Endpoint Change Management Lab

A browser-based training lab where you act as change manager for a fictional freight forwarder. Over three endpoint changes you classify the change, assess risk, choose approvers, plan testing, rollback, the window, communications and verification, and then see a seeded outcome of what happened. It trains judgement about process weight, not product configuration.

Because EDR policy, encryption and privilege settings change what every user can do on their laptop. A prevention policy that is too aggressive can stop payroll or a warehouse scanner, so it needs staged testing, a rollback and a clear owner just like any other production change.

In ITIL change enablement terms, a standard change is pre-authorised, low risk and follows a documented procedure. A monthly browser update by ring with a compatibility checklist, a version pin and a clean history fits. Sending it to the full board is over-governing. The calendar still applies: a standard change does not override a freeze.

An emergency is for active or imminent harm that cannot wait for the normal path. The harm from the lost laptop is handled by the incident process: revoke its sessions and wipe it. Enforcing encryption and removing admin across the fleet does not stop that harm tonight, and rushing it can lose data or lock out engineers. The requester's urgency is not an emergency.

A kept previous policy version per ring that you can flip back to from the console, an exception list with owners and expiry, and a rehearsal that tells you how long propagation takes. Uninstalling the agent is not a rollback: it removes protection from the devices in trouble.

Each change hides a few risks, such as an unsigned in-house tool, a laptop that never checks in, or a missing recovery key. The seed fixes the dice. Choosing tests, approvals, windows and rollbacks that address a risk makes it much less likely to fire, and a good rollback or verification limits the damage if it does. The same seed, level and plan give the same outcome.

Rookie shows a hint at each step and a "watch for" list of hidden dependencies and has the lowest chance that an unmitigated risk fires. Pro hides the hints, but a good test plan reveals a hidden dependency as you choose it. Elite hides everything until the outcome and raises the chance that an unmitigated risk fires.

A Markdown change record per change, with type, risk, approvers, window, test, rollback, communications, verification, the simulated outcome and the process findings, and a CSV register of all three. Downloading and copying documents is Pro. You can read the same records on the debrief page.

The terms follow ITIL change enablement. The controls echo NIST SP 800-53 configuration management (CM-3 configuration change control, CM-4 impact analyses, CM-5 access restrictions for change), ISO/IEC 27001 Annex A 8.32 change management, and CIS Controls. The lab is a training exercise, not a compliance checklist.

No. Marlow & Finch Logistics, its people, tools and the marlowfinch.example domain are invented, and every outcome is simulated in your browser. Nothing here connects to a real EDR console or device fleet.