mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
020248fbda
IME re-runs remediation policies on its own schedule for as long as the device is up, so an enrollment that waits for its user reported every run of every policy. The tracker now emits a policy's first run and every run whose result differs from the last reported one (compliance, exit code, stderr, remediation status, error code); repeats are counted and surface as one script_recurrence_summary per policy when the tracker stops. The start signal of a known policy is held until its result is known, because the running indicators pair a start with a later result; a start without any result is still emitted after a grace. The counters live in the tracker state file next to the file positions, so a hard kill rolls both back together. Platform scripts are untouched. The summary does not count as enrollment activity. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
312 lines
9.1 KiB
JSON
312 lines
9.1 KiB
JSON
{
|
|
"registryPrefixes": [
|
|
{
|
|
"category": "MDM / Enrollment",
|
|
"prefixes": [
|
|
"SOFTWARE\\Microsoft\\Enrollments",
|
|
"SOFTWARE\\Microsoft\\EnterpriseDesktopAppManagement",
|
|
"SOFTWARE\\Microsoft\\Provisioning",
|
|
"SOFTWARE\\Microsoft\\PolicyManager",
|
|
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\MDM"
|
|
]
|
|
},
|
|
{
|
|
"category": "AAD / Entra Join",
|
|
"prefixes": [
|
|
"SOFTWARE\\Microsoft\\IdentityStore",
|
|
"SYSTEM\\CurrentControlSet\\Control\\CloudDomainJoin"
|
|
]
|
|
},
|
|
{
|
|
"category": "Windows Update / WUfB",
|
|
"prefixes": [
|
|
"SOFTWARE\\Microsoft\\WindowsUpdate",
|
|
"SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
|
|
]
|
|
},
|
|
{
|
|
"category": "BitLocker",
|
|
"prefixes": [
|
|
"SOFTWARE\\Microsoft\\BitLocker",
|
|
"SYSTEM\\CurrentControlSet\\Control\\BitLockerStatus"
|
|
]
|
|
},
|
|
{
|
|
"category": "Network / Proxy",
|
|
"prefixes": [
|
|
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
|
|
"SYSTEM\\CurrentControlSet\\Services\\Tcpip"
|
|
]
|
|
},
|
|
{
|
|
"category": "Autopilot / OOBE / Setup",
|
|
"prefixes": [
|
|
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup",
|
|
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE",
|
|
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
|
|
"SOFTWARE\\Microsoft\\Windows\\Autopilot"
|
|
]
|
|
},
|
|
{
|
|
"category": "TPM",
|
|
"prefixes": [
|
|
"SYSTEM\\CurrentControlSet\\Services\\TPM",
|
|
"SOFTWARE\\Microsoft\\Tpm"
|
|
]
|
|
},
|
|
{
|
|
"category": "Secure Boot",
|
|
"prefixes": [
|
|
"SYSTEM\\CurrentControlSet\\Control\\SecureBoot"
|
|
]
|
|
},
|
|
{
|
|
"category": "Intune IME",
|
|
"prefixes": [
|
|
"SOFTWARE\\Microsoft\\IntuneManagementExtension"
|
|
]
|
|
},
|
|
{
|
|
"category": "Certificates (SCEP)",
|
|
"prefixes": [
|
|
"SOFTWARE\\Microsoft\\SystemCertificates",
|
|
"SOFTWARE\\Policies\\Microsoft\\SystemCertificates"
|
|
]
|
|
},
|
|
{
|
|
"category": "Servicing",
|
|
"prefixes": [
|
|
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing"
|
|
]
|
|
},
|
|
{
|
|
"category": "RealmJoin",
|
|
"prefixes": [
|
|
"SYSTEM\\CurrentControlSet\\Services\\realmjoin",
|
|
"SOFTWARE\\RealmJoin"
|
|
]
|
|
}
|
|
],
|
|
"filePrefixes": [
|
|
"C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs",
|
|
"C:\\Windows\\CCM\\Logs",
|
|
