mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
01fac29bcb
V2-only AutoLogonAnalyzer that reads the Winlogon AutoLogon configuration and emits an autologon_analysis event with raw facts at Info severity. AutoLogon can be a legitimate kiosk/shared-device setup or a way to automate enrollment/OOBE; the agent reports facts only and never reads the DefaultPassword value (presence detected via value-name enumeration). Backend analyze-rules grade the facts. - AutoLogonAnalyzer (always-on, no tenant toggle): startup no-op, runs at DeviceSetup-phase completion (new AutoLogonDeviceSetupTrigger on EspAndHelloHost.DeviceSetupProvisioningComplete) and at final shutdown. - Sysinternals Autologon heuristic (AutoLogon enabled + default user + no registry password = LSA-secret credential); never reads the LSA secret. - Analyze rules: ANALYZE-SEC-002 (AutoLogon enabled -> warning, default-on), ANALYZE-SEC-003 (plaintext DefaultPassword -> high), ANALYZE-SEC-004 (kiosk allow-list template). Sysinternals graded via a real confidence condition inside SEC-002/004 so the allow-list still suppresses approved kiosks. - autologon_analysis added to all event-type catalogs; rule-builder picker also gains the previously-missing integrity_bypass_analysis + local_admin_analysis. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>