Oliver Kieselbach
ce4d884abc
The guard functions had unit tests, but nothing proved that Registry, Wmi, Json, Xml and File actually consult them before touching the registry, WMI or disk. These drive the collectors themselves: each blocked target must come back empty, emit exactly one security_warning naming the target, and produce no rule output. Prefix-spoofing included, plus a positive case through JsonCollector so it is pinned that the guard is a gate and not a wall. Path traversal had no explicit coverage either. The sharpest case is ...\Logs\..\..\..\..\Secret.txt - the RAW string starts with an allowed prefix, so a naive StartsWith would admit it; the test pins that Path.GetFullPath canonicalizes first and the allowlist sees C:\Secret.txt. Also traversal into the C:\Users privacy block and into System32\config, both asserted under unrestrictedMode, which lifts the allowlist but never those. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
AutopilotMonitor
Advanced monitoring and troubleshooting solution for Windows Autopilot deployments. Gain full visibility into every enrollment session with a detailed event timeline, fleet health dashboards, and session reporting. Define custom analysis rules to automatically detect issues and gather rules to collect targeted evidence. Retrieve diagnostics packages on demand, configure agent settings like auto-reboot behavior and automatic timezone adjustment — all managed centrally from the web dashboard.
Private Preview
Autopilot Monitor is currently running as a Private Preview. Visit autopilotmonitor.com to request access and learn more.
Overview
Autopilot Monitor provides real-time tracking, intelligent diagnostics, and automated troubleshooting for Windows Autopilot enrollment processes. It consists of:
- Bootstrap Script — PowerShell script deployed via Intune that starts monitoring early in the enrollment process
- Monitoring Agent — Lightweight .NET application that collects telemetry and evidence during enrollment
- Backend API — Azure Functions-based ingestion and processing pipeline
- Web Dashboard — Next.js application for real-time monitoring and fleet analytics
Architecture
For detailed information about the system architecture, components, and data flow, see Architecture Documentation.
Documentation
Full admin documentation is available at docs.autopilotmonitor.com
License
This project uses a split licensing model:
- MIT License — Agent (
src/Agent/) and Shared library (src/Shared/) — unrestricted use on end-user devices - AGPL-3.0 — Backend (
src/Backend/), Web Dashboard (src/Web/), and MCP Server (src/McpServer/) — server-side components remain open source
See LICENSE for full details.