# Genuine capture guide

The manifest in [capture-plan.json](capture-plan.json) defines **20 mandatory genuine evidence images: six Azure Portal, eleven CLI, and three guest Windows images**. The separate synthwave cover is an illustration and never counts toward evidence acceptance.

## Before paid deployment

Confirm usable Azure Portal and CLI capture access. Confirm Bastion Developer's region/subscription and browser connection prerequisites before paid deployment. After Foundation exists, prove the real guest desktop route before starting fault exercises. A VM Run Command report is useful evidence, but it is not a Windows Explorer or Active Directory Users and Computers screenshot. Do not accept a release without the three required genuine guest Windows captures.

## Retrieve generated login credentials privately

After Bootstrap/Configure, return to the extracted package directory in PowerShell 7 on the original Windows operator machine, using the same Windows account that created the current-user DPAPI store. Keep `$state` bound to this run's private ledger. The stored property names are `labAdminPassword` and `writerPassword`; these are generated domain-user passwords, not storage keys.

~~~powershell
Import-Module ./scripts/AzureFiles.Common.psm1
$secretFile = Join-Path (Split-Path $state -Parent) 'secrets.dpapi'
$labSecrets = Unprotect-AzureFilesSecrets -Path $secretFile
try { Set-Clipboard -Value $labSecrets.labAdminPassword }
finally { $labSecrets = $null }
~~~

In Portal, select the owned VM → **Connect → Bastion → Bastion Developer**. Use password authentication and username `AWZFILES\LabAdmin`, then paste into the password field. For ADUC, connect to the owned DC; for administrative folder-security views, connect to the owned client. After pasting, run `Set-Clipboard -Value ''` on the operator machine.

For capture 05, sign out of the client and start a separate Bastion session as `AWZFILES\Writer`. Repeat the block with `$labSecrets.writerPassword`, paste, then clear the clipboard. ConfigureClient adds Writer to the client's Remote Desktop Users group and verifies it is not a local administrator. Run `whoami` in that Writer desktop before the Explorer checkpoint. Do not count LabAdmin's access as Writer's access. Do not expose the password field, clipboard, DPAPI file or decrypted object in screenshots, transcripts or shared clipboard history.

## Capture rules

- Capture the actual deployed resources, actual guest applications, or actual command output. Do not recreate Azure UI or type expected output into a terminal.
- Keep the phase, UTC timestamp, command, actor, attempted operation, result and relevant diagnostic visible. Show the current synthetic run marker where meaningful.
- A later display of retained output must say so and retain its original execution timestamp. Label newly executed commands separately. Cloud Shell, the Windows operator and the guest are different execution contexts.
- Redact subscription/tenant IDs, personal identities, credentials, storage keys, passwords, full domain SIDs, real private paths and unrelated resource names as needed. Preserve synthetic actor labels, error codes, result counts, protocol/encryption, operation names and diagnostic reasons.
- Originals stay in the private run directory outside the package and Git. Put only privacy-reviewed PNGs in docs/screenshots. A read-only crop or privacy redaction may improve legibility; do not alter evidence text or status.
- Record image filename, source surface, source phase, original and public SHA-256, original capture timestamp, execution timestamp/context, caption, redactions, privacy review and generated_ui=false. Hash the final redacted bytes.
- Capture 07 must show the exact exercise CIFS SPN absent, and accompanying command evidence must exclude a HOST mapping fallback. Capture 13 must show the protected exercise-folder ACL, not a share-root default ACL.

## Planned sequence

| ID | Surface | Required observation |
|---|---|---|
| 01 | CLI | Preflight and exact reviewed Foundation plan, cost/context checks |
| 02 | Portal | Dedicated resource group/network and private Windows deployment |
| 03 | Portal | Private endpoint connection and private DNS integration |
| 04 | Portal | AD DS identity properties for the exercise storage account |
| 05 | Windows | Writer's genuine Explorer session, exercise content and synthetic marker |
| 06 | CLI | Per-user healthy SMB checks, exact CIFS tickets/AES256, SMB3.1.1/AES-256-GCM on both accounts |
| 07 | Windows | ADUC Attribute Editor: exercise CIFS SPN absent during Kerberos fault |
| 08 | CLI | Fresh-session Kerberos fault and healthy independent control |
| 09 | CLI | Kerberos repair, recovery and safe repeated repair |
| 10 | Portal | Exercise default share permission Reader during ShareGate fault |
| 11 | CLI | ShareGate: Writer read succeeds, new write denied, control works |
| 12 | CLI | ShareGate repair, recovery and safe repeated repair |
| 13 | Windows | Advanced Security: protected Exercise-folder Writer RX during Ntfs fault |
| 14 | CLI | Ntfs: new exercise-file creation denied; sibling and independent controls work |
| 15 | CLI | Ntfs repair, fresh new-file success and safe repeated repair |
| 16 | Portal | Actual StorageFileLogs events with observed protocol, actor/session/status fields |
| 17 | CLI | Final healthy matrix, log correlation and no unexpected Terraform drift |
| 18 | CLI | Exact owned resource absence after cleanup; unrelated baseline preserved |
| 19 | CLI | Repeated cleanup creates nothing; fresh absence/baseline comparison |
| 20 | Portal | SMB security: Kerberos-only, SMB3.1.1 and AES256 configuration |

Keep the image order in the article pedagogical: 20 belongs beside 04/06, rather than after cleanup. The numeric identifier remains stable in filenames and provenance.

## Acceptance

No pending image may count as captured. Every accepted PNG must exist, have a valid positive IHDR size, match its public checksum and be marked genuine and privacy-reviewed. All twenty mandatory images must pass. CLI and Windows reports must corroborate the intended fault; a guest/agent timeout or an unrelated authentication error does not establish it.