env/windows: disable windows defender on builders

Windows Defender scans all new files written to disk which slows down
build performance.

- Uninstall Windows Defender as part of image building
- Refactor/Cleanup registry section for consistency
- Promote new image version to dashboard (built in staging/prod)

fixes golang/go#26055

Change-Id: I3e16b9a9581824c20abed5e8ffae1efd46c6dd09
Reviewed-on: https://go-review.googlesource.com/121937
Reviewed-by: Brad Fitzpatrick <[email protected]>

Author: johnsonj

dashboard/builders.go

@@ -247,21 +247,21 @@ var Hosts = map[string]*HostConfig{
 		env:         []string{"GO_TEST_TIMEOUT_SCALE=2"},
 	},
 	"host-windows-amd64-2008": &HostConfig{
-		VMImage:            "windows-amd64-server-2008r2-v6",
+		VMImage:            "windows-amd64-server-2008r2-v7",
 		machineType:        "n1-highcpu-4",
 		buildletURLTmpl:    "http://storage.googleapis.com/$BUCKET/buildlet.windows-amd64",
 		goBootstrapURLTmpl: "https://storage.googleapis.com/$BUCKET/go1.4-windows-amd64.tar.gz",
 		SSHUsername:        "gopher",
 	},
 	"host-windows-amd64-2012": &HostConfig{
-		VMImage:            "windows-amd64-server-2012r2-v6",
+		VMImage:            "windows-amd64-server-2012r2-v7",
 		machineType:        "n1-highcpu-4",
 		buildletURLTmpl:    "http://storage.googleapis.com/$BUCKET/buildlet.windows-amd64",
 		goBootstrapURLTmpl: "https://storage.googleapis.com/$BUCKET/go1.4-windows-amd64.tar.gz",
 		SSHUsername:        "gopher",
 	},
 	"host-windows-amd64-2016": &HostConfig{
-		VMImage:            "windows-amd64-server-2016-v6",
+		VMImage:            "windows-amd64-server-2016-v7",
 		machineType:        "n1-highcpu-4",
 		buildletURLTmpl:    "http://storage.googleapis.com/$BUCKET/buildlet.windows-amd64",
 		goBootstrapURLTmpl: "https://storage.googleapis.com/$BUCKET/go1.4-windows-amd64.tar.gz",

env/windows/make.bash

@@ -9,9 +9,9 @@ set -e -u
 declare -A public_images
 
 public_images=(
-         ['server-2016-v6']='windows-server-2016-dc-core-v20180410'
-         ['server-2008r2-v6']='windows-server-2008-r2-dc-v20180410'
-         ['server-2012r2-v6']='windows-server-2012-r2-dc-core-v20180410'
+         ['server-2016-v7']='windows-server-2016-dc-core-v20180612'
+         ['server-2008r2-v7']='windows-server-2008-r2-dc-v20180612'
+         ['server-2012r2-v7']='windows-server-2012-r2-dc-core-v20180612'
        )
 
 mkdir -p out

env/windows/startup.ps1

@@ -74,20 +74,21 @@ while(-Not (Test-NetConnection 8.8.8.8 -Port 53 | ? { $_.TcpTestSucceeded })) {
   sleep 3
 }
 
-# Disable password complexity, automatic updates, windows firewall, error reporting, and UAC
+# Disable password complexity, automatic updates, windows defender, windows firewall, error reporting, and UAC
 # 
-# - Updated interrupt the builds later. 
-# - We don't care about security since this isn't going to be Internet-facing. 
+# - Update can interrupt the builds
+# - We don't care about security since this isn't going to be Internet-facing
 # - No ports will ever be accessible externally
 # - We can be trusted to run as a real Administrator
 Write-Host "disabling security features"
 Disable-PasswordComplexity
-New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name NoAutoUpdate -Value 1 -Force | Out-Null
-new-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting" -Name Disabled -Value 1 -Force | Out-Null
-new-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting" -Name DontShowUI -Value 1 -Force | Out-Null
+New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name NoAutoUpdate -Value 1 -Force | Out-Null
+new-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting" -Name Disabled -Value 1 -Force | Out-Null
+new-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting" -Name DontShowUI -Value 1 -Force | Out-Null
+New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" -Name EnableLUA -PropertyType DWord -Value 0 -Force | Out-Null
 netsh advfirewall set allprofiles state off
 netsh firewall set opmode mode=disable profile=ALL
-New-ItemProperty -Path HKLM:Software\Microsoft\Windows\CurrentVersion\policies\system -Name EnableLUA -PropertyType DWord -Value 0 -Force | Out-Null
+Uninstall-WindowsFeature -Name Windows-Defender
 
 # Disable unwanted services
 Write-Host "disabling unused services"