"C:\\Windows\\Logs",
|
|
"C:\\Windows\\Panther",
|
|
"C:\\Windows\\SetupDiag",
|
|
"C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
|
|
"C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
|
|
"C:\\ProgramData\\RealmJoin\\choco\\logs"
|
|
],
|
|
"userProfileFilePrefixes": [
|
|
"AppData\\Local\\RealmJoin"
|
|
],
|
|
"wmiQueryPrefixes": [
|
|
"SELECT * FROM Win32_OperatingSystem",
|
|
"SELECT * FROM Win32_ComputerSystem",
|
|
"SELECT * FROM Win32_BIOS",
|
|
"SELECT * FROM Win32_Processor",
|
|
"SELECT * FROM Win32_BaseBoard",
|
|
"SELECT * FROM Win32_Battery",
|
|
"SELECT * FROM Win32_TPM",
|
|
"SELECT * FROM Win32_NetworkAdapter",
|
|
"SELECT * FROM Win32_NetworkAdapterConfiguration",
|
|
"SELECT * FROM Win32_DiskDrive",
|
|
"SELECT * FROM Win32_LogicalDisk",
|
|
"SELECT * FROM SoftwareLicensingProduct"
|
|
],
|
|
"eventLogChannels": [
|
|
{
|
|
"category": "Core Windows logs",
|
|
"channels": [
|
|
"Application",
|
|
"System",
|
|
"Setup",
|
|
"Microsoft-Windows-Kernel-Boot",
|
|
"Microsoft-Windows-Diagnostics-Performance"
|
|
]
|
|
},
|
|
{
|
|
"category": "MDM / Enrollment",
|
|
"channels": [
|
|
"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider",
|
|
"Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
|
|
"Microsoft-Windows-Provisioning-Diagnostics-Provider",
|
|
"Microsoft-Windows-AAD",
|
|
"Microsoft-Windows-User Device Registration"
|
|
]
|
|
},
|
|
{
|
|
"category": "ESP / Shell / Apps",
|
|
"channels": [
|
|
"Microsoft-Windows-Shell-Core",
|
|
"Microsoft-Windows-AppXDeployment",
|
|
"Microsoft-Windows-AppXDeploymentServer",
|
|
"Microsoft-Windows-AppReadiness",
|
|
"Microsoft-Windows-Store"
|
|
]
|
|
},
|
|
{
|
|
"category": "Security posture / Crypto",
|
|
"channels": [
|
|
"Microsoft-Windows-BitLocker-API",
|
|
"Microsoft-Windows-BitLocker-DrivePreparationTool",
|
|
"Microsoft-Windows-TPM-WMI",
|
|
"Microsoft-Windows-CertificateServicesClient-Lifecycle-System"
|
|
]
|
|
},
|
|
{
|
|
"category": "Update / Servicing",
|
|
"channels": [
|
|
"Microsoft-Windows-WindowsUpdateClient"
|
|
]
|
|
},
|
|
{
|
|
"category": "Logon / Session",
|
|
"channels": [
|
|
"Microsoft-Windows-Winlogon",
|
|
"Microsoft-Windows-User Profile Service",
|
|
"Microsoft-Windows-GroupPolicy",
|
|
"Microsoft-Windows-TaskScheduler"
|
|
]
|
|
},
|
|
{
|
|
"category": "Network",
|
|
"channels": [
|
|
"Microsoft-Windows-NetworkProfile",
|
|
"Microsoft-Windows-Dhcp-Client",
|
|
"Microsoft-Windows-DNS-Client",
|
|
"Microsoft-Windows-NCSI",
|
|
"Microsoft-Windows-WLAN-AutoConfig",
|
|
"Microsoft-Windows-Time-Service"
|
|
]
|
|
}
|
|
],
|
|
"blockedEventLogChannels": [
|
|
"Security",
|
|
"Microsoft-Windows-PowerShell",
|
|
"Windows PowerShell",
|
|
"Microsoft-Windows-Sysmon"
|
|
],
|
|
"allowedCommands": [
|
|
{
|
|
"category": "TPM and Security",
|
|
"commands": [
|
|
"Get-Tpm",
|
|
"Get-SecureBootPolicy",
|
|
"Get-SecureBootUEFI -Name SetupMode"
|
|
]
|
|
},
|
|
{
|
|
"category": "BitLocker",
|
|
"commands": [
|
|
"Get-BitLockerVolume -MountPoint C:"
|
|
]
|
|
},
|
|
{
|
|
"category": "Network",
|
|
"commands": [
|
|
"Get-NetAdapter | Select-Object Name, Status, InterfaceDescription, MacAddress, LinkSpeed",
|
|
"Get-DnsClientServerAddress | Select-Object InterfaceAlias, ServerAddresses",
|
|
"Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv4Address, IPv4DefaultGateway, DNSServer",
