Two-tier control gap across the Windows fleet
670 cloud-managed devices have no managed local-admin rotation and no attack-surface-reduction coverage, while the 1,180 co-managed devices have both. The split follows management history, not device role.
Decision recorded · ADR-001