A reliable experiment starts with a reliable environment

The endpoint-triage idea is to use AI to help organize Windows evidence while leaving response decisions with a person. Before evaluating that idea, Casey needed a reproducible home-lab environment whose actual configuration could be inspected.

This case study centers on the verified lab work: Hyper-V provisioning, PowerShell troubleshooting, and configuration checks. Windows event logs, Defender, and Sysmon were intended evidence sources for later triage work. Their operational use by a completed agent is not established here.

Configure, troubleshoot, then verify

Casey worked through the VM setup and inspected the resulting PowerShell output. That evidence confirms a Generation 2 Hyper-V VM with four virtual CPUs, dynamic memory, Secure Boot, a virtual TPM, installation media, and checkpoint configuration.

The demonstrated contribution is environment engineering and verification. AI-assisted setup guidance can help propose commands, but the meaningful evidence is the state those commands actually produce. Casey inspected that state as part of working through the setup.

A foundation for controlled evaluation

Hyper-V provides the virtual machine; PowerShell provides a repeatable way to configure and inspect it. Secure Boot and vTPM settings establish parts of the guest’s security configuration, while CPU, memory, installation media, and checkpoint settings define the environment being prepared.

Provisioning, guest readiness, and application behavior are separate layers. Inspecting the VM’s settings establishes a foundation for the experiment; evaluating telemetry collection and model behavior belongs to the later agent work.

Inspect the result, not just the command

One setup problem came from malformed storage-path construction. Casey resolved the path construction and inspected the resulting configuration instead of assuming that the intended command represented the final state. This is a practical example of turning a provisioning error into a verification step.

Guest startup also required investigation after the optical-media boot prompt was missed and the VM attempted network boot. Separating that boot behavior from the VM’s configured media helped narrow the problem to the installation sequence rather than treating every startup failure as a broken virtual machine.

Keep the evidence boundary visible

The work exercises secure lab configuration, reproducibility, and hypothesis-driven troubleshooting. Configuration output supports claims about the VM. Keeping that evidence separate from assumptions about the guest or a future agent is part of the security practice.

The intended triage direction retains human approval for remediation. That is a design boundary for future evaluation, not a claim that operational approval controls or an adversarial test suite have already been implemented.

Provisioned environment, bounded claims

The supported outcome is the provisioned Hyper-V VM, inspected configuration, storage-path repair, and boot troubleshooting. The record does not establish deployed Sysmon collection, operational Defender automation, incident detection, triage accuracy, or autonomous remediation.

Make verification part of setup

Repairing the path and checking the resulting VM configuration demonstrates PowerShell troubleshooting and virtualization skills. Investigating the boot sequence demonstrates the value of separating an observation from an initial explanation.

The broader lesson is methodological: establish the environment before evaluating the agent. A reproducible foundation and an honest account of what was verified are prerequisites for meaningful AI-security testing.