Enrich professor profiles and harden client policy

docs/architecture.md

@@ -28,9 +28,11 @@ administrative incident overview for `AD`, the student information page for
 `AL`, or the portal menu for `DO`. After the incident page confirms an `AD`
 employee number, two additional GETs in the same in-memory session read the
 structured name from `datos/personales.aspx` and the address from
-`datos/ubicacion.aspx`. A supplemental failure preserves fields already
-collected, and a profile timeout does not invalidate an already authenticated
-credential. NTLM may still require its normal
+`datos/ubicacion.aspx`. Docentes keep the menu name as a base and attempt those
+same two shared staff modules without requiring them to exist. A supplemental
+404, changed/missing element ID, other failure, or timeout preserves fields
+already collected, and a profile timeout does not invalidate an already
+authenticated credential. NTLM may still require its normal
 challenge/response round trips on the connection. Transient portal cookies are
 kept only in an in-memory per-request container and are never persisted or
 returned to the client.
@@ -60,9 +62,12 @@ updates the applicable `displayName`, `givenName`, `sn`, `mail`, `title`,
 `postalCode` attributes. Administrative and student numbers must match the six
 numeric digits of the requested identity before any role-specific metadata is
 trusted. Administrative personal and location pages are accepted only after
-that incident-page match. Student faculty/department is deliberately left unset because the
-verified page does not expose it. Missing metadata does not clear existing AD
-values and never changes the password outcome.
+that incident-page match. A docente's supplemental fields remain tied to the
+fresh NTLM-authenticated portal session and are optional; the menu display name
+remains usable if neither shared page is available. Student faculty/department
+is deliberately left unset because the verified page does not expose it.
+Missing metadata does not clear existing AD values and never changes the
+password outcome.
 
 Human-readable SGU values are decoded with BOM/header/meta detection, strict
 UTF-8 validation, and a Windows-1252 fallback for the legacy portal. Names and
@@ -91,7 +96,11 @@ synthetic Windows account to imitate that title or ordering.
 The managed hierarchy is rooted at `OU=Usuarios-SGU`: `Docentes`, `Alumnos`,
 and `Administrativos` are direct child OUs beneath it. The domain GPO
 `SGU - User session restrictions` is linked to this root and enables the
-per-user `DisableLockWorkstation` policy for the complete hierarchy.
+per-user `DisableLockWorkstation` policy and disables screen savers for the
+complete hierarchy. The computer GPO `SGU - Windows client experience` is linked
+to `OU=Laboratorio`; it suppresses first-logon/privacy/diagnostic prompts,
+disables location, and enforces always-on display, sleep, and hibernation
+settings for managed clients.
 
 Per-user synchronization is serialized inside the broker to prevent concurrent
 create/reset races. Production deployments should run the broker as a gMSA with

docs/broker-operations.md

@@ -50,8 +50,9 @@ Eso es comportamiento esperado, no una caída del servicio.
 - El broker permite hasta **20 segundos** para el desafío NTLM ligero de
   `/psulsa/`. El enriquecimiento usa el límite total independiente
   `ProfileTimeoutSeconds` —**90 segundos** en la configuración del laboratorio—
-  y conserva los campos que alcance a obtener si una página administrativa se
-  retrasa o falla. El Credential Provider mantiene su propio límite de **90
+  y conserva los campos que alcance a obtener si una página de personal se
+  retrasa, no existe o cambia sus IDs. Esto incluye los módulos opcionales de
+  nombre y ubicación para docentes. El Credential Provider mantiene su propio límite de **90
   segundos**: si SGU excede ese presupuesto, Windows continúa por el fallback
   normal de AD o credenciales de dominio en caché.
 - El instalador configura recuperación del servicio con reinicios a los 5, 15

docs/client-enrollment.md

@@ -82,17 +82,29 @@ siguiente arranque síncrono y el fondo se aplica al siguiente inicio de sesión
 del usuario SGU.
 
 En el controlador de dominio, aplicar una vez la directiva de usuario al árbol
-completo `Usuarios-SGU`:
+completo `Usuarios-SGU` y la directiva de equipo a `Laboratorio`:
 
 ```powershell
 .\Set-SguDomainUserPolicies.ps1
+.\Set-SguDomainComputerPolicies.ps1
 ```
 
 El script crea y vincula de forma idempotente el GPO
 `SGU - User session restrictions` y configura `DisableLockWorkstation=1` para
-Administrativos, Alumnos y Docentes. La directiva elimina la acción manual de
-bloqueo; no sustituye otras directivas independientes de protector de pantalla,
-inactividad o desconexión de RDP.
+Administrativos, Alumnos y Docentes; también deshabilita el protector de
+pantalla. El segundo crea `SGU - Windows client experience` y, antes del primer
+inicio de sesión de dominio, suprime la experiencia de privacidad, las
+notificaciones y controles de telemetría, la animación **Hi / Preparing
+Windows**, y el acceso a ubicación. Además fija en **Nunca** el apagado de
+pantalla, suspensión, hibernación y suspensión híbrida, conectado a corriente o
+batería. El guard de enrolamiento vuelve a aplicar `powercfg /hibernate off` y
+los tiempos en cero al inicio y diariamente.
+
+`HideEULAPage` no forma parte de esta GPO: es una opción de archivo Unattend para
+la fase OOBE y Microsoft la reserva para pruebas de OEM/System Builder. La GPO
+usa las alternativas soportadas `DisablePrivacyExperience=1` y
+`EnableFirstLogonAnimation=0`, que son las que afectan a cada cuenta de dominio
+nueva.
 
