77 lines
3.5 KiB
Markdown
77 lines
3.5 KiB
Markdown
# Windows Deploy Startup Model
|
|
|
|
## Supported startup models
|
|
|
|
### 1. Multi-user RDP host
|
|
|
|
Use this model on `HOST-EXAMPLE`-style hosts with multiple user sessions.
|
|
|
|
- `AWatchRusCollectorGuard` service:
|
|
- runs under `LocalSystem`
|
|
- is the preferred local control plane for collector supervision
|
|
- in `shadow` mode only publishes state/heartbeat
|
|
- in `enforce` mode starts only session-appropriate collectors/tasks with cooldown and restart budget
|
|
- publishes `aw-rus-collector-guard_<HOST>`
|
|
- `ActivityWatch Launch [HOST_user]` tasks:
|
|
- `AtLogOn`
|
|
- `InteractiveToken`
|
|
- start only for users that currently have a real Windows session
|
|
- `ActivityWatch Recovery` task:
|
|
- `AtStartup`
|
|
- `SYSTEM`
|
|
- stays enabled even when `AWatchRusCollectorGuard` is active
|
|
- keeps only the global `worktime-session-collector` alive
|
|
- may re-trigger user launch tasks for managed live or disconnected sessions
|
|
- interactive collectors/watcher binaries belong to the user-session path, not to Session 0
|
|
|
|
Collector ownership in this model:
|
|
|
|
- `aw-watcher-afk` and `aw-watcher-window`: user-session only
|
|
- `browser-domains-native-collector.ps1`: user-session only
|
|
- `email-outbound-collector.ps1`: user-session only
|
|
- `file-operations-collector.ps1`: user-session path
|
|
- `dlp-endpoint-signals-collector.ps1`: user-session path
|
|
- `worktime-session-collector.ps1`: single global process under recovery path
|
|
- publishes session presence and `process_start` / `process_stop` events for all visible user sessions, including `Disc`
|
|
- this is session/process telemetry, not a replacement for per-user foreground window watchers
|
|
|
|
### 2. Standalone service installer
|
|
|
|
Use this model on single-user or headless hosts where Task Scheduler per-user orchestration is not the primary control plane.
|
|
|
|
- `aw-standalone-service.ps1` runs as a loop/service wrapper
|
|
- Session 0 starts only collectors that are safe headless
|
|
- browser/email interactive collectors must not be assumed available from Session 0
|
|
|
|
Collector ownership in this model:
|
|
|
|
- `dlp-endpoint-signals-collector.ps1`: allowed
|
|
- `file-operations-collector.ps1`: allowed
|
|
- `worktime-session-collector.ps1`: allowed
|
|
- still provides session/process telemetry, but not interactive foreground-window truth
|
|
- `browser-domains-native-collector.ps1`: not reliable in Session 0
|
|
- `email-outbound-collector.ps1`: not reliable in Session 0
|
|
- `aw-watcher-afk` / `aw-watcher-window`: not a standalone Session 0 primitive
|
|
|
|
## Non-supported mix
|
|
|
|
Do not mix the two startup models on the same RDP host:
|
|
|
|
- no permanent standalone-service loop together with per-user launch/recovery tasks
|
|
- no blind `Start-ScheduledTask` for all configured users
|
|
- no validation rule that treats users without sessions as failed collector startup
|
|
- no bot-driven collector recovery as the primary control plane
|
|
|
|
During migration, `AWatchRusCollectorGuard` may run in `shadow` mode beside the existing
|
|
recovery task. In `enforce` mode it becomes the primary control plane; `ActivityWatch Recovery`
|
|
still remains enabled as fallback/bootstrap and must not be disabled by deploy scripts.
|
|
|
|
## Hardening rules
|
|
|
|
- start launch tasks only for users with real sessions
|
|
- treat managed disconnected RDP sessions as real recovery targets when their launch tasks exist
|
|
- keep only one global `worktime-session-collector`
|
|
- validate by session-aware expectations, not by “all configured users must currently run”
|
|
- use guard heartbeat and bucket freshness as health signals
|
|
- keep `deploy_aw_windows.yml`, `deploy-ensemble.ps1`, `hardening-recovery.ps1`, and installer assumptions aligned
|