BISF reborn. https://github.com/JonathanPitre/BIS-F/tree/2608

whats new on this release ?

Read the changelog to find out

Ah sry. I fly over the GitHub

It's still very early stage, and demands community testibg

this is a good test and will be sorted under beta 😛

A lot of supported products were changed over the years and there's a lot of legacy stuff that must be removed

if i find something i will inform u....if i can help with anything send me a dm

I wanna yank CCleaner support and replace it by FluentCleaner

this is a good step, because i never used the ccleaner at my customers....will test it at my managed customers...so i can bring very fast some feedback...

FluentCleaner is awesome and open source but may get blocked by your EDR since the binary is not signed

for stuff like this i create my own repo and sign it 😛

I hear ya but it change every week

or a hash value check is also most of the time good enough

Submit a PR to the main report 🙂

Very nice. Yeah, the old TCP offload optimization pieces was the general optimization piece that was detrimental on anything newer, and we usually would disable if it was a scenario we had to (most times we had another optimizer template defined, be on AHV, etc. which would skip that anyway if I remember right), but yea, we always had to make sure to have that not run if needed. Nice. Thanks mate

💯 I think BISF should focus on fixing cloning issues and let the Optimization piece to other software

@richminichiello and @Brian Forst for feedback and/or questions here on our testing for Jonathan

Hey Jonathan...we more have feedback, as we kind of answered our own questions as we were getting things sorted. With setting it up - we had the older version installed on our machine, which we went through an uninstall of first. Then used your PowerShell script to get your installed. Few things on it: 1. Your installation script doesn't take into consideration the version information that's written to the registry, so it throws an error that the buildnumber could not be determined. We added "Version" to HKLM\Software\LoginConsultants\BISF to get around that. 2. The SentinelOne script you have had a bunch of non-standard characters in the throw messages, which caused issues. (screenshot atached - see line 405) 3. The version number in the splash screen was still the old 7.1912.1. We updated that in Global PSM area (I'll have to find the exact file - but not a big deal - just cosmetic) 4. The shortcut that gets created is pointing to C:\prepareimage.bat instead of where the script "installs" the batch file in Program Files (x86). The only breaking issue was #2, which is a quick fix. The rest are either cosmetic or just having to go to the actual batch file instead of using the shortcut. Great work, though, in getting an update out!

Thx @Jonathan Pitre great step forward.👍 Don’t find time to fix things ..

@richminichiello noted ill get this fixed soon and I have bunch more change coming

Exciting news! Yes PLEASE! some polish on the TCP offlload optimization - I think it can be disabled entirely at this point for modern apps. Thanks for your continued work @Matthias Schlimm and @Jonathan Pitre!!!

Fix installer, version, encoding, and shortcut issues Feedback from Rich (four items). Issue 2 was the only sealing-breaker; the others are install/version leftovers from dropping Advanced Installer.

flowchart LR
  zipInstall["README zip install"]
  regHive["HKLM SOFTWARE Login Consultants BISF"]
  getVer["Get-Version"]
  splash["Show-SplashScreen"]
  shortcut["Desktop / Start Menu shortcut"]
  zipInstall -->|"does not write Path or Version"| regHive
  regHive --> getVer
  getVer -->|"2608.0 last digit 0"| warn["BuildNumber could not be determined"]
  splash -->|"Get-Module Version"| splashVer["subtitle"]
  shortcut -->|"InstallLocation from Path"| target["PrepareBaseImage.cmd"]

Issue 1 — Registry Version / “BuildNumber could not be determined” Cause:

[Initialize-Configuration](Framework/SubCall/Global/BISF.psm1)

still reads installer-written values:

$Global:InstallLocation = (Get-ItemProperty "$HklmBisfScripts").Path
 $Global:BISFversion = (Get-ItemProperty "$HklmBisfScripts").Version

The README install snippet copies files into

C:\Program Files (x86)\Base Image Script Framework (BIS-F)

and never creates

HKLM:\SOFTWARE\Login Consultants\BISF

Path

/

Version

.

[Test-RegHive](Framework/SubCall/Global/BISF.psm1)

only creates the key, later, and still does not write those values.

