Navigation

  • Home
  • Documentation

    Agent

    The Autopilot Monitor agent is a lightweight .NET application that runs on the device during the Windows Autopilot enrollment process. It collects real-time telemetry about enrollment phases, app installations, policy processing, and system events — then streams everything to the backend for live monitoring and analysis.

    Full Enrollment Timeline — From the Very First Second

    Although the agent arrives on the device via the bootstrapper script — typically a few seconds after MDM enrollment begins — it does not miss any earlier activity. The Intune Management Extension (IME) has been writing detailed log files from the very start of enrollment, and the agent reads those logs from the beginning on its first launch. This backfill mechanism ensures complete coverage of the entire enrollment timeline, with no blind spots.

    1
    IME logs from the start: The Intune Management Extension begins logging immediately when enrollment starts — long before the agent exists on the device. App downloads, installations, ESP phase transitions, and policy processing are all recorded into CMTrace-formatted log files on disk.
    2
    Backfill on first launch: When the agent starts for the first time, it reads the IME log files from byte position zero. Every historical entry — app state changes, phase transitions, download progress, script executions — is parsed and processed as if the agent had been running the whole time. Archived (rotated) log files are included and processed before the current log to preserve chronological order.
    3
    Real-time from there: After the initial backfill completes, the agent switches to incremental polling. It tracks the byte position in each log file and reads only new data on each cycle, providing real-time visibility into ongoing enrollment activity without re-processing earlier entries.

    The result is a complete, chronologically accurate record of every app installation, ESP phase, and enrollment signal from T=0 — regardless of when the agent was installed on the device.

    Latest Agent Version
    Loading version info...
    Latest Bootstrapper Script Version
    Loading version info...

    Binary Integrity Verification

    Agent binaries are protected by SHA-256 integrity verification at two stages: during download (package integrity) and at runtime (executable integrity). This ensures the binary has not been tampered with, corrupted during transfer, or modified after installation.

    1
    Build-time hash: When a new agent version is built, the CI/CD pipeline computes two SHA-256 hashes: one for the agent ZIP package (stored in version.json) and one for the agent executable itself (stored in the backend configuration).
    2
    Download verification: Both the bootstrapper script and the agent's self-updater verify the SHA-256 hash of the downloaded package before installation. If the hash does not match, installation is aborted.
    3
    Backend cross-check: The expected ZIP hash is also stored in the backend and delivered to the agent via the authenticated configuration endpoint — a second, independent trust channel. An attacker would need to compromise both the download server and the backend API simultaneously.
    4
    Runtime integrity check: After fetching its configuration from the backend, the running agent computes the SHA-256 hash of its own executable and compares it against the EXE hash provided in the configuration response. A mismatch triggers an emergency alert, detecting post-installation tampering or binary corruption on disk.

    All communication uses HTTPS (TLS 1.2+). The agent authenticates to the backend using the device's MDM client certificate, ensuring only authorized devices receive configuration data.

    Command-Line Parameters

    The agent accepts command-line parameters for testing, debugging, and advanced scenarios. These are passed when launching the agent executable directly.

    Session & Lifecycle

    --new-session

    Deletes existing session data and starts a fresh session. Useful when the agent needs to be restarted on a device without carrying over stale data from a previous run.

    --no-cleanup

    Suppresses self-destruct after enrollment — agent files and the scheduled task remain on the device. Helpful for post-enrollment debugging and log analysis.

    --keep-logfile

    Preserves the log directory during self-destruct. Logs remain on disk for later analysis even after the agent cleans up everything else.

    --reboot-on-complete

    Reboots the device after enrollment completes. The reboot is delayed by 10 seconds by default (configurable via the remote configuration). Useful when a reboot is required to finalize device setup but not configured as a tenant default.

    --disable-geolocation

    Disables geo-location detection. The agent will not attempt to resolve the device's geographic location via IP-based lookup. Useful in restricted network environments or when location data is not desired.

    Authentication & Bootstrap

    --bootstrap-token <token>

    Provides a bootstrap token for pre-MDM authentication during OOBE, before an MDM client certificate is available on the device.

    --await-enrollment

    The agent waits for the MDM client certificate to become available before starting monitoring. Timeout can be configured with --await-enrollment-timeout.

    --await-enrollment-timeout <minutes>

    Maximum time in minutes to wait for the MDM certificate. Default: 480 (8 hours).

    Testing & Replay

    --ime-log-path <path>

    Custom path to IME log files. Allows testing with logs collected from other devices without running a real enrollment.

    --replay-log-dir <path>

    Replays real IME log files from the specified directory and simulates a complete enrollment in fast-forward. Creates a real session in the backend — device information is collected from the current machine (WMI/Registry), while enrollment events are extracted from the log files. Ideal for testing, demos, or analyzing past enrollments without waiting for a live enrollment.

    --replay-speed-factor <n>

    Time compression factor for log replay. Default: 50. A factor of 50 means a 50-minute enrollment replays in approximately 1 minute. Delays between events are divided by this factor, capped at 5 seconds per delay.

    Example — Replay a captured enrollment

    AutopilotMonitor.Agent.exe --replay-log-dir "C:\Logs\IME" --replay-speed-factor 100

    Replays a previously captured enrollment at 100x speed, creating a full session visible in the dashboard.

    Parameters like --replay-log-dir are intended for testing and development environments only — do not use them in production deployments.