# ProcessMonitor Phase 2 clean-VM validation

Copy the complete `dist\ProcessMonitor` directory to a disposable Windows VM that has no Python installation and no previously staged ProcessMonitor driver package.

## State A

Open non-elevated PowerShell in the copied directory and run:

```powershell
Set-ExecutionPolicy -Scope Process Bypass
.\validate_clean_vm.ps1 -PackagePath . -InteractiveGui
```

The script refuses State A unless `python`, `py`, the ProcessMonitor service, and matching staged packages are absent. Preserve its evidence directory.

The validation script is shipped from the repository's `packaging` directory; copy it beside the two EXEs for the VM run. It does not install or start the driver.

## State B prerequisites

Proceed only after State A reports `PASS`. Use an elevated PowerShell prompt and the existing complete WDK-produced driver package containing the matching SYS, INF, and CAT. Do not use the standalone SYS alone as an install package.

Record signature and package state:

```powershell
Get-AuthenticodeSignature .\driver\ProcessMonitor.sys | Format-List Status,StatusMessage,SignerCertificate
pnputil.exe /enum-drivers | Select-String "ProcessMonitor|Contoso" -Context 2,6
```

Stage the explicit known-good INF path; never assume an OEM number:

```powershell
pnputil.exe /add-driver "C:\Exact\KnownGoodPackage\ProcessMonitor.inf" /install
sc.exe query ProcessMonitor
sc.exe qc ProcessMonitor
Start-Service ProcessMonitor
```

If staging does not create the Root device/service, stop and use the already-established WDK root-device installation workflow. Do not fabricate an INF or create a duplicate Win32 service.

Start the packaged relay and GUI:

```powershell
.\ProcessMonitorRelay.exe --start
.\ProcessMonitorRelay.exe --status
.\ProcessMonitor.exe
```

Generate a benign process such as Notepad, wait at least one relay polling interval, and confirm real events, enrichment, JSONL, SQLite growth, GUI counters, Process Details, and LOW/0 with no actionable findings.

For a correlation smoke, back up the external JSON configuration, add one narrowly scoped temporary command-line indicator with a unique lab token, run a benign process containing that token long enough for one polling interval, verify its structured finding/evidence, and restore the original configuration immediately.

Cleanup:

```powershell
.\ProcessMonitorRelay.exe --stop
Get-Process ProcessMonitorRelay -ErrorAction SilentlyContinue
sc.exe stop ProcessMonitor
pnputil.exe /enum-drivers | Select-String "ProcessMonitor|Contoso" -Context 2,6
```

Identify the actual published OEM INF from the final command before any `pnputil /delete-driver` operation. Never assume `oem2.inf`.
