mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
cf8fadfc17
ANALYZE-SEC-002 fired Warning (confidence 90) on every normal user-driven Entra-join enrollment. During ESP, Windows writes AutoAdminLogon=1 + DefaultUserName + AutoLogonSID + no DefaultPassword for the enrolling user — the exact fingerprint the sysinternals_autologon_suspected heuristic targeted (enabled && user && !password). AutoLogon-enabled is registry-indistinguishable from a Sysinternals/kiosk setup during Autopilot, so the heuristic and SEC-002 could never tell a benign enrollment from a real one. Declare AutoLogon only when a plaintext password is actually present: - delete ANALYZE-SEC-002 (broad AutoLogon-active warning) - remove the non-discriminating sysinternals heuristic from AutoLogonAnalyzer (computation + finding label + checks.sysinternals_autologon_suspected) - strip the sysinternals condition+factor from SEC-004 (kiosk allow-list, still a disabled opt-in template) and refresh its now-stale SEC-002 guidance - ANALYZE-SEC-003 (plaintext DefaultPassword -> high) is now the sole default-on AutoLogon grade; the autologon_analysis event still carries all raw facts at Info Tests: assert SEC-002 absent + no rule references the sysinternals signal; add analyzer regression guard for enabled+user+no-password. V2-only, no ConfigVersion bump. Build 0 err, AutoLogon 19/19, BuiltInRulesTests 8/8, web tsc clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>