# Windows-Builder Network And RDP Stability

## Purpose

Windows-Builder uses GPU passthrough for Unreal Editor and packaged build validation. GPU passthrough can make RDP and display behavior confusing because RDP, Sunshine, the virtual display driver, and the NVIDIA GPU are separate access paths.

This runbook records the stable baseline for normal administration and recovery.

## Stable Network Baseline

- VM: `Windows-Builder`
- LAN IP: `192.168.5.12`
- VM bridge: `br0`
- NIC model: `virtio-net`
- MAC address: `52:54:00:17:ec:5d`
- Windows adapter: `Red Hat VirtIO Ethernet Adapter`
- Windows adapter alias: `Ethernet`
- Windows network profile: `Private`
- DNS observed during stabilization: `192.168.4.1`

The fixed MAC address is important. Keep the VM NIC on the same bridge/MAC so router DHCP reservations, firewall rules, SMB mappings, RDP bookmarks, and Sunshine/Moonlight pairing continue to resolve to the same machine.

## Stable RDP Baseline

- RDP registry switch: enabled through `fDenyTSConnections = 0`
- Service: `TermService`
- Startup type: `Automatic`
- Listener: TCP `3389`
- Windows Firewall group: `Remote Desktop`
- Required firewall rules:
  - `Remote Desktop - User Mode (TCP-In)`
  - `Remote Desktop - User Mode (UDP-In)`
  - `Remote Desktop - Shadow (TCP-In)`

Use RDP for administration, installs, and recovery. Use Sunshine/Moonlight for real-GPU visual inspection of Unreal because RDP can change the active display path seen by graphics applications.

## Power Baseline

The VM should not sleep while it is acting as the build host.

- Hibernate: off
- AC sleep timeout: disabled
- DC sleep timeout: disabled
- AC monitor timeout: disabled
- DC monitor timeout: disabled

This avoids the Windows kernel power standby events that can leave the VirtIO NIC disconnected until a manual wake or reconnect.

## Verification Commands

From Ubuntu-Codex:

```bash
nc -vz -w 5 192.168.5.12 3389
sshpass -p '<unraid-root-password>' ssh root@192.168.5.8 'virsh domiflist Windows-Builder'
```

From Windows-Builder PowerShell:

```powershell
Get-NetAdapter
Get-NetConnectionProfile
Get-Service TermService
Get-NetFirewallRule -DisplayGroup "Remote Desktop"
powercfg /a
```

Expected results:

- `nc` reports that TCP `3389` succeeds.
- `virsh domiflist` shows `bridge br0`, `virtio-net`, and MAC `52:54:00:17:ec:5d`.
- `TermService` is running and automatic.
- Remote Desktop firewall rules are enabled.
- Hibernate is unavailable because it is disabled.

## Recovery Flow

1. Use the QEMU guest-agent path first if RDP fails.
2. Confirm the VM still has IP `192.168.5.12`.
3. Confirm the VM XML still has the fixed VirtIO NIC on `br0`.
4. Confirm Windows still sees the network as `Private`.
5. Restart `TermService` only if the service is not listening on TCP `3389`.
6. If Unreal visual inspection is needed, use Sunshine/Moonlight instead of RDP.

