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -304,12 +304,17 @@ Set-TimeZone -Name "GMT Standard Time"
 #
 # {{{ join domain if domain-name tag is set
 # Join domain and reboot is needed before installers run
+$env:PSModulePath = "$ModulesRepo;$env:PSModulePath"
 $ErrorActionPreference = "Continue"
 Import-Module ModPlatformAD -Force
 $ADConfig = Get-ModPlatformADConfig
 if ($null -ne $ADConfig) {
   $ADCredential = Get-ModPlatformADJoinCredential -ModPlatformADConfig $ADConfig
   if (Add-ModPlatformADComputer -ModPlatformADConfig $ADConfig -ModPlatformADCredential $ADCredential) {
+    # Get the AD Admin credentials
+    $ADAdminCredential = Get-ModPlatformADAdminCredential -ModPlatformADConfig $ADConfig
+    # Move the computer to the correct OU
+    Move-ModPlatformADComputer -ModPlatformADCredential $ADAdminCredential -NewOU $($Config.nartComputersOU)
     Exit 3010 # triggers reboot if running from SSM Doc
   }
 } else {
@@ -325,16 +330,16 @@ $Tags = Get-InstanceTags
 
 
 # {{{ Add computer to the correct OU
-$env:PSModulePath = "$ModulesRepo;$env:PSModulePath"
-
-Import-Module ModPlatformAD -Force
-$ADConfig = Get-ModPlatformADConfig
+# $env:PSModulePath = "$ModulesRepo;$env:PSModulePath"
+#
+# Import-Module ModPlatformAD -Force
+# $ADConfig = Get-ModPlatformADConfig
 
 # Get the AD Admin credentials
-$ADAdminCredential = Get-ModPlatformADAdminCredential -ModPlatformADConfig $ADConfig
+# $ADAdminCredential = Get-ModPlatformADAdminCredential -ModPlatformADConfig $ADConfig
 
 # Move the computer to the correct OU
-Move-ModPlatformADComputer -ModPlatformADCredential $ADAdminCredential -NewOU $($Config.nartComputersOU)
+# Move-ModPlatformADComputer -ModPlatformADCredential $ADAdminCredential -NewOU $($Config.nartComputersOU)
 
 # ensure computer is in the correct OU
 gpupdate /force
@@ -387,27 +392,54 @@ oracle.install.client.installType=Administrator
 
 $19cResponseFileContent | Out-File -FilePath "$WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp" -Force -Encoding ascii
 
+$logFile11g = "$WorkingDirectory\Oracle11g64bitClient\install.log"
+New-Item -ItemType File -Path $logFilellg -Force
+
 $11gClientParams = @{
     FilePath = "$WorkingDirectory\Oracle11g64bitClient\client\setup.exe"
     ArgumentList = "-silent","-nowelcome","-nowait","-noconfig","-responseFile $WorkingDirectory\Oracle11g64bitClient\11gClient64bitinstall.rsp"
     Wait = $true
+    WindowsStyle = "Hidden"
     # NoNewWindow = $true
     Verb = "RunAs"
     # Credential = $credential
 }
 
+try {
+    "Starting Oracle 11g 64-bit client installation at $(Get-Date)" | Out-File -FilePath $logFile11g -Append
+    Start-Process @11gClientParams
+}
+catch {
+    $exception = $_.Exception
+    $exception.Message | Out-File -FilePath $logFilellg -Append
+    Write-Host "Failed to install Oracle 11g 64-bit client. Error: $_"
+}
+
+$logFile19c = "$WorkingDirectory\Oracle19c64bitClient\install.log"
+New-Item -ItemType File -Path $logFile19c -Force
+
+"Starting Oracle 19c 64-bit client installation at $(Get-Date)" | Out-File -FilePath $logFile19c -Append
+
 $19cClientParams = @{
     FilePath = "$WorkingDirectory\Oracle19c64bitClient\client\setup.exe"
     ArgumentList = "-silent","oracle.install.OracleHomeUserPassword=$service_user_password","-noconfig","-nowait","-responseFile $WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp"
     Wait = $true
+    WindowStyle = "Hidden"
     # NoNewWindow = $true
     Verb = "RunAs"
     # Credential = $credential
 }
 