|
|
"netsh winhttp show proxy",
|
|
"ipconfig /all"
|
|
]
|
|
},
|
|
{
|
|
"category": "Domain / Identity",
|
|
"commands": [
|
|
"nltest /dsgetdc:",
|
|
"dsregcmd /status"
|
|
]
|
|
},
|
|
{
|
|
"category": "Certificate",
|
|
"commands": [
|
|
"certutil -store My",
|
|
"$c = Get-ChildItem Cert:\\LocalMachine\\My; if ($c) { $c | Select-Object Subject, Thumbprint, Issuer, NotBefore, NotAfter, HasPrivateKey | ConvertTo-Json } else { '{\"CertificateCount\": 0}' }"
|
|
]
|
|
},
|
|
{
|
|
"category": "Windows Update",
|
|
"commands": [
|
|
"Get-HotFix | Select-Object -First 10 HotFixID, InstalledOn, Description"
|
|
]
|
|
},
|
|
{
|
|
"category": "Autopilot / Hardware Identity",
|
|
"commands": [
|
|
"try { $cs = Get-CimInstance -ClassName Win32_ComputerSystem; $bios = Get-CimInstance -ClassName Win32_BIOS; $hash = $null; try { $hash = (Get-CimInstance -Namespace root/cimv2/mdm/dmmap -ClassName MDM_DevDetail_Ext01 -Filter \"InstanceID='Ext' AND ParentID='./DevDetail'\" -ErrorAction Stop).DeviceHardwareData } catch { $hash = \"ERROR: $($_.Exception.Message)\" }; [pscustomobject]@{ Manufacturer = $cs.Manufacturer; Model = $cs.Model; SystemSKU = $cs.SystemSKUNumber; SerialNumber = $bios.SerialNumber; BiosVersion = $bios.SMBIOSBIOSVersion; HardwareHash = $hash } | ConvertTo-Json -Compress } catch { @{ error = $_.Exception.Message } | ConvertTo-Json -Compress }"
|
|
]
|
|
}
|
|
],
|
|
"diagnosticsPathPrefixes": [
|
|
"C:\\ProgramData\\AutopilotMonitor",
|
|
"C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs",
|
|
"C:\\Windows\\Panther",
|
|
"C:\\Windows\\Logs",
|
|
"C:\\Windows\\SetupDiag",
|
|
"C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
|
|
"C:\\Windows\\System32\\winevt\\Logs",
|
|
"C:\\Windows\\CCM\\Logs",
|
|
"C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
|
|
"C:\\ProgramData\\Microsoft\\Windows\\WER",
|
|
"C:\\Windows\\Logs\\CBS",
|
|
"C:\\Install\\Log"
|
|
],
|
|
"blockedFilePrefixes": [
|
|
"C:\\Users",
|
|
"C:\\Windows\\System32\\config"
|
|
],
|
|
"blockedCommandPatterns": [
|
|
"Invoke-WebRequest",
|
|
"Invoke-RestMethod",
|
|
"Start-BitsTransfer",
|
|
"wget",
|
|
"curl",
|
|
"certutil -urlcache",
|
|
"New-LocalUser",
|
|
"Add-LocalGroupMember",
|
|
"net user",
|
|
"net localgroup",
|
|
"bcdedit",
|
|
"bcdboot",
|
|
"schtasks /create",
|
|
"Register-ScheduledTask",
|
|
"Remove-Item -Recurse",
|
|
"Format-Volume",
|
|
"Set-ExecutionPolicy"
|
|
],
|
|
"maxCommandLength": 2000,
|
|
"blockedInterimTriggerEventTypes": [
|
|
"performance_snapshot",
|
|
"agent_metrics_snapshot",
|
|
"download_progress",
|
|
"network_state_change",
|
|
"network_connectivity_check",
|
|
"log_entry",
|
|
"agent_trace",
|
|
"stall_probe_check"
|
|
],
|
|
"imeLogDerivedEventTypes": [
|
|
"app_install_started",
|
|
"app_install_completed",
|
|
"app_install_failed",
|
|
"app_install_skipped",
|
|
"app_download_started",
|
|
"app_tracking_summary",
|
|
"download_progress",
|
|
"do_telemetry",
|
|
"script_started",
|
|
"script_completed",
|
|
"script_failed",
|
|
"script_timeout_suspected",
|
|
"script_recurrence_summary",
|
|
"esp_phase_changed",
|
|
"ime_agent_version",
|
|
"ime_token_failure",
|
|
"ime_user_session_completed",
|
|
"ime_process_exited",
|
|
"ime_user_token_acquired"
|
|
]
|
|
}
|