# Sanitized validation transcript

- `[PASS] Compiled WorkshopWindowsBaseline into a MOF with the expected configuration name.`
- `[WARN] Expected package-name mismatch failure: Found a dependency on resources from the PSDesiredStateConfiguration module, but we cannot copy these resources into the Guest Configuration package. Please switch these resources to using the PSDscResources module instead.`
- `[PASS] Compiled WorkshopWindowsBaseline into a MOF with the expected configuration name.`
- `[WARN] Expected package-name mismatch failure: Found a dependency on resources from the PSDesiredStateConfiguration module, but we cannot copy these resources into the Guest Configuration package. Please switch these resources to using the PSDscResources module instead.`
- `[PASS] Compiled WorkshopWindowsBaseline into a MOF with the expected configuration name.`
- `[WARN] Intentional package-name mismatch was created for the troubleshooting demonstration.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.0.0-Audit.zip; uncompressed size 2.45 MB.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.1.0-AuditAndSet.zip; uncompressed size 2.45 MB.`
- `[PASS] Local non-mutating package test completed; compliance result: False.`
- `[PASS] Created the Audit 1.0.0 and AuditAndSet 1.1.0 packages plus four role-aware policy definitions.`
- `[PASS] Exact active subscription confirmed: Visual Studio Enterprise Subscription (identifier redacted).`
- `[PASS] Preflight passed with PowerShell 7.6.3, Azure CLI available, all pinned modules, and sufficient B-series quota.`
- `[PASS] Exact active subscription confirmed: Visual Studio Enterprise Subscription (identifier redacted).`
- `[PASS] Exact active subscription confirmed: Visual Studio Enterprise Subscription (identifier redacted).`
- `[PASS] Exact active subscription confirmed: Visual Studio Enterprise Subscription (identifier redacted).`
- `[PASS] Exact active subscription confirmed: Visual Studio Enterprise Subscription (identifier redacted).`
- `[PASS] Exact active subscription confirmed: Visual Studio Enterprise Subscription (identifier redacted).`
- `[PASS] Compiled WorkshopWindowsBaseline into a MOF with the expected configuration name.`
- `[WARN] Intentional package-name mismatch was created for the troubleshooting demonstration.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.0.0-Audit.zip; uncompressed size 2.45 MB.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.1.0-AuditAndSet.zip; uncompressed size 2.45 MB.`
- `[WARN] The local audit test requires an elevated authoring shell; package execution will be validated through Azure VM Run Command.`
- `[PASS] Compiled WorkshopWindowsBaseline into a MOF with the expected configuration name.`
- `[WARN] Intentional package-name mismatch was created for the troubleshooting demonstration.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.0.0-Audit.zip; uncompressed size 2.45 MB.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.1.0-AuditAndSet.zip; uncompressed size 2.45 MB.`
- `[WARN] GuestConfiguration 4.12.0 emitted a recoverable generator warning; all generated policy JSON passed structural validation.`
- `[WARN] GuestConfiguration 4.12.0 emitted a recoverable generator warning; all generated policy JSON passed structural validation.`
- `[PASS] Created the Audit 1.0.0 and AuditAndSet 1.1.0 packages plus four role-aware policy definitions.`
- `[PASS] Exact active subscription confirmed: Visual Studio Enterprise Subscription (identifier redacted).`
- `[PASS] Compiled WorkshopWindowsBaseline into a MOF with the expected configuration name.`
- `[WARN] Intentional package-name mismatch was created for the troubleshooting demonstration.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.0.0-Audit.zip; uncompressed size 2.45 MB.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.1.0-AuditAndSet.zip; uncompressed size 2.45 MB.`
- `[WARN] The local audit test requires an elevated authoring shell; package execution will be validated through Azure VM Run Command.`
- `[PASS] Exact active subscription confirmed: Visual Studio Enterprise Subscription (identifier redacted).`
- `[PASS] Compiled WorkshopWindowsBaseline into a MOF with the expected configuration name.`
