mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 20:53:06 +00:00
Oliver Kieselbach
27fdd19568
EnableDoGroupIdAutoSet (ConfigVersion 40, default off): the agent seeds the DOGroupId policy value with a deterministic GUID derived from the default gateway's IPv4 + SendARP MAC, RealmJoin-compatible byte layout so mixed fleets peer together. Foreign DOGroupId/DOGroupIdSource policies always win (ownership tracked via StartupEventGate fingerprint); no random-GUID fallback. New do_group_id_auto_set event, portal toggle, admin report row, manifest/catalog sync, OKF doc. Gateway heuristic deduplicated into NetworkInterfaceLocator. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2.5 KiB
2.5 KiB
V2 Agent
How the on-device agent works:
- Runtime Overview - lifecycle (install → boot guards → runtime → termination), collector hosts, the single-rail event pipeline to the backend, config & kill switch, on-disk layout.
- Decision Engine - the pure-reducer state machine (DecisionCore): signals, state, effects, the A/B/C completion arms, invariants, threading.
- Logs, Persistence & Crash Recovery - every persisted file and why it exists; signal log vs spool; snapshot/journal; the replay-based recovery flow and quarantine.
- Hello Wizard Un-Skip - why a single "WHfB disabled" policy read never decides completion: the HelloWizardStarted signal (prevention + cure) and the HelloTracker confirmation second read.
- Autopilot ZTD Diagnostics - Windows' own diagnostic surfaces for the profile-download flow: ModernDeployment event IDs (807/815/164/...), the Diagnostics\Autopilot registry key, deployment-service endpoints, and the known-issue error-code map.
- MDM Reboot Coalescing - attributing the mid-ESP coalesced reboot ("second sign-in") to the device-assigned policy URIs that forced it: aggregated 2800 observations (neutral, flush-time watermark) + ANALYZE-ESP-005 gated on an actually-observed reboot.
- Power-State Watcher - live AC↔battery transitions and 50/30/15% downward threshold crossings via a WMI push subscription (no polling): power_state_change semantics (latch/debounce/cap, never armed without a battery) and the single-condition analyze rules ANALYZE-DEV-009/-010 on top.
- DO GroupId Auto-Set - the optional Delivery Optimization peering-group seed: deterministic GUID from default gateway IPv4 + MAC (RealmJoin-compatible), written to the DOGroupId policy value with readback, ownership-tracked so foreign Intune/GPO values are never overwritten; skip reasons and the do_group_id_auto_set event.
- System Timeline Watcher - clock steps (system_clock_changed: oldTime/newTime/timeDeltaMs/process, micro-slew floor) and completed sleep episodes (system_sleep_episode: sleep/hibernate/Modern Standby with authoritative enteredAt/exitedAt) from one System-channel EventLogWatcher with pre-agent backfill; feeds the web clock-set jump cause, the standby duration note, time-attribution SleepSpans and ANALYZE-DEV-012.
Reading order for newcomers: overview → decision engine → persistence.