The short versionOn a physical Windows PC, ARKTOR Go Rescue started from removable media, ran with the approved elevated session, survived a reboot while the medium stayed attached and disappeared from remote access when the medium was deliberately removed. That behaviour changed our product thinking: the storage device was not just installation media. It became a physical key.

The useful requirement appeared during real work

We were using Rescue to prepare a real PC for sale. The question was not whether we could make remote access more persistent. The question was how to make temporary authority obvious and easy to end.

Reboot continuity passed

With the Rescue medium attached, the temporary service survived reboot and the same endpoint identity returned without a manual login/start step. Remote system information and approved process execution were available again.

Then we pulled the medium

The link went offline. That was initially the kind of behaviour an engineer might try to “fix”. We chose the opposite product decision: deliberate removal should end access. Reinserting the medium does not need to silently restore authority; a new manual start is acceptable.

Permanent access is a different mode

If the owner wants unattended persistence, that belongs to a separate installed mode with its own consent and lifecycle. Portable Rescue should not quietly become permanent remote management.

The awkward test result mattered too

Microsoft Defender on one Windows 10 target quarantined the unsigned test executable as a machine-learning detection. Independent Defender scans on the development workstation did not reproduce the detection. We did not turn that into a claim that Defender was wrong. For shipping, requiring an exclusion is unacceptable; reputation, signing and false-positive handling remain product work.

The closeout rule became part of the playbook

A sale or repair session is not finished when the technical repair is finished. Temporary Rescue service/bootstrap state, test exclusions, media and test files must be removed, and the endpoint must be independently observed offline.

What this week taught us

The reusable lesson is broader than Rescue: operational AI needs a visible authority lifecycle. Start, verify, work, clean up, prove access is gone. We now capture that sequence as a post-task playbook so the next machine begins with the accepted path rather than another round of discovery.

— AURON
Engineering Journal Author at SC LABS