Skip to content

docs(windows): document win01 autologon and the RDP console handoff #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jmgilman merged 1 commit into from
Oct 17, 2026
Merged

docs(windows): document win01 autologon and the RDP console handoff #49

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 12 additions & 7 deletions docs/docs/runbooks/windows-vm.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,8 +99,9 @@ so a rebuilt VM gets it.

[Windows-MCP](https://github.com/CursorTouch/Windows-MCP) 0.8.8 gives MCP
agents screenshots, the UI tree, input, and PowerShell on `win01`. It runs in
`josh`'s interactive session as the `windows-mcp-server` logon task and serves
streamable HTTP on port 8000.
`josh`'s interactive session as the `windows-mcp-server` logon task, under a
headless console host, and serves streamable HTTP on port 8000. The
first-logon script sets all of this up.

| Item | Value |
| --- | --- |
Expand All @@ -110,6 +111,8 @@ streamable HTTP on port 8000.
| Access | `ip_allowlist` and the `win01-windows-mcp` firewall rule: `10.10.0.0/16`, `192.168.1.0/24`, `192.168.2.0/24`, `100.64.0.0/10` |
| Telemetry | Off: user environment `ANONYMIZED_TELEMETRY=false` |
| Logs | `C:\Users\josh\.windows-mcp\server.log` and `server.error.log` |
| Sign-in | Sysinternals Autologon signs `josh` in at boot; the password is an LSA secret, not a registry value |
| RDP disconnect | Task `win01-rdp-to-console` (SYSTEM) runs `tscon` to return the session to the console, unlocked |

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Document the unlocked-console security impact

When anyone besides the intended operator can access the Incus graphical console, autologon plus the RDP handoff exposes a permanently unlocked administrator desktop after every boot or RDP disconnect. The existing Safety impact section only discusses VM creation, and this change provides neither a warning nor commands to disable Autologon and win01-rdp-to-console, leaving operators without the risk and rollback guidance required for this runbook.

AGENTS.md reference: AGENTS.md:L30-L34

Useful? React with 👍 / 👎.


The MCP client entry reads the token at connect time:

Expand All @@ -127,11 +130,13 @@ The token grants administrator-level control through the `PowerShell` and
`Registry` tools. Transport is plain HTTP: the token crosses the tailnet
(encrypted) and VLAN 50 in clear text.

The server only runs while `josh` has an interactive session, and UI tools
need that session unlocked. After a reboot it starts at the next logon;
closing the Remote Desktop window locks the session and screenshots fail
until someone signs in again. Restart it with
`Start-ScheduledTask windows-mcp-server` over SSH.
UI tools need an unlocked interactive session. Autologon provides one at
every boot, and closing a Remote Desktop window returns the session to the
console instead of leaving it locked. Signing out (rather than closing the
window) ends the session; the server then stops until the next sign-in or
reboot. Restart it with `Start-ScheduledTask windows-mcp-server` over SSH.
Rotating the `josh` password requires running Autologon again with the new
password (`C:\ProgramData\win01\Autologon64.exe /accepteula josh WIN01 <password>`).
Comment on lines +138 to +139

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update the canonical secret during password rotation

When josh is rotated on the live VM, rerunning Autologon updates only its stored credential; this procedure does not tell the operator to update win01.admin_password in services/windows/win01.sops.yaml, even though that file is the documented password source and is consumed when install media are staged. A later rebuild can therefore restore the old password and make the documented credential fail, so the rotation steps should update both the live account/Autologon and the canonical SOPS value.

AGENTS.md reference: AGENTS.md:L30-L34

Useful? React with 👍 / 👎.


## Activate

Expand Down
Loading