- `[WARN] Intentional package-name mismatch was created for the troubleshooting demonstration.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.0.0-Audit.zip; uncompressed size 2.45 MB.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.1.0-AuditAndSet.zip; uncompressed size 2.45 MB.`
- `[PASS] Exact active subscription confirmed: Visual Studio Enterprise Subscription (identifier redacted).`
- `[PASS] Compiled WorkshopWindowsBaseline into a MOF with the expected configuration name.`
- `[WARN] Intentional package-name mismatch was created for the troubleshooting demonstration.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.0.0-Audit.zip; uncompressed size 2.45 MB.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.1.0-AuditAndSet.zip; uncompressed size 2.45 MB.`
- `[WARN] GuestConfiguration 4.12.0 emitted a recoverable generator warning; all generated policy JSON passed structural validation.`
- `[WARN] GuestConfiguration 4.12.0 emitted a recoverable generator warning; all generated policy JSON passed structural validation.`
- `[PASS] Created the Audit 1.0.0 and AuditAndSet 1.1.0 packages plus four role-aware policy definitions.`
- `[PASS] Packages were uploaded with Entra authentication; temporary upload access was removed and public Storage access was disabled.`

## Cleanup verification

- `[PASS] Reviewed the exact cleanup target before deletion.`
- `[PASS] Deleted the workshop policy assignments, remediation tasks, guest assignments, role assignments, custom initiatives, and custom definitions.`
- `[PASS] Azure reports rg-machine-configuration-deep-dive-we as absent.`
- `[PASS] Zero workshop VMs, public IPs, disks, role assignments, policy assignments, custom definitions, or initiatives remain.`
- `[PASS] Resources outside the exact workshop scope were not modified.`
- `[WARN] The first enforcement report exposed the documented PowerShell 7 incompatibility in the PSDscResources Windows feature resources; success was not claimed.`
- `[PASS] Replaced WindowsFeature and WindowsOptionalFeature with a packaged class-based Windows PowerShell bridge and regenerated all four role-aware definitions.`
- `[PASS] Confirmed both enforcement definitions use the corrected immutable hash, ApplyAndAutoCorrect assignment type, ApplyAndAutoCorrect LCM mode, and a 15-minute evaluation frequency.`
- `[PASS] Removed only the stale baseline audit child assignment and started fresh corrected remediation for both initiative members.`
- `[PASS] Corrected baseline and application remediation deployments both completed successfully.`
- `[PASS] Live guest verification: Server 2022 registry 1.1.0, marker present, Event Log Automatic, IIS absent.`
- `[PASS] Live guest verification: Server 2025 registry 1.1.0, marker present, Event Log Automatic, IIS present.`
- `[WARN] A redirected-stream deadlock left the first custom Windows PowerShell bridge process alive after IIS changed; the assignment remained Pending.`
- `[PASS] The final bridge drains stdout and stderr concurrently, enforces a 15-minute timeout, and was rehashed before redeployment.`
- `[PASS] Reset only the two workshop guest assignments and ConfigurationforWindows extensions; the VMs, AMA, networking, monitoring, and unrelated guest assignments were preserved.`
- `[PASS] Second drift was captured at 2026-08-12T11:35:02Z with no later remediation task created.`
- `[PASS] Final live guest verification: both machines returned to registry 1.1.0, marker present, Event Log Automatic; IIS absent on baseline and present on application.`
- `[PASS] REST and Resource Graph reported both WorkshopWindowsBaseline assignments Compliant with the same final package hash and ApplyAndAutoCorrect mode.`
- `[PASS] Log Analytics correlated workshop drift event 4101 and desired-state verification event 4102 for both machines.`
- `[PASS] Audit policy definitions, initiative, and resource-group assignment were created.`
- `[PASS] Azure Policy compliance scan requested.`
- `[PASS] Private Storage networking verified: public access disabled and Blob Private Endpoint approved.`
- `[WARN] Deliberate package access test returned HTTP 403 before container-scoped RBAC.`
- `[PASS] Audit initiative initially matched only the Windows Server 2022 baseline VM.`
- `[PASS] The mistyped Pliot tag was corrected to Pilot and the application VM entered policy scope.`
- `[PASS] ConfigurationforWindows 1.29.116.0 provisioned successfully on Windows Server 2025.`
- `[WARN] Azure VM Run Command executes Windows PowerShell 5.1; the guest drift helper was corrected from a PowerShell 7.2 requirement before use.`
- `[WARN] Verified application drift: registry DRIFTED, proof marker absent, Event Log startup Manual, and IIS absent while Firewall remained enabled and SMBv1 absent.`
- `[PASS] Enforcement policy definitions, initiative, system-assigned identity, and resource-group assignment were created.`
- `[PASS] Separate ApplyAndAutoCorrect remediation tasks started for the baseline and application initiative members.`
- `[WARN] The audit assignment intentionally has a bad baseline checksum and the package identity still lacks blob access.`
- `[PASS] The package identity now has Storage Blob Data Reader only at the private container scope.`
- `[PASS] Azure Policy compliance scan requested.`
- `[PASS] Azure Policy compliance scan requested.`
- `[PASS] The Pliot tag typo was corrected; both Windows VMs are now in the Pilot ring.`
- `[WAIT] vm-mc-ws2025-we Machine Configuration extension is still converging.`
- `[WAIT] vm-mc-ws2025-we Machine Configuration extension is still converging.`
- `[PASS] vm-mc-ws2025-we Machine Configuration extension is ready.`
- `[WARN] Drift could not be introduced on vm-mc-ws2022-we during this pass: ERROR: (Conflict) Run command extension execution is in progress. Please wait for completion before invoking a run command.
Code: Conflict
Message: Run command extension execution is in progress. Please wait for completion before invoking a run command.`
- `[WARN] Safe drift introduced on vm-mc-ws2025-we: `
- `[PASS] Azure Policy compliance scan requested.`
- `[PASS] enforcement policy managed identity is ready.`
- `[PASS] Enforce policy definitions, initiative, and resource-group assignment were created.`
- `[PASS] Azure Policy compliance scan requested.`
- `[PASS] ApplyAndAutoCorrect assignment and two role-aware remediation tasks were started.`
- `[WARN] Live enforcement found that PSDscResources requires Force=true before it overwrites the deliberately drifted registry value.`
- `[PASS] Corrected the DSC registry resources, rebuilt the final packages, refreshed package hashes, and redeployed only the workshop guest assignments.`
- `[PASS] The Author stage now polls temporary Storage data-plane RBAC instead of assuming fixed propagation time.`
- `[WARN] Live enforcement proved that assignmentType alone is insufficient when the LCM configurationMode remains MonitorOnly.`
- `[PASS] The generated enforcement definitions and guest assignments now set both assignmentType and configurationMode to ApplyAndAutoCorrect at a 15-minute consistency interval.`
- `[PASS] Compiled WorkshopWindowsBaseline into a MOF with the expected configuration name.`
- `[WARN] Intentional package-name mismatch was created for the troubleshooting demonstration.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.0.0-Audit.zip; uncompressed size 2.45 MB.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.1.0-AuditAndSet.zip; uncompressed size 2.45 MB.`
- `[WARN] GuestConfiguration 4.12.0 emitted a recoverable generator warning; all generated policy JSON passed structural validation.`
- `[WARN] GuestConfiguration 4.12.0 emitted a recoverable generator warning; all generated policy JSON passed structural validation.`
- `[PASS] Created the Audit 1.0.0 and AuditAndSet 1.1.0 packages plus four role-aware policy definitions.`
- `[PASS] Exact active subscription confirmed: Visual Studio Enterprise Subscription (identifier redacted).`
- `[PASS] Compiled WorkshopWindowsBaseline into a MOF with the expected configuration name.`
- `[WARN] Intentional package-name mismatch was created for the troubleshooting demonstration.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.0.0-Audit.zip; uncompressed size 2.45 MB.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.1.0-AuditAndSet.zip; uncompressed size 2.45 MB.`
- `[WARN] GuestConfiguration 4.12.0 emitted a recoverable generator warning; all generated policy JSON passed structural validation.`