 ## 3. Verificación y reparación
 
@@ -134,5 +146,10 @@ Referencias de Microsoft:
 - <https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-credentialproviders#defaultcredentialprovider>
 - <https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowslogon#enumeratelocalusersondomainjoinedcomputers>
 - <https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-ctrlaltdel#disablelockcomputer>
+- <https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#disableprivacyexperience>
+- <https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowslogon#enablefirstlogonanimation>
+- <https://learn.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#182-location>
+- <https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/powercfg-command-line-options>
+- <https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/automate-oobe>
 - <https://learn.microsoft.com/en-us/windows/win32/api/credentialprovider/ne-credentialprovider-credential_provider_field_type>
 - <https://learn.microsoft.com/en-us/windows/win32/api/credentialprovider/nf-credentialprovider-icredentialprovidercredential2-getusersid>

docs/lab-runbook.md

@@ -4,8 +4,8 @@ Validated lab inventory:
 
 - Domain controller/broker: Windows Server 2025 Standard,
   `WIN-1AIQMMA1EPR.lci.lasalle.mx`, `192.168.50.10`.
-- Client: Windows 10 Pro 22H2,
-  `DESKTOP-U1I3BNN.lci.lasalle.mx`, `192.168.50.20`.
+- Client: no active Windows client VM. The next enrollment target is a clean
+  Windows 11 Enterprise VM placed in `OU=Laboratorio`.
 - Domain: `lci.lasalle.mx` / `LCI`.
 - Private switch: `Laboratorio AD`.
 
@@ -133,14 +133,18 @@ Use Lithnet's `Invoke-CredUI` test utility when available, or sign out/restart
 the VM and select **Acceso institucional SGU**. Keep the built-in Windows
 password provider available through **Other user**.
 
-On the domain controller, apply the SGU user policy once:
+On the domain controller, apply the SGU user and computer policies once:
 
 ```powershell
 .\Set-SguDomainUserPolicies.ps1
+.\Set-SguDomainComputerPolicies.ps1
 ```
 
 It links `SGU - User session restrictions` to `OU=Usuarios-SGU` and prevents
-managed users from manually locking the workstation.
+managed users from manually locking the workstation or starting a screen saver.
+It also links `SGU - Windows client experience` to `OU=Laboratorio` to suppress
+first-logon privacy/diagnostic/location screens and keep display, sleep, and
+hibernation disabled.
 
 Before testing through Hyper-V Enhanced Session/RDP, enable the dedicated lab
 group and Windows PowerShell Remoting:

docs/security.md

@@ -43,12 +43,16 @@
   city/municipality, state, and postal code from known element IDs.
 - Student CURP, birth date, sex, blood type, marital status, telephone, mobile,
   guardian, medical, financial, and academic-history values are ignored.
+- Professor enrichment keeps the menu display name as its base and optionally
+  reads only the same name and postal-address element IDs used by staff pages.
+  A missing professor route or element never makes authentication fail.
 - Incident details, calendars, photographs, manager names, and manager positions
   are deliberately ignored.
 - The employee or student number must match the authenticated `AD` or `AL` key
   before role-specific metadata is synchronized. The two supplemental
   administrative pages are never requested unless the incident page supplied
-  the matching employee number.
+  the matching employee number. Professor supplemental data comes from the
+  same fresh, request-scoped NTLM session as its menu fallback.
 - If SGU changes its HTML, authentication and exact-password synchronization
   continue without enrichment; existing AD metadata is not erased.
 - Slow profile pages cannot change an accepted credential into a rejection. The

docs/windows-client-onboarding.md

@@ -63,6 +63,8 @@ powershell.exe -NoProfile -ExecutionPolicy Bypass `
 
 El script realiza de forma idempotente lo siguiente:
 
+- fija pantalla, suspensión e hibernación en **Nunca** para corriente y batería,
+  y ejecuta `powercfg /hibernate off`;
 - habilita RDP y conserva Network Level Authentication;
 - habilita las reglas RDP solo para el perfil Domain;
 - autoriza el grupo SGU dedicado;
@@ -121,6 +123,12 @@ contraseña incorrecta. Comprobar que la cuenta pertenece a
 `SG-Laboratorio-Usuarios-RDP` y que ese grupo aparece en **Remote Desktop Users**.
 Las directivas de grupo de dominio prevalecen sobre la política local.
 
+En el controlador de dominio, `Set-SguDomainComputerPolicies.ps1` crea y vincula
+la GPO `SGU - Windows client experience` a `OU=Laboratorio`. Esa GPO refuerza la
+configuración siempre activa y evita las experiencias iniciales de privacidad,
+telemetría, ubicación y **Hi / Preparing Windows** antes de que un usuario SGU
+entre por primera vez.
+
 Microsoft documenta este derecho en:
 <https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-userrights#allowlogonthroughremotedesktop>
 y PowerShell Remoting en: