Enrich professor profiles and harden client policy

docs/lab-runbook.md

@@ -4,8 +4,8 @@ Validated lab inventory:
 
 - Domain controller/broker: Windows Server 2025 Standard,
   `WIN-1AIQMMA1EPR.lci.lasalle.mx`, `192.168.50.10`.
-- Client: Windows 10 Pro 22H2,
-  `DESKTOP-U1I3BNN.lci.lasalle.mx`, `192.168.50.20`.
+- Client: no active Windows client VM. The next enrollment target is a clean
+  Windows 11 Enterprise VM placed in `OU=Laboratorio`.
 - Domain: `lci.lasalle.mx` / `LCI`.
 - Private switch: `Laboratorio AD`.
 
@@ -133,14 +133,18 @@ Use Lithnet's `Invoke-CredUI` test utility when available, or sign out/restart
 the VM and select **Acceso institucional SGU**. Keep the built-in Windows
 password provider available through **Other user**.
 
-On the domain controller, apply the SGU user policy once:
+On the domain controller, apply the SGU user and computer policies once:
 
 ```powershell
 .\Set-SguDomainUserPolicies.ps1
+.\Set-SguDomainComputerPolicies.ps1
 ```
 
 It links `SGU - User session restrictions` to `OU=Usuarios-SGU` and prevents
-managed users from manually locking the workstation.
+managed users from manually locking the workstation or starting a screen saver.
+It also links `SGU - Windows client experience` to `OU=Laboratorio` to suppress
+first-logon privacy/diagnostic/location screens and keep display, sleep, and
+hibernation disabled.
 
 Before testing through Hyper-V Enhanced Session/RDP, enable the dedicated lab
 group and Windows PowerShell Remoting: