Endpoint management and remediation
Project details
Why it was created
Directory, monitoring and remote-access tools solved isolated layers, but none closed the full resolution loop. Each incident still required collecting artifacts, finding a healthy peer and testing corrections manually. Recurring cases consumed 20–40 minutes per endpoint; complex incidents could take hours while stores needed to keep selling.
What I created
I designed and developed the platform end to end: Windows agent, native collectors, central management service, operations console, fleet orchestration and the supervised AI workflow for diagnosis, remediation and operational documentation.
How it is structured
- 01Collect
The C#/.NET agent collects local inventory, events and security posture, reports through active check-ins and executes authorized jobs; remote CIM/SMB collection covers sites without an outbound route.
- 02Correlate
The central service reconciles device identities and persists snapshots, job state, protected credentials, approvals and audit records; the operations console requires an explicit target.
- 03Act
Once the operator authorizes a device, Codex or Claude CLI compares it with healthy peers, triangulates the fault, captures a dump, preserves changed or corrupted files, applies the approved correction, validates recovery and documents the procedure.
Constraints and trade-offs
+
Constraints that shaped the system
- 01Stores remained open, so a failed action could interrupt sales rather than only a test environment.
- 02The fleet combined different Windows versions, network policies and intermittent connectivity.
- 03Administrative access had to remain restricted to the designated endpoint, while credentials, evidence and every privileged action stayed protected and auditable.
Trade-offs
- 01Local collection by the agent, with remote CIM/SMB fallback, favored coverage under imperfect connectivity over dependence on one transport.
- 02Fastify and SQLite kept the central management service operable and recoverable without introducing a heavier distributed data layer.
- 03Human approval, evidence capture and encrypted credential storage add steps before execution, deliberately exchanging unrestricted autonomy for a smaller blast radius.
Additional architecture decisions
- C#/.NET was chosen over Rust for first-class integration with WMI, COM, Windows Services, Event Log and Group Policy deployment.
- Fastify and SQLite kept the central management service recoverable without introducing a distributed data layer the operation did not need.
Business value
In observed recurring cases, resolution fell from 20–40 minutes to 5–7. The Service Desk moved from manually reproducing fixes to coordinating immediate, evidence-based resolution and reusing each documented procedure.
Engineering principle
“AI is fastest when it is not unrestricted: verified context, a designated target, healthy peers, explicit authority, preserved evidence and a recovery path turn model capability into safe operational speed.”