[Get-Version](Framework/SubCall/Global/BISF.psm1)

then treats the first character of the last dotted segment as a DTAP stage (

1

prod,

2

beta,

3

test,

4

dev). That matched

7.1912.7.11042

. For

2608.0

the last segment is

0

→ default warning “The BuildNumber could not be determined !!”. Missing

Version

can also throw on

.split()

. Rich’s workaround (manually adding

Version

) matches this. Fix: 1. Extract a real installer

[tools/Install-BISF.ps1](tools/Install-BISF.ps1)

(README becomes a thin caller). After copy, write:

HKLM:\SOFTWARE\Login Consultants\BISF\Path

= install root with trailing

\

(existing concatenations like

$InstallLocation + "BISFSharedConfig.json"

assume that)

HKLM:\SOFTWARE\Login Consultants\BISF\Version

=

ModuleVersion

from

[BISF.psd1](Framework/SubCall/Global/BISF.psd1)

(

2608.0

) 2. Self-heal in `Initialize-Configuration`: if the hive/`Path`/`Version` is missing, derive Path from

$Main_Folder

(parent of

Framework\

) and Version from the loaded module / `BISF.psd1`; write them. Do not throw when the key is absent. 3. Rewrite `Get-Version`: use the loaded module version (what the SYNOPSIS already claims). Treat

YYMM.minor

(

2608.0

) as production. Keep the old 1/2/3/4 DTAP warnings only for four-part

7.1912.*

strings. Issue 2 — UTF-8 without BOM (breaking) — repo-wide, enforced Cause: Windows PowerShell 5.1 defaults to the system ANSI code page. A UTF-8 file without BOM that contains an em dash (

—

, U+2014) is parsed as Windows-1252 →

â€"

. That matches the screenshot (

throw "SentinelOne identity reset/verify failed â€" sealing aborted"

). A parse error here aborts seal. BOM is the real fix for PS 5.1. It is required for every PowerShell file in the repo (

.ps1

,

.psm1

,

.psd1

under

Framework/

,

tools/

, and anywhere else), not only the new SentinelOne script. CHANGELOG currently mentions BOM only for new prep scripts; that is not enough. Workspace copy of

[10_PrepBISF_AV-SentinelOne.ps1](Framework/SubCall/Preparation/10_PrepBISF_AV-SentinelOne.ps1)

already uses ASCII

-

(lines 397/402). Line numbers in the screenshot (throw at 405) were an older revision. One-time convert: rewrite all matching files as UTF-8 with BOM, preserving CRLF (already required by

[.gitattributes](.gitattributes)

). Skip files that already start with

EF BB BF

. While touching SentinelOne / Rapid7 / NinjaOne, keep

throw

strings on ASCII hyphen-minus so consoles without UTF-8 output still read cleanly. Automate (three layers): 1. Editor (prevent new files without BOM) Add `[.editorconfig](.editorconfig)`:

[*.{ps1,psm1,psd1}]

charset = utf-8-bom

(and keep

end_of_line = crlf

to match

.gitattributes

).

[.vscode/settings.json](.vscode/settings.json)

`[powershell]`:

"files.encoding": "utf8bom"

so Cursor/VS Code save with BOM even without EditorConfig. 2. Local tool:

[tools/Test-BISFUtf8Bom.ps1](tools/Test-BISFUtf8Bom.ps1)

Scan the repo for

*.ps1

/

*.psm1

/

*.psd1

(exclude nothing that ships or CI runs). Fail (exit 1) listing paths whose first three bytes are not UTF-8 BOM. `-Fix`: rewrite in place with

UTF8Encoding($true)

, preserve existing newlines; do not transcode if the file is not valid UTF-8 (report those instead). Same usage pattern as

[tools/Test-BISFVariableCasing.ps1](tools/Test-BISFVariableCasing.ps1)

(

-ChangedOnly

optional; full scan is cheap — first 3 bytes). 3. CI: extend

[validate-scripts.yml](.github/workflows/validate-scripts.yml)

PR / dispatch: always full-repo BOM check (fail the job). Push to

master

/

main

/

develop

/ `refactor/modernize`: run

-Fix

and auto-commit, same pattern as

[markdownlint.yml](.github/workflows/markdownlint.yml)

(

stefanzweifel/git-auto-commit-action

). Trigger paths include

**/*.{ps1,psm1,psd1}

plus the new tool and workflow. Document in `[.github/CONTRIBUTING.md](.github/CONTRIBUTING.md)`: save as UTF-8 with BOM; run

