Skip to content

Windows test machine#

A Windows 11 VM with a real vTPM, built unattended, for the Windows keystore backends and the Windows half of the break tests.

Why a VM and not a laptop#

The Windows backend talks TPM 2.0 through TBS, with CNG as the fallback when TBS is unreachable, and what either does — whether a machine key is visible to a service running as SYSTEM, whether the provider reports hardware backing, what an export attempt actually returns — cannot be answered from documentation. Windows 11's own install requirements (TPM 2.0, Secure Boot) happen to be exactly the ones the backend needs, so the installer refusing to run without them is a feature here.

Bring it up#

The installation ISO cannot be downloaded unattended: the evaluation centre answers 403 and the retail download API sits behind bot protection. Fetch it in a browser, then:

sudo mv ~/Downloads/win11*.iso /var/lib/libvirt/images/win11.iso
testbed/windows/up.sh          # 20-40 minutes, nothing to click

up.sh defines a dedicated NAT network, creates the disk, attaches a vTPM through swtpm, builds a small ISO carrying autounattend.xml, and waits for SSH.

Two details in there are the whole reason the script exists:

  • the boot prompt. Windows installation media asks "Press any key to boot from CD or DVD" and gives up after a few seconds, leaving UEFI with nothing to boot. up.sh sends keys during that window only — later ones would land in a setup UI the answer file is supposed to own.
  • SATA and e1000e. Both have in-box drivers. virtio would need the virtio-win ISO injected mid-setup, which is the kind of manual step that makes a test machine rot.

Use it#

testbed/windows/run.sh 'Get-Tpm | Select-Object TpmPresent,TpmReady,ManufacturerIdTxt'
GOOS=windows GOARCH=amd64 go build -o /tmp/exordos-nac-agent.exe ./cmd/exordos-nac-agent
testbed/windows/run.sh --copy /tmp/exordos-nac-agent.exe
testbed/windows/run.sh 'C:\Users\nac\exordos-nac-agent.exe selftest --scenario full'

Requires sshpass on the host. Credentials: nac / NacTest!2026 — a throwaway on a private network, written down rather than hidden, because pretending it is a secret would be worse than admitting it is not.

Running as SYSTEM#

The device key is created by whoever runs enroll and used afterwards by the service that proves, so whether a key created by an administrator is usable by a service account is a question about this product rather than about Windows. schtasks is the shortest path to asking it:

testbed/windows/run.sh 'schtasks /create /tn nacagent /tr "C:\Users\nac\exordos-nac-agent.exe status > C:\nac-system.txt 2>&1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f'
testbed/windows/run.sh 'schtasks /run /tn nacagent; Start-Sleep 5; Get-Content C:\nac-system.txt'