mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 04:32:32 +00:00
Oliver Kieselbach
e5cb3c4f5e
All 54 shipped analyze rules get role, summary, subject and key facts as
{{signal.key}} templates, each with a minor version bump so the self-seed
picks them up. Values were checked against stored findings, the rows that
receive the block at read time.
- ENRL-001 repeats the outcome only: the 0x87D1041C paragraph and the
placeholder note are gone, labels read "ESP step that failed" / "ESP
error code", remediation is "Find the cause". This changes its alert text.
- ENRL-002 says the sweep "closed" the session (it can end Incomplete).
- ID-002 and ID-004 gain evidence-only conditions (unexpected account
names; IME token failure count and codes); firing and confidence are
unchanged.
- Resolution: facts sharing a label are alternatives, an exact repeat of
label and value is left out (new shared fixture case, web module and
its generated MCP copy).
- Ratchet: every built-in presentation passes the save validator, uses
qualified tokens only, and each token names a condition of the rule and
a key its source records (RuleTemplateInterpolator.TokenRegex internal).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
90 lines
3.6 KiB
JSON
90 lines
3.6 KiB
JSON
{
|
|
"$schema": "../schema/analyze-rule.schema.json",
|
|
"ruleId": "ANALYZE-DEV-008",
|
|
"title": "Device Clock Wrong During Enrollment — Jump or Sustained Offset",
|
|
"description": "The device's clock changed by five or more minutes mid-session (clock jump) or ran five or more minutes off server time for the whole session (sustained offset), measured against the server receive frame of every uploaded event. Complements ANALYZE-DEV-007, which is a one-shot NTP check at agent startup and misses devices where NTP was unreachable or the clock changed later. IME-log-derived events are excluded from the measurement.",
|
|
"severity": "warning",
|
|
"category": "device",
|
|
"version": "1.1.0",
|
|
"author": "Autopilot Monitor",
|
|
"enabled": true,
|
|
"evaluateOn": [
|
|
"enrollment_end",
|
|
"whiteglove_sealed"
|
|
],
|
|
"trigger": "single",
|
|
"baseConfidence": 60,
|
|
"confidenceThreshold": 50,
|
|
"conditions": [
|
|
{
|
|
"signal": "clock_jump",
|
|
"source": "clock_skew",
|
|
"skewMetric": "clock_jump",
|
|
"operator": "gte",
|
|
"value": "300",
|
|
"required": false
|
|
},
|
|
{
|
|
"signal": "sustained_offset",
|
|
"source": "clock_skew",
|
|
"skewMetric": "sustained_offset",
|
|
"operator": "gte",
|
|
"value": "300",
|
|
"required": false
|
|
}
|
|
],
|
|
"confidenceFactors": [],
|
|
"explanation": "This device's {{skewSummary}} (five-minute threshold). A clock that is off by five or more minutes breaks time-sensitive enrollment mechanisms: Kerberos tolerates at most 5 minutes of skew (Hybrid Join), Entra ID token validation allows about 5 minutes on token lifetimes, and freshly issued SCEP/PKCS certificates can be rejected as \"not yet valid\" when the clock is more than ~10 minutes behind the CA.\n\nUnlike ANALYZE-DEV-007 (a one-shot NTP comparison at agent startup), this finding is measured across the whole session against the server's receive time — it also catches devices where the NTP check could not run (UDP 123 blocked) or where the clock changed after startup (time sync correcting a wrong RTC, Windows auto-timezone, manual change).",
|
|
"remediation": [
|
|
{
|
|
"title": "Fix the device clock and time source",
|
|
"steps": [
|
|
"Check the BIOS/RTC clock and the CMOS battery if the wrong time recurs on the same hardware.",
|
|
"At OOBE, run 'w32tm /resync /force' (Shift+F10 command prompt) to sync with time.windows.com.",
|
|
"Ensure UDP port 123 to time.windows.com is open in the deployment network.",
|
|
"Review 'Set time automatically' and 'Set time zone automatically' behavior on the deployment image — automatic timezone changes mid-enrollment show up as clock jumps."
|
|
]
|
|
}
|
|
],
|
|
"relatedDocs": [
|
|
{
|
|
"title": "Microsoft Learn: Windows Autopilot known issues — device provisioning can fail (clock skew)",
|
|
"url": "https://learn.microsoft.com/en-us/autopilot/known-issues"
|
|
},
|
|
{
|
|
"title": "Microsoft Learn: Windows Autopilot requirements — Networking (NTP)",
|
|
"url": "https://learn.microsoft.com/en-us/autopilot/requirements?tabs=networking"
|
|
}
|
|
],
|
|
"markSessionAsFailedDefault": false,
|
|
"presentation": {
|
|
"role": "cause",
|
|
"subject": {
|
|
"kind": "device",
|
|
"key": "clock",
|
|
"name": "System clock"
|
|
},
|
|
"facts": [
|
|
{
|
|
"label": "Clock jump (min)",
|
|
"value": "{{clock_jump.jumpMinutes}}",
|
|
"format": "number"
|
|
},
|
|
{
|
|
"label": "Clock offset (min)",
|
|
"value": "{{sustained_offset.offsetMinutes}}",
|
|
"format": "number"
|
|
}
|
|
]
|
|
},
|
|
"tags": [
|
|
"device",
|
|
"clock-skew",
|
|
"clock-jump",
|
|
"time-sync",
|
|
"kerberos",
|
|
"certificates",
|
|
"known-issue"
|
|
]
|
|
}
|