Test the Restart

A cleanup can look finished until the computer restarts. Test that the unwanted program stays stopped and the approved programs return.

Suppose the practice helper has already been stopped, quarantined and removed from startup. Restart its computer:

seclab host practice-laptop restart

You should see:

practice-laptop: restart.

Check the helper:

seclab inspect processes demo-helper

Look for these lines:

demo-helper:
  Running: no

It stays stopped. To watch another interval without making a new change, use wait:

seclab wait

You should see:

Watching the next interval.

Then read the connection records:

seclab inspect connections demo-upload

Look for these lines:

demo-upload:
  Allowed: no
  Reason: process_stopped

The route is blocked because the source process is stopped. A restart is useful evidence that cleanup lasted, but also check that the computer’s approved work still runs.