42 lines
3 KiB
Markdown
42 lines
3 KiB
Markdown
# Astra continuation — complete free guests and protected autologon
|
|
|
|
Read housekeeping-worker-state.md and lead-state.md. Same ownership, Terra model, no delegates.
|
|
User asked for all five VMs plus passwordless logins; continue beyond policies on only two guests.
|
|
|
|
## Astra decision on activity
|
|
|
|
An active dedicated `re` console session or passive VNC proxy ALONE does not constitute a test.
|
|
Inventory VM140/144/146 for actual SOTS/game, debugger, capture, UI automation, running scheduled
|
|
test tasks and recent harness activity. If absent, apply non-disruptive policies serially without
|
|
logging off/rebooting or closing user's tools. The user authorized removing consumer interference
|
|
so OneDrive/Copilot presence alone is a target, not a blocker. Actual active test/interactive task
|
|
must remain untouched. Report exact process/task/time evidence for any remaining blocked guest.
|
|
Use the canonical lease CLI now provided in tools/campaign.py; no custom lock format needed.
|
|
Clean up only your previously created empty custom directories if incompatible with new leases.
|
|
|
|
## Autologon investigation and implementation
|
|
|
|
Do not stop at "no protected-secret tool verified" without investigating. Supported Sysinternals
|
|
Autologon stores password as an LSA secret and is suitable for dedicated lab accounts. Discover
|
|
existing installation/infra procedure; use verified Microsoft download if needed. Alternatively
|
|
Windows LsaStorePrivateData with a small reviewed script is the same protected-secret mechanism.
|
|
Use the existing account password from the documented credential store, never change it or print
|
|
it. Do not place it on command lines, in repository/temporary script files, stdout or logs. If a
|
|
utility only accepts plaintext command-line passwords, use its UI securely or the LSA API with a
|
|
secret passed over a protected channel/in memory, and zero memory when feasible. Preserve remote
|
|
SSH key auth. Do NOT use DefaultPassword plaintext registry value. Inspect any existing autologon
|
|
configuration without logging secrets; do not read/print password values in inventory.
|
|
|
|
Verify AutoAdminLogon + username/domain + existence (NOT CONTENTS) of protected secret. Need a
|
|
free guest and recorded recovery path to reboot and prove actual autologon. If reboots cannot be
|
|
done while viewer/session active, report configuration verified but login-after-reboot unverified.
|
|
If credential store lacks the existing password, report that exact missing dependency for user;
|
|
do not reset passwords or pretend config-only is demonstrated login.
|
|
|
|
## Debloat quality
|
|
|
|
Policies alone may leave current OneDrive/Copilot/Xbox/consumer scheduled startup active. Inventory
|
|
startup entries, consumer processes and scheduled tasks, remove/disable targeted consumer startups
|
|
and app packages only where safe for dedicated lab. Preserve all game/runtime/remote tooling.
|
|
Record exact differences and idempotence verify all intended policy/task/startup settings.
|
|
Keep guest-by-guest outcome in evidence and checkpoint. No false all-five completion.
|