-Start-Process @11gClientParams
+try {
+  "Starting Oracle 19c 64-bit client installation at $(Get-Date)" | Out-File -FilePath $logFile19c -Append
+  Start-Process @19cClientParams
+} catch {
+  $exception = $_.Exception
+  $exception.Message | Out-File -FilePath $logFile19c -Append
+  Write-Host "Failed to install Oracle 19c 64-bit client. Error $_"
+}
+
 
-Start-Process @19cClientParams
 
 # }}}
 

From 3c3c91cb1ae391ce9659370ed0f00c1eeffcb2e1 Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Fri, 8 Nov 2024 17:57:10 +0000
Subject: [PATCH 14/23] get config

---
 powershell/Scripts/UserDataScripts/OnrClient.ps1 | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index 38166609b..83f446b98 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -302,6 +302,8 @@ Set-TimeZone -Name "GMT Standard Time"
 
 # }}} complete - add prerequisites to server
 #
+$Config = Get-Config
+$Tags = Get-InstanceTags
 # {{{ join domain if domain-name tag is set
 # Join domain and reboot is needed before installers run
 $env:PSModulePath = "$ModulesRepo;$env:PSModulePath"

From 82bc160cb8c09f7e4f1d39d170dc1561e2204e75 Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Fri, 8 Nov 2024 18:39:27 +0000
Subject: [PATCH 15/23] exception message failure

---
 powershell/Scripts/UserDataScripts/OnrClient.ps1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index 83f446b98..71c1bbfe6 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -413,7 +413,7 @@ try {
 }
 catch {
     $exception = $_.Exception
-    $exception.Message | Out-File -FilePath $logFilellg -Append
+    $exception.Message | Out-File -FilePath $logFile11g -Append
     Write-Host "Failed to install Oracle 11g 64-bit client. Error: $_"
 }
 

From db4d95c8249a4cc8754c4505fe686545940becb8 Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Mon, 11 Nov 2024 10:11:53 +0000
Subject: [PATCH 16/23] get a group policy report after the changes

---
 powershell/Scripts/UserDataScripts/OnrClient.ps1 | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index 71c1bbfe6..1202990a5 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -346,6 +346,8 @@ $Tags = Get-InstanceTags
 # ensure computer is in the correct OU
 gpupdate /force
 
+gpresult /h "C:\Windows\Temp\gpresult.html"
+
 # }}}
 
 # {{{ prepare assets

From 48d17715295b37ab3cf466518596c7142911893b Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Mon, 11 Nov 2024 11:07:13 +0000
Subject: [PATCH 17/23] fix install params

---
 powershell/Scripts/UserDataScripts/OnrClient.ps1 | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index 1202990a5..f2180f05f 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -346,7 +346,7 @@ $Tags = Get-InstanceTags
 # ensure computer is in the correct OU
 gpupdate /force
 
-gpresult /h "C:\Windows\Temp\gpresult.html"
+gpresult /h "$WorkingDirectory\gpresult.html"
 
 # }}}
 
@@ -397,13 +397,14 @@ oracle.install.client.installType=Administrator
 $19cResponseFileContent | Out-File -FilePath "$WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp" -Force -Encoding ascii
 
 $logFile11g = "$WorkingDirectory\Oracle11g64bitClient\install.log"
-New-Item -ItemType File -Path $logFilellg -Force
+New-Item -ItemType File -Path $logFile11g -Force
 
