added additional foouser detection (soft WhiteGlove Indicator)

src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Enrollment/EnrollmentTracker.CompletionLogic.cs

@@ -132,6 +132,7 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Enrollment
                     {
                         { "whiteGloveStartDetected", whiteGloveStarted },
                         { "saveWhiteGloveSuccessResult", whiteGloveSuccessResult },
+                        { "fooUserDetected", _fooUserDetected },
                         { "autopilotMode", _autopilotMode },
                         { "skipUserStatusPage", _skipUserStatusPage }
                     });
@@ -680,6 +681,7 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Enrollment
                             {
                                 { "whiteGloveStartDetected", wgStarted },
                                 { "saveWhiteGloveSuccessResult", wgSuccessResult },
+                                { "fooUserDetected", _fooUserDetected },
                                 { "previousPhase", lastPhase ?? "unknown" }
                             });
 
@@ -1208,7 +1210,8 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Enrollment
                     { "isSelfDeploying", IsSelfDeploying },
                     { "isDeviceOnlyDeployment", IsDeviceOnlyDeployment },
                     { "whiteGloveStartDetected", _espAndHelloTracker?.IsWhiteGloveStartDetected ?? false },
-                    { "saveWhiteGloveSuccessResult", _espAndHelloTracker?.HasSaveWhiteGloveSuccessResult ?? false }
+                    { "saveWhiteGloveSuccessResult", _espAndHelloTracker?.HasSaveWhiteGloveSuccessResult ?? false },
+                    { "fooUserDetected", _fooUserDetected }
                 };
             }
 

src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Enrollment/EnrollmentTracker.cs

@@ -104,6 +104,8 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Enrollment
         // True when AAD join status shows a joined device with a real user email.
         // Detected via CollectAadJoinStatus() in DeviceInfoCollector.
         private bool _aadJoinedWithUser;
+        // Soft indicator: AAD userEmail starts with "foouser@" (pre-provisioning synthetic account).
+        private bool _fooUserDetected;
 
         // Signal-correlated WhiteGlove detection (Ebene 2.6):
         // Feeds the bestehenden OnWhiteGloveCompleted() callback when the Shell-Core detector
@@ -617,6 +619,7 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Enrollment
                 _skipDeviceStatusPage = result.skipDeviceStatusPage;
                 _autopilotMode = result.autopilotMode;
                 _aadJoinedWithUser = result.hasAadJoinedUser;
+                _fooUserDetected = result.isFooUserDetected;
                 _stateData.EnrollmentType = _enrollmentType;
                 _stateData.SkipUserStatusPage = _skipUserStatusPage;
                 _stateData.SkipDeviceStatusPage = _skipDeviceStatusPage;

src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Telemetry/DeviceInfo/DeviceInfoCollector.NetworkAndSecurity.cs

@@ -26,6 +26,13 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.DeviceInfo
         /// </summary>
         public bool HasAadJoinedUser { get; private set; }
 
+        /// <summary>
+        /// True when the AAD join userEmail starts with "foouser@" — a synthetic account used
+        /// by Windows during Autopilot pre-provisioning (WhiteGlove) for AAD discovery.
+        /// Soft indicator for pre-provisioning; does not affect completion logic.
+        /// </summary>
+        public bool IsFooUserDetected { get; private set; }
+
         private void CollectNetworkAndDnsConfiguration()
         {
             try
@@ -433,7 +440,16 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.DeviceInfo
                                     data["thumbprint"] = subKeyNames[0]; // Certificate thumbprint
 
                                     if (!string.IsNullOrWhiteSpace(userEmail))
+                                    {
                                         HasAadJoinedUser = true;
+
+                                        if (userEmail.StartsWith("foouser@", StringComparison.OrdinalIgnoreCase))
+                                        {
+                                            IsFooUserDetected = true;
+                                            data["isFooUser"] = true;
+                                            _logger.Info($"AAD join: foouser@ detected ({userEmail}) — pre-provisioning indicator");
+                                        }
+                                    }
                                 }
                             }
                         }

src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Telemetry/DeviceInfo/DeviceInfoCollector.cs

@@ -48,7 +48,7 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.DeviceInfo
         /// Runs all device info collectors at agent startup.
         /// Returns the detected enrollment type, Hybrid Join flag, and ESP skip configuration from registry.
         /// </summary>
-        public (string enrollmentType, bool isHybridJoin, bool? skipUserStatusPage, bool? skipDeviceStatusPage, int? autopilotMode, bool hasAadJoinedUser) CollectAll()
+        public (string enrollmentType, bool isHybridJoin, bool? skipUserStatusPage, bool? skipDeviceStatusPage, int? autopilotMode, bool hasAadJoinedUser, bool isFooUserDetected) CollectAll()
         {
             _logger.Info("EnrollmentTracker: collecting device info (at start)");
 
@@ -64,7 +64,7 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.DeviceInfo
             CollectActiveNetworkInterfaceInfo();
             CollectHardwareSpec();
 
-            return (profileResult.enrollmentType, profileResult.isHybridJoin, espConfig.skipUserStatusPage, espConfig.skipDeviceStatusPage, profileResult.autopilotMode, HasAadJoinedUser);
+            return (profileResult.enrollmentType, profileResult.isHybridJoin, espConfig.skipUserStatusPage, espConfig.skipDeviceStatusPage, profileResult.autopilotMode, HasAadJoinedUser, IsFooUserDetected);
         }
 
         /// <summary>

src/Agent/AutopilotMonitor.Agent/buildcounter.txt

@@ -1 +1 @@
-1013
+1015