3 KiB
Astra continuation — complete free guests and protected autologon
Read housekeeping-worker-state.md and lead-state.md. Same ownership, Terra model, no delegates. User asked for all five VMs plus passwordless logins; continue beyond policies on only two guests.
Astra decision on activity
An active dedicated re console session or passive VNC proxy ALONE does not constitute a test.
Inventory VM140/144/146 for actual SOTS/game, debugger, capture, UI automation, running scheduled
test tasks and recent harness activity. If absent, apply non-disruptive policies serially without
logging off/rebooting or closing user's tools. The user authorized removing consumer interference
so OneDrive/Copilot presence alone is a target, not a blocker. Actual active test/interactive task
must remain untouched. Report exact process/task/time evidence for any remaining blocked guest.
Use the canonical lease CLI now provided in tools/campaign.py; no custom lock format needed.
Clean up only your previously created empty custom directories if incompatible with new leases.
Autologon investigation and implementation
Do not stop at "no protected-secret tool verified" without investigating. Supported Sysinternals Autologon stores password as an LSA secret and is suitable for dedicated lab accounts. Discover existing installation/infra procedure; use verified Microsoft download if needed. Alternatively Windows LsaStorePrivateData with a small reviewed script is the same protected-secret mechanism. Use the existing account password from the documented credential store, never change it or print it. Do not place it on command lines, in repository/temporary script files, stdout or logs. If a utility only accepts plaintext command-line passwords, use its UI securely or the LSA API with a secret passed over a protected channel/in memory, and zero memory when feasible. Preserve remote SSH key auth. Do NOT use DefaultPassword plaintext registry value. Inspect any existing autologon configuration without logging secrets; do not read/print password values in inventory.
Verify AutoAdminLogon + username/domain + existence (NOT CONTENTS) of protected secret. Need a free guest and recorded recovery path to reboot and prove actual autologon. If reboots cannot be done while viewer/session active, report configuration verified but login-after-reboot unverified. If credential store lacks the existing password, report that exact missing dependency for user; do not reset passwords or pretend config-only is demonstrated login.
Debloat quality
Policies alone may leave current OneDrive/Copilot/Xbox/consumer scheduled startup active. Inventory startup entries, consumer processes and scheduled tasks, remove/disable targeted consumer startups and app packages only where safe for dedicated lab. Preserve all game/runtime/remote tooling. Record exact differences and idempotence verify all intended policy/task/startup settings. Keep guest-by-guest outcome in evidence and checkpoint. No false all-five completion.