[Nobrac]

Fixes the findings of the code review of Part 1 and Part 2 (H1, M1–M6, N1–N10). Six commits, each of which builds and passes its tests on its own.

What changes

H1 – installer locked out the break-glass admin. install-doppio.ps1 imported register-filter.reg automatically and advised keeping a second admin unenrolled, who then had no way in at the console or over RDP. The filter is now a separate -EnableFilter step that refuses while an enabled local account is not enrolled (-AllowUnenrolled for service accounts). The CLSID check also covers HKLM\SOFTWARE\Classes\CLSID and the filter key.

M1/M2 – authentication package (ap.cpp). Rebuilt on the same lsass rules as the filter: no heap or CRT of its own, SEH around the decision, unreadable index = deny. AccountName is always returned from the LSA heap, as LSA_AP_LOGON_USER_EX2 requires. Status codes are now the documented ones (STATUS_ACCOUNT_RESTRICTION with SubStatus STATUS_INVALID_WORKSTATION, STATUS_INVALID_LOGON_TYPE, STATUS_NO_MEMORY). The user name is read as a client address or a packed offset (N2).

M3/M4/N5 – sub-auth filter (subauth.cpp). Authoritative and UserFlags are set on every path. The veto is STATUS_INVALID_WORKSTATION, which is in the documented list. MSV1_0_PASSTHRU gets no objection. LogoffTime/KickoffTime stay untouched, and every call logs the incoming values, so the VM test can settle the open question. install-subauth.ps1 refuses on a DC.

Store. The index reads that run in lsass moved to store_index.cpp. The two LSA DLLs now link only that file and advapi32, with no DPAPI, TOTP or bcrypt code in lsass. On the object files, the only unresolved symbols are Windows imports, __C_specific_handler and memset. Locale-invariant case folding (N8). QueryAnyEnrollment counts real secrets only (M6). The DACL repair moved from every SaveState to enroll.exe (N9).

Filter/enroll (N4, M6). UpdateRemoteCredential leaves RDP credentials alone while nothing is enrolled, and leaves smartcard serializations with their own provider. New enroll /list shows orphaned secrets of deleted accounts, and enroll /remove <SID> removes them.

Scripts (N1, N7). LSA install scripts also check WinInit event 12 since the last boot, because the Win11 default-on case is not documented to appear in RunAsPPL. The texts note that Auth0 loads on first use.

Tests/CI (N10). New tests/native/test_lsa runs the real subauth.cpp, ap.cpp and store_index.cpp against a fake registry, event log and LSA heap under ASan/UBSan. totp_check.py can now fail CI. CI parses every .ps1, adds /CETCOMPAT, and runs /analyze /WX over the lsass code.

Verified here

• All 14 .cpp files: clang syntax check against the mingw-w64 Windows headers, 0 errors, no new warnings.
• make -C tests/native: both suites pass. Re-introducing six of the old defects one at a time makes test_lsa fail each time.
• totp_check.py exits 1 on a wrong RFC vector and on a broken Base32 decoder.
• CI on this branch: all steps green – MSVC build with /W4 /sdl /guard:cf /CETCOMPAT, CFG check, /analyze /WX over the lsass code, PowerShell parse of every script, both native suites, Python check.

Not verified – please check

• PowerShell behaviour. The scripts parse, but none was run on Windows.
• Live LSA. Still untested, as before. In the VM, the [Doppio-SubAuth] lines now show what LogoffTime/KickoffTime hold and which LogonLevel a NetworkCleartext (type 8) logon arrives with.
• Behaviour change: the filter's veto code changed from STATUS_ACCOUNT_RESTRICTION to STATUS_INVALID_WORKSTATION (Microsoft's description: "The user is not authorized to log on to the specified workstation"), so a client shows a different error text. The article update in theadmincafe-nuxt explains it.
• Ristretto: its submodule pins Doppio at 2776655. When it moves to this branch, build-ristretto.bat has to add %DOPPIO%\store_index.cpp next to %DOPPIO%\store.cpp, or ristretto.exe will not link.

🤖 Generated with Claude Code

https://claude.ai/code/session_015Q8WTBzhJ9rZXAXLe89ssH

---

Generated by Claude Code