- `[WARN] GuestConfiguration 4.12.0 emitted a recoverable generator warning; all generated policy JSON passed structural validation.`
- `[PASS] Created the Audit 1.0.0 and AuditAndSet 1.1.0 packages plus four role-aware policy definitions.`
- `[PASS] Exact active subscription confirmed: Visual Studio Enterprise Subscription (identifier redacted).`
- `[PASS] Compiled WorkshopWindowsBaseline into a MOF with the expected configuration name.`
- `[WARN] Intentional package-name mismatch was created for the troubleshooting demonstration.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.0.0-Audit.zip; uncompressed size 2.45 MB.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.1.0-AuditAndSet.zip; uncompressed size 2.45 MB.`
- `[WARN] GuestConfiguration 4.12.0 emitted a recoverable generator warning; all generated policy JSON passed structural validation.`
- `[WARN] GuestConfiguration 4.12.0 emitted a recoverable generator warning; all generated policy JSON passed structural validation.`
- `[PASS] Created the Audit 1.0.0 and AuditAndSet 1.1.0 packages plus four role-aware policy definitions.`
- `[PASS] Packages were uploaded with Entra authentication; temporary upload access was removed and public Storage access was disabled.`
- `[PASS] Compiled WorkshopWindowsBaseline into a MOF with the expected configuration name.`
- `[WARN] Intentional package-name mismatch was created for the troubleshooting demonstration.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.0.0-Audit.zip; uncompressed size 2.46 MB.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.1.0-AuditAndSet.zip; uncompressed size 2.46 MB.`
- `[WARN] GuestConfiguration 4.12.0 emitted a recoverable generator warning; all generated policy JSON passed structural validation.`
- `[WARN] GuestConfiguration 4.12.0 emitted a recoverable generator warning; all generated policy JSON passed structural validation.`
- `[PASS] Created the Audit 1.0.0 and AuditAndSet 1.1.0 packages plus four role-aware policy definitions.`
- `[PASS] Exact active subscription confirmed: Visual Studio Enterprise Subscription (identifier redacted).`
- `[WAIT] Waiting for temporary Blob Data Contributor propagation (1/20).`
- `[PASS] Compiled WorkshopWindowsBaseline into a MOF with the expected configuration name.`
- `[WARN] Intentional package-name mismatch was created for the troubleshooting demonstration.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.0.0-Audit.zip; uncompressed size 2.46 MB.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.1.0-AuditAndSet.zip; uncompressed size 2.46 MB.`
- `[WARN] GuestConfiguration 4.12.0 emitted a recoverable generator warning; all generated policy JSON passed structural validation.`
- `[WARN] GuestConfiguration 4.12.0 emitted a recoverable generator warning; all generated policy JSON passed structural validation.`
- `[PASS] Created the Audit 1.0.0 and AuditAndSet 1.1.0 packages plus four role-aware policy definitions.`
- `[PASS] Packages were uploaded with Entra authentication; temporary upload access was removed and public Storage access was disabled.`
- `[PASS] Exact active subscription confirmed: Visual Studio Enterprise Subscription (identifier redacted).`
- `[WAIT] Waiting for temporary Blob Data Contributor propagation (1/20).`
- `[PASS] Compiled WorkshopWindowsBaseline into a MOF with the expected configuration name.`
- `[WARN] Intentional package-name mismatch was created for the troubleshooting demonstration.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.0.0-Audit.zip; uncompressed size 2.46 MB.`
- `[PASS] Validated package archive WorkshopWindowsBaseline-1.1.0-AuditAndSet.zip; uncompressed size 2.46 MB.`
- `[WARN] GuestConfiguration 4.12.0 emitted a recoverable generator warning; all generated policy JSON passed structural validation.`
- `[WARN] GuestConfiguration 4.12.0 emitted a recoverable generator warning; all generated policy JSON passed structural validation.`
- `[PASS] Created the Audit 1.0.0 and AuditAndSet 1.1.0 packages plus four role-aware policy definitions.`
- `[PASS] Packages were uploaded with Entra authentication; temporary upload access was removed and public Storage access was disabled.`
