mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
33618e183d
Windows Update activity during Autopilot OOBE/ESP is a blind spot no other tool (Intune console included) surfaces well — a cumulative update installing mid-OOBE can break enrollment (r/Intune KB5095189). This makes it visible with secured evidence. Agent (net48): - WindowsUpdateTracker + WindowsUpdateWatcherHost: watch Microsoft-Windows-WindowsUpdateClient/Operational (EventIDs 19/20/43/44 = success/failure/install-started/download-started), startup backfill (OOBE updates run before the agent starts), RecordId watermark dedup (restart boundary vs intra-run seen-set so a high-id live event can't hide older backfill events), HRESULT->symbol decode. Emits windows_update_succeeded/_failed/_started with the real event Timestamp. Default-on config knobs; uncertain EventIDs configurable without redeploy. - RegistryCollector: emitOnlyIfExists (suppress positive-assertion events when the key is absent) + Registry64 base view by default (bitness-independent, matches TenantIdResolver) with optional registryView override. Rules: - ANALYZE-DEV-004 (high: WU failed during enrollment, high-insight not KO) + ANALYZE-DEV-005 (info: WU installed). reboot_pending corroboration matches event_data exists==true. - GATHER-DEVICE-005 -> windows_update_reboot_pending (emitOnlyIfExists), GATHER-DEVICE-004 -> windows_update_history (Get-HotFix, opt-in). - 5 EventTypes synced across Constants + MCP resource-catalog + web eventTypes. Self-maintaining rule lifecycle (analyze + gather parity): - Gather rules gain the sunset/orphan-GC that only analyze had (ProcessSunsetGatherRuleAsync + runtime filter + seed/reseed/github paths). - RuleProvenance field (embedded/github, null=embedded back-compat): the embedded catalog only sunsets its own rules; GitHub-reseeded rules ahead of the deployed binary (new ids AND content updates to existing ids) are exempt and reclaimed to embedded once the binary catches up. No orphans, no operator knowledge required. Verified: full solution builds; backend suite 2770 pass, agent suite 1638 pass; rules AJV-valid + combined. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>