BZ-B TOOL KIT v3.1.3 - WINDOWS VM VALIDATION CHECKLIST
=====================================================

TARGET
  Disposable Windows 11 Pro VM, fully patched, with a snapshot/checkpoint taken
  before testing. Use a domain-member VM for domain-specific tests when available.

A. INSTALLATION / PARSER
  [ ] Copy release to C:\Tech Tools\BZ-B Tool Kit
  [ ] Run BZB-ToolKit.bat
  [ ] Menu displays v3.1.3
  [ ] Run [7] Installation Self-Test
  [ ] Self-test has zero FAIL results
  [ ] SHA256 manifest checks pass

B. READ-ONLY FUNCTIONS
  [ ] Health Check completes
  [ ] Inventory completes
  [ ] Smart Diagnose completes and creates Findings.csv + HealthScore.json
  [ ] Advanced Diagnostics completes
  [ ] Network Deep Dive completes
  [ ] RDP Diagnostics completes
  [ ] MSP/RMM/Security Agent Audit creates CSV even with zero matching agents
  [ ] Snapshot capture completes
  [ ] Snapshot compare completes
  [ ] Server Migration Audit completes and records unsupported collectors cleanly

C. SERVICE SESSION
  [ ] Start Service Session succeeds
  [ ] Session.json contains exact PreSnapshotPath and SmartDiagnosePath
  [ ] Run one LOW-risk remediation
  [ ] RemediationHistory.jsonl records the transaction
  [ ] Close Service Session succeeds
  [ ] Session.json contains PostSnapshotPath and ComparisonPath
  [ ] ConnectWise-Ticket-Notes.txt is generated and references performed work

D. LOW-RISK REMEDIATION
  [ ] DNS_CLIENT_REPAIR - test on a normal network; validate DNS afterward
  [ ] TIME_SYNC_REPAIR - validate w32tm status afterward
  [ ] PRINT_SPOOLER_REPAIR - use only disposable queued test jobs
  [ ] TEMP_CLEANUP - seed temp folder with test files first
  [ ] WINDOWS_IMAGE_REPAIR - allow sufficient time; review DISM.txt and SFC.txt

E. MEDIUM-RISK / ROLLBACK TESTS
  [ ] Take a fresh VM checkpoint first
  [ ] RDP_ENABLE records exact registry/firewall state
  [ ] RDP_ENABLE rollback restores original registry/firewall state
  [ ] RDP_DISABLE is blocked while the test is run from an RDP session unless override supplied
  [ ] NETWORK_STACK_RESET returns exit 1 / REBOOT_REQUIRED on successful reset
  [ ] Reboot and validate networking after NETWORK_STACK_RESET
  [ ] WINDOWS_UPDATE_RESET creates transaction-specific preserved store paths
  [ ] WINDOWS_UPDATE_RESET restores original service runtime states
  [ ] WINDOWS_UPDATE_RESET rollback restores the exact preserved transaction stores

F. DOMAIN MEMBER TESTS (OPTIONAL TEST VM)
  [ ] Domain Deep Audit succeeds without requiring dcdiag.exe
  [ ] AD DNS SRV lookup is captured
  [ ] Healthy secure channel is reported as healthy
  [ ] DOMAIN_TRUST_REPAIR is not run on a healthy production endpoint
  [ ] If intentionally testing broken trust, use only a disposable domain-member VM

G. RMM TEST
  [ ] SmartDiagnose -Silent completes and returns expected exit code
  [ ] A LOW-risk remediation with -Silent but without -Force is blocked
  [ ] Same approved test remediation with -Silent -Force runs and logs a transaction
  [ ] Reports/Logs/Backups are retrievable through the RMM session

RELEASE GATE
  Do not mass-deploy remediation through RMM until A-G relevant to your environment
  pass on the disposable VM(s). Record failures before changing the test VM snapshot.