.\tools\Test-BISFUtf8Bom.ps1

locally; CI will fail PRs that drop the BOM. Git cannot encode BOM via `.gitattributes`; editor + test + CI are the enforcement. Issue 3 — Splash still shows

7.1912.1

Cause: Fluent splash already reads

Get-Module -Name $MainModuleName

.Version (

[Show-SplashScreen](Framework/SubCall/Global/BISF.psm1)

). Console title still uses registry

$BISFversion

. Stale surfaces: • README release badge still says

7.1912

• Testers overlaying the zip on an old 7.1912 install, or adding

Version=7.1912.1

as the Issue 1 workaround • Local

ModuleVersion = '2608.0'

is uncommitted (

BISF.psd1

is modified) — a GitHub zip may still be the old number until this lands Fix: One version source:

BISF.psd1

ModuleVersion

. Splash, window title,

Get-Version

, and registry

Version

all use that string. Update the README badge to

2608.0

. Do not hardcode a version in the splash XAML. Issue 4 — Shortcut points at

C:\prepareimage.bat

Cause: The zip install creates no shortcut. GPO desktop shortcut in

[Invoke-DesktopShortcut](Framework/SubCall/Preparation/97_PrepBISF_PRE_BaseImage.ps1)

uses

$InstallLocation

from registry

Path

. Empty/wrong

Path

produces a broken target. Repo launcher is

[PrepareBaseImage.cmd](PrepareBaseImage.cmd)

, not

prepareimage.bat

.

C:\prepareimage.bat

is almost certainly a leftover/manual shortcut, not something this tree writes. Fix: • Installer creates a Start Menu shortcut (and optional Desktop) to

$InstallRoot\PrepareBaseImage.cmd

, working directory

$InstallRoot

, icon

Framework\SubCall\Global\BISF.ico

if present. •

Invoke-DesktopShortcut

uses

Join-Path

(stop mixing

$InstallLocation + "Framework\..."

with

$InstallLocation\PrepareBaseImage.cmd

). • After install,

Path

must be the Program Files (x86) root with trailing

\

. Out of scope No MSI / winget / Advanced Installer revival. Self-heal +

Install-BISF.ps1

is enough until a packaged installer exists. Verification • Clean VM: run

Install-BISF.ps1

, confirm

Path

+

Version=2608.0

under

HKLM:\SOFTWARE\Login Consultants\BISF

, shortcut target is

...\PrepareBaseImage.cmd

. • Prep start: no BuildNumber warning; splash and console title show

2608.0

. • Overlay on leftover 7.1912 registry: self-heal overwrites Version; splash not

7.1912.1

. • On Windows PowerShell 5.1:

powershell -NoProfile -File ...\10_PrepBISF_AV-SentinelOne.ps1

parses with no

â€"

/ parser errors. •

.\tools\Test-BISFUtf8Bom.ps1

exits 0 on a clean tree; a file saved without BOM fails CI;

-Fix

restores BOM without changing script text.

Hi @Jonathan Pitre Thank you for working on this project! ❤️ I didn't read the whole thread nor the whole changelog, yet. So I apologize if I double post this, but I thought I might share my manual fixes I've done so far to our BIS-F setups. But I have the feeling you already addressed those eventually.

Write-Host "##[command]Customize Scripts of $Vendor $Product $Version"
((Get-Content "$BISFDir\Preparation\97_PrepBISF_PRE_BaseImage.ps1" -Raw) -replace "DisableTaskOffload' -Value '1'", "DisableTaskOffload' -Value '0'") | Set-Content -Path "$BISFDir\Preparation\97_PrepBISF_PRE_BaseImage.ps1"
((Get-Content "$BISFDir\Preparation\97_PrepBISF_PRE_BaseImage.ps1" -Raw) -replace 'nx AlwaysOff', 'nx OptOut') | Set-Content -Path "$BISFDir\Preparation\97_PrepBISF_PRE_BaseImage.ps1"
((Get-Content "$BISFDir\Preparation\97_PrepBISF_PRE_BaseImage.ps1" -Raw) -replace 'rss=disable', 'rss=enable') | Set-Content -Path "$BISFDir\Preparation\97_PrepBISF_PRE_BaseImage.ps1"

thank you @Marco Hofmann I'm well aware of these I've used it myself for years 😛

Is this already "fixed" in your branch?

Not yet