Flagship Active · Enforce validated in production

DeviceLifecycle

A safety-first PowerShell lifecycle engine for identifying, quarantining, recovering, and removing inactive Windows devices using Active Directory and available evidence from Microsoft Entra ID and Intune.

PowerShellActive DirectoryMicrosoft Entra IDMicrosoft IntuneMicrosoft GraphJSONCSV
View project
Open source Active · Companion service

DeviceLifecycle-API

A narrow read-only FastAPI extension that publishes DeviceLifecycle reports and logs to authorized internal consumers without exposing lifecycle actions or the underlying administrative control plane.

PythonFastAPIUvicornPowerShellWindows ServerAPI SecurityCSVJSON
View project
Open source Active · Pilot-ready

WallpaperAgent

A Windows endpoint agent that securely downloads, validates, promotes, and applies versioned desktop and lock-screen content through separate machine and interactive-user security contexts.

PowerShellMicrosoft IntuneWindows Scheduled TasksSHA-256JSONWin32Windows Runtime
View project
Open source Active · Deployment reference

RustDeskIntuneDeployment

A PowerShell-based Microsoft Intune Win32 deployment package that installs, configures, validates, detects, and removes RustDesk on managed Windows endpoints.

PowerShellMicrosoft IntuneWin32 AppsWindows InstallerRustDeskWindows ServicesTOML
View project
Open source Active · Pilot-validated v1.0.0

Windows Unattended Provisioning

A security-conscious PowerShell pipeline that generates deployment-specific Windows answer files, performs delegated Active Directory domain join, and completes Hybrid Microsoft Entra join with state, cleanup, and validation controls.

PowerShellWindows SetupWindows 10Windows 11Active DirectoryMicrosoft Entra IDMicrosoft IntuneWindows LAPSXMLGitHub Actions
View project
Open source Active · v0.7.0 · RDP + SSH + temporal correlation

Remote Session API

Central FastAPI service for normalizing RDP and SSH telemetry, consolidating session lifecycle state, reconciling current state, and correlating connection origin asynchronously.

PythonFastAPISQLAlchemyAlembicMariaDBUvicornsystemdNginxHTTPXRESTJSON
View project
Open source Active · v0.3.1 · Windows rollout completed

RDP Session Agent

PowerShell agent for collecting RDP lifecycle events on Windows Server, capturing connection-origin evidence, reconciling state through WTS, and delivering telemetry with durable local spooling.

PowerShellWindows ServerWindows Event LogWTS APITask SchedulerDPAPIHTTPSJSONRDP
View project
Open source Pilot · v0.1.0 · Debian/Ubuntu

SSH Session Agent

Low-intrusion Linux agent that turns OpenSSH, journald, and systemd-logind evidence into normalized SSH telemetry for Remote Session API v2.

PythonLinuxOpenSSHsystemdjournaldsystemd-logindHTTPSJSONSSH
View project