Administrator guide

Technician workstations should have the RSAT Active Directory Domain Services and Lightweight Directory Services tools installed so the ActiveDirectory PowerShell module is available. The AD user report fails safely with a visible finding when it is absent. Configuration Manager Remote Control requires CmRcViewer.exe and its normal companion files; deploy the Configuration Manager console or approved standalone remote tools. If the viewer is outside standard console paths, set remote_control.viewer_path in enterprise or machine configuration.

Deployment

Use the PyInstaller one-directory output on a local drive or copy the source-prepared portable folder. Do not execute modules from a network share. Distribute centrally managed JSON files through SCCM/MDM or a protected package. Ordinary technicians need read/execute permission to application resources and write access to their %LOCALAPPDATA% application directory and the configured paths.downloads directory. When paths.downloads is empty, archives are written to C:\TEMP. Ensure the directory’s ACL permits the approved elevated support identities to create and read collected archives.

Set branding before packaging in config/defaults.json. Put organization policy in config/enterprise.json and list immutable dotted keys under _locked. Use repositories.json for approved sources. Never put secrets in any JSON file.

Managed application uninstall inventories Add/Remove Programs metadata and uses an exact MSI product code or a verified quiet vendor-uninstaller identity rather than a display name alone. Protect organization-critical products by adding case-insensitive name fragments to integrations.application_management.protected_products in enterprise.json, then lock that dotted key. The built-in list protects Configuration Manager, the toolkit, CrowdStrike/Falcon, GlobalProtect, Defender/Windows Security, and the Intune Management Extension. Validate exact MSI identities and vendor quiet registration in a pilot collection before authorizing broad use. EXE entries without a credible utility and matching QuietUninstallString are visible but disabled. Never remove these protections merely to work around a failed managed deployment.

Windows startup/logon tracing is an explicit persistent diagnostic. The confirmed management module copies a fixed runner to C:\TEMP\WindowsLogonTimingTrace, grants local Users read/execute access to the runner and modify access only to its Logs child, and registers Muon Insight Windows Logon Timing Trace for the BUILTIN\Users principal at limited privilege. The task runs for one through ten minutes and stores per-computer, per-user, timestamped evidence. Logs can include user names, startup command values, process names, printer/mapped-drive metadata, and event messages; apply the same endpoint and archive access controls as other support data. Use the remove action when investigation ends. Existing logs are retained unless the operator explicitly clears the retain option.

The application picker queries the selected endpoint under the same local or signed-in WinRM identity used for module execution. It returns only display metadata and never exposes uninstall command lines. The user picker similarly combines the interactive user, enabled local users, profile-backed identities, and direct local Administrators members that the execution identity can see. Pilot both pickers using the actual delegated support identity; restricted remote visibility is preferable to granting broad profile or registry access.

Computer OU movement runs on the technician workstation and uses the signed-in identity. Delegate only the required move permissions on approved source/destination OUs. The module does not disable accidental deletion protection, accept LDAP filters, or store alternate AD credentials. Its destination picker also runs locally through RSAT and reads a bounded approved OU subtree. Missing RSAT or insufficient directory read permission produces a visible load error without enabling manual DN entry. Set integrations.active_directory.ou_move_root to the approved organizational-unit distinguished name and lock the dotted key in enterprise configuration. The picker queries only that root and its subtree. The action resolves the configured root again and refuses a destination outside it, even if a parameter is crafted or an earlier selection becomes stale. An empty or invalid root fails closed.

Authorization

The current foundation reads groups from the signed-in Windows token (whoami /groups), which contains nested memberships resolved at sign-in. Refreshing requires a new token when directory membership has changed. Configure offline policy to deny, cached authorization, or read-only; read_only is the safe default. Production deployment must populate actual domain groups and test denied, nested, and offline cases with representative accounts.

Logging and support

Local JSON Lines logs rotate by size and backup count under the user data directory. Network logging is non-blocking and is phased; do not remove local logs. Search by correlation_id, task_id, module_id, or target. Stack traces belong in technical logs, not default dialogs.

Module operations

Validate a candidate with the schemas and tests before publishing. Give every module an immutable ID; change only its semantic version. Publish it from the Administration page, which records SHA-256 for every file in a snapshot (see ADMIN_REPOSITORY_GUIDE.md). Remove write permission for technicians and require signing in production.

Data directories and cleanup

MUON_DATA_DIR overrides the per-user data root for controlled test or portable scenarios. Task folders contain contexts and output but no stored credential. Apply enterprise retention to logs/reports and clean old task data only when no corresponding task is running. Never broadly grant access to cached authorization, environment metadata, or future credential references.