 $11gClientParams = @{
     FilePath = "$WorkingDirectory\Oracle11g64bitClient\client\setup.exe"
+    WorkingDirectory = "$WorkingDirectory\Oracle11g64bitClient\client"
     ArgumentList = "-silent","-nowelcome","-nowait","-noconfig","-responseFile $WorkingDirectory\Oracle11g64bitClient\11gClient64bitinstall.rsp"
     Wait = $true
-    WindowsStyle = "Hidden"
+    WindowStyle = "Hidden"
     # NoNewWindow = $true
     Verb = "RunAs"
     # Credential = $credential
@@ -422,11 +423,10 @@ catch {
 $logFile19c = "$WorkingDirectory\Oracle19c64bitClient\install.log"
 New-Item -ItemType File -Path $logFile19c -Force
 
-"Starting Oracle 19c 64-bit client installation at $(Get-Date)" | Out-File -FilePath $logFile19c -Append
-
 $19cClientParams = @{
     FilePath = "$WorkingDirectory\Oracle19c64bitClient\client\setup.exe"
-    ArgumentList = "-silent","oracle.install.OracleHomeUserPassword=$service_user_password","-noconfig","-nowait","-responseFile $WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp"
+    WorkingDirectory = "$WorkingDirectory\Oracle19c64bitClient\client"
+    ArgumentList = "-silent oracle.install.OracleHomeUserPassword=$service_user_password -noconfig -nowait -responseFile $WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp"
     Wait = $true
     WindowStyle = "Hidden"
     # NoNewWindow = $true

From 45d07c8260295d03a9cab60033473046b6a4a8be Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Mon, 11 Nov 2024 11:59:19 +0000
Subject: [PATCH 18/23] make sure gpupdate runs

---
 powershell/Scripts/UserDataScripts/OnrClient.ps1 | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index f2180f05f..1055cc52a 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -344,9 +344,9 @@ $Tags = Get-InstanceTags
 # Move-ModPlatformADComputer -ModPlatformADCredential $ADAdminCredential -NewOU $($Config.nartComputersOU)
 
 # ensure computer is in the correct OU
-gpupdate /force
+Start-Process -FilePath "gpupdate.exe" -ArgumentList "/force" -Wait -NoNewWindow
 
-gpresult /h "$WorkingDirectory\gpresult.html"
+Start-Process -FilePath "gpresult.exe" -ArgumentList "/h", "$WorkingDirectory\gpresult.html" -Wait -NoNewWindow
 
 # }}}
 
@@ -404,9 +404,9 @@ $11gClientParams = @{
     WorkingDirectory = "$WorkingDirectory\Oracle11g64bitClient\client"
     ArgumentList = "-silent","-nowelcome","-nowait","-noconfig","-responseFile $WorkingDirectory\Oracle11g64bitClient\11gClient64bitinstall.rsp"
     Wait = $true
-    WindowStyle = "Hidden"
-    # NoNewWindow = $true
-    Verb = "RunAs"
+    NoNewWindow = $true
+    # WindowStyle = "Hidden"
+    # Verb = "RunAs"
     # Credential = $credential
 }
 
@@ -428,9 +428,9 @@ $19cClientParams = @{
     WorkingDirectory = "$WorkingDirectory\Oracle19c64bitClient\client"
     ArgumentList = "-silent oracle.install.OracleHomeUserPassword=$service_user_password -noconfig -nowait -responseFile $WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp"
     Wait = $true
-    WindowStyle = "Hidden"
-    # NoNewWindow = $true
-    Verb = "RunAs"
+    # WindowStyle = "Hidden"
+    NoNewWindow = $true
+    # Verb = "RunAs"
     # Credential = $credential
 }
 

From 13c1c12c5b60c3e0fabd9577209d5e4dce8a4a7a Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Mon, 11 Nov 2024 13:25:23 +0000
Subject: [PATCH 19/23] fix silent installer params

