mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 04:32:32 +00:00
Oliver Kieselbach
e5cb3c4f5e
All 54 shipped analyze rules get role, summary, subject and key facts as
{{signal.key}} templates, each with a minor version bump so the self-seed
picks them up. Values were checked against stored findings, the rows that
receive the block at read time.
- ENRL-001 repeats the outcome only: the 0x87D1041C paragraph and the
placeholder note are gone, labels read "ESP step that failed" / "ESP
error code", remediation is "Find the cause". This changes its alert text.
- ENRL-002 says the sweep "closed" the session (it can end Incomplete).
- ID-002 and ID-004 gain evidence-only conditions (unexpected account
names; IME token failure count and codes); firing and confidence are
unchanged.
- Resolution: facts sharing a label are alternatives, an exact repeat of
label and value is left out (new shared fixture case, web module and
its generated MCP copy).
- Ratchet: every built-in presentation passes the save validator, uses
qualified tokens only, and each token names a condition of the rule and
a key its source records (RuleTemplateInterpolator.TokenRegex internal).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
91 lines
3.0 KiB
JSON
91 lines
3.0 KiB
JSON
{
|
|
"$schema": "../schema/analyze-rule.schema.json",
|
|
"ruleId": "ANALYZE-DEV-007",
|
|
"title": "System Clock Skew — TPM Attestation and ESP Timeout Risk",
|
|
"description": "The device's real-time clock deviates from NTP by more than two minutes. Microsoft documents that a clock off by several minutes causes TPM attestation errors (self-deploying/pre-provisioning) and ESP timeouts.",
|
|
"severity": "warning",
|
|
"category": "device",
|
|
"version": "1.2.0",
|
|
"author": "Autopilot Monitor",
|
|
"enabled": true,
|
|
"evaluateOn": [
|
|
"enrollment_end",
|
|
"whiteglove_sealed"
|
|
],
|
|
"trigger": "single",
|
|
"baseConfidence": 55,
|
|
"confidenceThreshold": 50,
|
|
"conditions": [
|
|
{
|
|
"signal": "clock_behind",
|
|
"source": "event_data",
|
|
"eventType": "ntp_time_check",
|
|
"dataField": "offsetSeconds",
|
|
"operator": "gt",
|
|
"value": "120",
|
|
"required": false
|
|
},
|
|
{
|
|
"signal": "clock_ahead",
|
|
"source": "event_data",
|
|
"eventType": "ntp_time_check",
|
|
"dataField": "offsetSeconds",
|
|
"operator": "lt",
|
|
"value": "-120",
|
|
"required": false
|
|
}
|
|
],
|
|
"confidenceFactors": [],
|
|
"explanation": "The device's system clock is off by **{{offsetSeconds}} seconds** relative to the NTP reference (time.windows.com). Microsoft documents that Autopilot provisioning can fail with TPM attestation errors or ESP timeouts when the real-time clock is off by several minutes — certificate and token validation are time-sensitive.\n\nThis is especially critical for **self-deploying and pre-provisioning** deployments (TPM attestation) and can also skew all client-side timestamps in this session's timeline.",
|
|
"remediation": [
|
|
{
|
|
"title": "Sync the clock before provisioning",
|
|
"steps": [
|
|
"Boot the device to the start of OOBE and establish a network connection.",
|
|
"Run 'w32tm /resync /force' (Shift+F10 command prompt) to sync with time.windows.com.",
|
|
"Ensure UDP port 123 to time.windows.com is open in the deployment network.",
|
|
"Check the BIOS/RTC battery and firmware clock if the skew recurs on the same hardware."
|
|
]
|
|
}
|
|
],
|
|
"relatedDocs": [
|
|
{
|
|
"title": "Microsoft Learn: Windows Autopilot known issues — device provisioning can fail (clock skew)",
|
|
"url": "https://learn.microsoft.com/en-us/autopilot/known-issues"
|
|
},
|
|
{
|
|
"title": "Microsoft Learn: Windows Autopilot requirements — Networking (NTP)",
|
|
"url": "https://learn.microsoft.com/en-us/autopilot/requirements?tabs=networking"
|
|
}
|
|
],
|
|
"markSessionAsFailedDefault": false,
|
|
"presentation": {
|
|
"role": "cause",
|
|
"subject": {
|
|
"kind": "device",
|
|
"key": "clock",
|
|
"name": "System clock"
|
|
},
|
|
"facts": [
|
|
{
|
|
"label": "Clock offset (s)",
|
|
"value": "{{clock_behind.value}}",
|
|
"format": "number"
|
|
},
|
|
{
|
|
"label": "Clock offset (s)",
|
|
"value": "{{clock_ahead.value}}",
|
|
"format": "number"
|
|
}
|
|
]
|
|
},
|
|
"tags": [
|
|
"device",
|
|
"ntp",
|
|
"clock-skew",
|
|
"tpm",
|
|
"esp",
|
|
"known-issue"
|
|
]
|
|
}
|