ProjectAchilles v2.6.1

Fixed

• SentinelOne Endpoint Protection score stuck at 0% on laptop fleets (#597). Two of its checks failed every agent for reasons that aren't protection gaps. Reporting used SentinelOne's live online flag, so a snapshot taken while laptops were closed failed all of them, although an offline agent keeps protecting its endpoint. It is now Checked in (7 days): online, or last checked in within 7 days. Firewall control failed every agent on consoles without SentinelOne Firewall Control (a separate license); when no agent has it on, the check is now skipped as not deployed. Agent snapshots now also keep each agent's last check-in time.

Documentation

• Server Installer: trusting the on-prem root CA (#596). The trust section and the GPO steps now say plainly that without the root in LocalMachine\Root agents can't enroll (x509: certificate signed by unknown authority), what the GPO changes in the domain (one certificate, nothing else), and how to roll it out: a dedicated GPO under Computer Configuration, piloted on one OU, with how to undo it and which ASR, PowerShell, AppLocker/WDAC and firewall policies still apply. Adds a troubleshooting row for the enrollment x509 error.