---
 powershell/Scripts/UserDataScripts/OnrClient.ps1 | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index 1055cc52a..9aadb8bf1 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -7,8 +7,8 @@ $GlobalConfig = @{
          "Oracle11g64bitClientS3File" = "V20609-01.zip"
          "Oracle19c64bitClientS3File" = "WINDOWS.X64_193000_client.zip" # Oracle 19c client SW, install 1st"
          "ORACLE_19C_HOME"       = "C:\app\oracle\product\19.0.0\client_1"
-         "ORACLE_11G_HOME"       = "E:\app\oracle\product\11.2.0\client_1"
-         "ORACLE_BASE"           = "E:\app\oracle"
+         "ORACLE_11G_HOME"       = "C:\app\oracle\product\11.2.0\client_1"
+         "ORACLE_BASE"           = "C:\app\oracle"
          "RegistryPath" = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\winlogon"
          "LegalNoticeCaption" = "IMPORTANT"
          "LegalNoticeText" = "This system is restricted to authorized users only. Individuals who attempt unauthorized access will be prosecuted. If you are unauthorized terminate access now. Click OK to indicate your acceptance of this information"
@@ -344,9 +344,7 @@ $Tags = Get-InstanceTags
 # Move-ModPlatformADComputer -ModPlatformADCredential $ADAdminCredential -NewOU $($Config.nartComputersOU)
 
 # ensure computer is in the correct OU
-Start-Process -FilePath "gpupdate.exe" -ArgumentList "/force" -Wait -NoNewWindow
 
-Start-Process -FilePath "gpresult.exe" -ArgumentList "/h", "$WorkingDirectory\gpresult.html" -Wait -NoNewWindow
 
 # }}}
 
@@ -412,6 +410,8 @@ $11gClientParams = @{
 
 try {
     "Starting Oracle 11g 64-bit client installation at $(Get-Date)" | Out-File -FilePath $logFile11g -Append
+    Start-Process -FilePath "gpupdate.exe" -ArgumentList "/force" -Wait -NoNewWindow
+    Start-Process -FilePath "gpresult.exe" -ArgumentList "/h", "$WorkingDirectory\gpresult.html" -Wait -NoNewWindow
     Start-Process @11gClientParams
 }
 catch {

From bb7974ed27345438b9fbd2ec84aab2b79714108d Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Mon, 11 Nov 2024 16:01:00 +0000
Subject: [PATCH 20/23] put user password in installer and then remove it

---
 .../Scripts/UserDataScripts/OnrClient.ps1     | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index 9aadb8bf1..1e90355c5 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -344,7 +344,9 @@ $Tags = Get-InstanceTags
 # Move-ModPlatformADComputer -ModPlatformADCredential $ADAdminCredential -NewOU $($Config.nartComputersOU)
 
 # ensure computer is in the correct OU
+Start-Process -FilePath "gpupdate.exe" -ArgumentList "/force" -Wait -NoNewWindow
 
+Start-Process -FilePath "gpresult.exe" -ArgumentList "/f /h","$WorkingDirectory\gpresult.html" -Wait -Verb "RunAs"
 
 # }}}
 
@@ -357,16 +359,13 @@ Expand-Archive ( ".\" + $Config.Oracle11g64bitClientS3File) -Destination ".\Orac
 Expand-Archive ( ".\" + $Config.Oracle19c64bitClientS3File) -Destination ".\Oracle19c64bitClient"
 # }}}
 
-# {{{
-# TODO: Add Oracle client installation for 11g and 19c
+# {{{ Install Oracle 11g and 19c 64-bit clients
 #
 # Create svc_nart credential object
 $dbenv = ($Tags | Where-Object { $_.Key -eq "oasys-national-reporting-environment" }).Value
 $bodsSecretName  = "/sap/bods/$dbenv/passwords"
 
 $service_user_password = Get-SecretValue -SecretId $bodsSecretName -SecretKey "svc_nart" -ErrorAction SilentlyContinue
-$service_user_secure_password = ConvertTo-SecureString -String $service_user_password -AsPlainText -Force
-$credential = New-Object System.Management.Automation.PSCredential ("$($Config.domain)\$($Config.serviceUser)", $service_user_secure_password)
 
 $DomainName = (Get-WmiObject -Class Win32_ComputerSystem).Domain
 
@@ -389,6 +388,7 @@ ORACLE_HOME=$($Config.ORACLE_19C_HOME)
 ORACLE_BASE=$($Config.ORACLE_BASE)
 oracle.install.IsBuiltInAccount=false
 oracle.install.OracleHomeUserName=$($Config.domain)\$($Config.serviceUser)
+oracle.install.OracleHomeUserPassword=$service_user_password
 oracle.install.client.installType=Administrator
 "@
 
@@ -403,16 +403,12 @@ $11gClientParams = @{
     ArgumentList = "-silent","-nowelcome","-nowait","-noconfig","-responseFile $WorkingDirectory\Oracle11g64bitClient\11gClient64bitinstall.rsp"
     Wait = $true
     NoNewWindow = $true
-    # WindowStyle = "Hidden"
-    # Verb = "RunAs"
-    # Credential = $credential
 }
 
 try {
     "Starting Oracle 11g 64-bit client installation at $(Get-Date)" | Out-File -FilePath $logFile11g -Append
-    Start-Process -FilePath "gpupdate.exe" -ArgumentList "/force" -Wait -NoNewWindow
-    Start-Process -FilePath "gpresult.exe" -ArgumentList "/h", "$WorkingDirectory\gpresult.html" -Wait -NoNewWindow
     Start-Process @11gClientParams
+    "Ended Oracle 11g 64-bit client installation at $(Get-Date)" | Out-File -FilePath $logFile11g -Append
 }
 catch {
     $exception = $_.Exception
@@ -426,17 +422,15 @@ New-Item -ItemType File -Path $logFile19c -Force
 $19cClientParams = @{
     FilePath = "$WorkingDirectory\Oracle19c64bitClient\client\setup.exe"
     WorkingDirectory = "$WorkingDirectory\Oracle19c64bitClient\client"
-    ArgumentList = "-silent oracle.install.OracleHomeUserPassword=$service_user_password -noconfig -nowait -responseFile $WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp"
+    ArgumentList = "-silent","-noconfig","-nowait","-responseFile $WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp"
     Wait = $true
-    # WindowStyle = "Hidden"
     NoNewWindow = $true
-    # Verb = "RunAs"
-    # Credential = $credential
 }
 
 try {
   "Starting Oracle 19c 64-bit client installation at $(Get-Date)" | Out-File -FilePath $logFile19c -Append
   Start-Process @19cClientParams
+  "Ended Oracle 19c 64-bit client installation at $(Get-Date)" | Out-File -FilePath $logFile19c -Append
 } catch {
   $exception = $_.Exception
   $exception.Message | Out-File -FilePath $logFile19c -Append
@@ -472,3 +466,9 @@ try {
  } else {
      Write-Host "Running on Windows Server 2012 R2. Antivirus configuration was not changed."
  }
+
+$content = Get-Content "$WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp"
+
+$modifycontent = $content -replace '(?i)(Password=)(.*)', '$1********'
+
+$modifycontent | Set-Content "$WorkingDirectory\Oracle19c64bitClient\19cClient64bitinstall.rsp"
\ No newline at end of file

From d242265d3f7e92277720b430f02177a38d40cc92 Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Mon, 11 Nov 2024 16:28:34 +0000
Subject: [PATCH 21/23] check user password can be found

---
 powershell/Scripts/UserDataScripts/OnrClient.ps1 | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index 1e90355c5..d497078ff 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -367,6 +367,11 @@ $bodsSecretName  = "/sap/bods/$dbenv/passwords"
 
 $service_user_password = Get-SecretValue -SecretId $bodsSecretName -SecretKey "svc_nart" -ErrorAction SilentlyContinue
 
+if ([string]::IsNullOrEmpty($service_user_password)) {
+    Write-Host "Failed to retrieve svc_nart password from Secrets Manager. Exiting."
+    exit 1
+}
+
 $DomainName = (Get-WmiObject -Class Win32_ComputerSystem).Domain
 
 $11gResponseFileContent = @"

From 511a97fe834bc7de18751272262ab1bee88a5130 Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Mon, 11 Nov 2024 16:52:27 +0000
Subject: [PATCH 22/23] add client shortcuts

---
 powershell/Scripts/UserDataScripts/OnrClient.ps1 | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/powershell/Scripts/UserDataScripts/OnrClient.ps1 b/powershell/Scripts/UserDataScripts/OnrClient.ps1
index d497078ff..651cb688a 100644
--- a/powershell/Scripts/UserDataScripts/OnrClient.ps1
+++ b/powershell/Scripts/UserDataScripts/OnrClient.ps1
@@ -414,6 +414,14 @@ try {
     "Starting Oracle 11g 64-bit client installation at $(Get-Date)" | Out-File -FilePath $logFile11g -Append
     Start-Process @11gClientParams
     "Ended Oracle 11g 64-bit client installation at $(Get-Date)" | Out-File -FilePath $logFile11g -Append
+    # create shortcut for sqlplus on the desktop for all users
+    $WScriptShell = New-Object -ComObject WScript.Shell
+    $targetPath = [System.IO.Path]::Combine($($Config.ORACLE_11G_HOME), "BIN\sqlplus.exe")
+    $shortcutPath = [System.IO.Path]::Combine([environment]::GetFolderPath("CommonDesktopDirectory"), "sqlplus11g.lnk")
+    $shortcut = $WScriptShell.CreateShortcut($shortcutPath)
+    $shortcut.TargetPath = $targetPath
+    $shortcut.Save() | Out-Null
+    "Shortcut created at $shortcutPath" | Out-File -FilePath $logFile11g -Append
 }
 catch {
     $exception = $_.Exception
@@ -436,6 +444,14 @@ try {
   "Starting Oracle 19c 64-bit client installation at $(Get-Date)" | Out-File -FilePath $logFile19c -Append
   Start-Process @19cClientParams
   "Ended Oracle 19c 64-bit client installation at $(Get-Date)" | Out-File -FilePath $logFile19c -Append
+  # create shortcut for sqlplus on the desktop for all users
+  $WScriptShell = New-Object -ComObject WScript.Shell
+  $targetPath = [System.IO.Path]::Combine($($Config.ORACLE_19C_HOME), "bin\sqlplus.exe")
+  $shortcutPath = [System.IO.Path]::Combine([environment]::GetFolderPath("CommonDesktopDirectory"), "sqlplus19c.lnk")
+  $shortcut = $WScriptShell.CreateShortcut($shortcutPath)
+  $shortcut.TargetPath = $targetPath
+  $shortcut.Save() | Out-Null
+  "Shortcut created at $shortcutPath" | Out-File -FilePath $logFile19c -Append
 } catch {
   $exception = $_.Exception
   $exception.Message | Out-File -FilePath $logFile19c -Append

From 824278c822a1fb5bce10a4735b11e79102005547 Mon Sep 17 00:00:00 2001
From: robertsweetman <robert.sweetman@digital.justice.gov.uk>
Date: Mon, 11 Nov 2024 17:13:55 +0000
Subject: [PATCH 23/23] response files aren't needed

---
 powershell/Configs/11gClientResp.rsp | 0
 powershell/Configs/19cClientResp.rsp | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 powershell/Configs/11gClientResp.rsp
 delete mode 100644 powershell/Configs/19cClientResp.rsp

diff --git a/powershell/Configs/11gClientResp.rsp b/powershell/Configs/11gClientResp.rsp
deleted file mode 100644
index e69de29bb..000000000
diff --git a/powershell/Configs/19cClientResp.rsp b/powershell/Configs/19cClientResp.rsp
deleted file mode 100644
index e69de29bb..000000000