Oliver Kieselbach
6bd9139869
Intune's MDM device cert stores the DeviceId in OID 1.2.840.113556.5.4 as a bare 16-byte GUID with no ASN.1 wrapper, so the strict OCTET-STRING parser bailed on the tag check and returned null. Verified against a live Intune device cert: 5.4 is 16 raw bytes, while 5.6 / 5.11 / 5.14 carry the usual 04 10 wrapper. - ParseGuidFromAsn1OctetString -> ParseGuidFromExtension (the old name no longer describes what it parses); both encodings now handled, with the shared LE-GUID construction pulled into ToGuid(). The forms cannot collide: a wrapped 16-byte GUID is always >= 18 bytes. - Document the Intune MDM cert OID arc on the class: 5.4 DeviceId, 5.6 Intune AccountId (NOT the Entra tenant), 5.14 Entra TenantId, 5.11 undocumented GUID, 5.15/.16/.17/.18/.19/.23 INTEGER enums. - 13 tests pinning both encodings plus the malformed-input rejections, including a bare GUID whose first byte is the 0x04 OCTET STRING tag. No behaviour change for the MS-Organization-Access probe the agent uses; TryGetTenantIdFromCert is untouched. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
AutopilotMonitor
Advanced monitoring and troubleshooting solution for Windows Autopilot deployments. Gain full visibility into every enrollment session with a detailed event timeline, fleet health dashboards, and session reporting. Define custom analysis rules to automatically detect issues and gather rules to collect targeted evidence. Retrieve diagnostics packages on demand, configure agent settings like auto-reboot behavior and automatic timezone adjustment — all managed centrally from the web dashboard.
Availability
Autopilot Monitor is publicly available — the Community plan is free. Sign in with your work account at autopilotmonitor.com; new organizations complete a short activation step after first sign-in.
Overview
Autopilot Monitor provides real-time tracking, intelligent diagnostics, and automated troubleshooting for Windows Autopilot enrollment processes. It consists of:
- Bootstrap Script — PowerShell script deployed via Intune that starts monitoring early in the enrollment process
- Monitoring Agent — Lightweight .NET application that collects telemetry and evidence during enrollment
- Backend API — Azure Functions-based ingestion and processing pipeline
- Web Dashboard — Next.js application for real-time monitoring and fleet analytics
Architecture
For detailed information about the system architecture, components, and data flow, see Architecture Documentation.
Documentation
Full admin documentation is available at docs.autopilotmonitor.com
License
This project uses a split licensing model:
- MIT License — Agent (
src/Agent/) and Shared library (src/Shared/) — unrestricted use on end-user devices - AGPL-3.0 — Backend (
src/Backend/), Web Dashboard (src/Web/), and MCP Server (src/McpServer/) — server-side components remain open source
See LICENSE for full details.