Split Windows client bootstrap profiles

scripts/Invoke-SguClientBootstrap.ps1

@@ -11,6 +11,8 @@ param(
     [string]$DomainNetbios = 'LCI',
     [string]$ComputerOuDn,
     [string]$NewComputerName,
+    [ValidateSet('Auto', 'Windows10Legacy', 'Windows11Modern')]
+    [string]$CompatibilityProfile = 'Auto',
     [ValidateSet('Direct', 'AzureP2S')]
     [string]$ConnectivityMode = 'Direct',
     [string]$VpnConnectionName = 'SGU Azure P2S',
@@ -85,6 +87,7 @@ function Assert-PackageManifest {
             throw "Bootstrap package integrity check failed: $($entry.Path)"
         }
     }
+    return $manifest
 }
 
 function Resolve-ClientInterfaceAlias {
@@ -309,7 +312,38 @@ if (-not $ComputerOuDn) {
 }
 
 $packageRoot = $PSScriptRoot
-Assert-PackageManifest -PackageRoot $packageRoot
+$packageManifest = Assert-PackageManifest -PackageRoot $packageRoot
+$manifestProfile = if ($packageManifest.PSObject.Properties['CompatibilityProfile']) {
+    [string]$packageManifest.CompatibilityProfile
+}
+else {
+    'Auto'
+}
+if ($CompatibilityProfile -ne 'Auto' -and $manifestProfile -ne 'Auto' -and
+    $CompatibilityProfile -ne $manifestProfile) {
+    throw "The requested compatibility profile '$CompatibilityProfile' does not match package profile '$manifestProfile'."
+}
+if ($CompatibilityProfile -eq 'Auto') {
+    $CompatibilityProfile = $manifestProfile
+}
+$windowsBuild = [int]$operatingSystem.BuildNumber
+if ($CompatibilityProfile -eq 'Auto') {
+    $CompatibilityProfile = if ($windowsBuild -lt 22000) {
+        'Windows10Legacy'
+    }
+    else {
+        'Windows11Modern'
+    }
+}
+if ($CompatibilityProfile -eq 'Windows10Legacy' -and $windowsBuild -ge 22000) {
+    throw "The Windows 10 legacy package cannot enroll Windows build $windowsBuild. Use the Windows 11 modern client package."
+}
+if ($CompatibilityProfile -eq 'Windows11Modern' -and $windowsBuild -lt 22000) {
+    throw "The Windows 11 modern package cannot enroll Windows build $windowsBuild. Use the Windows 10 legacy client package."
+}
+if ($CompatibilityProfile -eq 'Windows10Legacy' -and $ConnectivityMode -eq 'AzureP2S') {
+    throw 'Azure P2S pre-logon enrollment belongs to the Windows 11 modern package. Use Direct connectivity for the Windows 10 legacy package.'
+}
 $scriptsRoot = Join-Path $packageRoot 'payload\scripts'
 $providerPublishPath = Join-Path $packageRoot 'payload\credential-provider'
 $runtimeInstaller = Get-ChildItem (Join-Path $packageRoot 'payload\prerequisites') `
@@ -609,6 +643,7 @@ if ($SkipRestart) {
         ClientCertificateRegistered = $true
         BrokerEndpoint = $brokerEndpoint
         ConnectivityMode = $ConnectivityMode
+        CompatibilityProfile = $CompatibilityProfile
         VpnConnectionName = if ($ConnectivityMode -eq 'AzureP2S') { $VpnConnectionName } else { $null }
         RestartRequired = $true
         RustDesk = if ($result) { $result.RustDesk } else { $null }