SentryBay Armoured Client on Windows 11: A Technical Case Study in Zero-Trust Endpoint Hardening for Remote Workforces

Oct 1

4 min read

As remote and hybrid work becomes the operational norm, organisations including Global E-Director, serving key enterprise and government sectors in the MENA region face a persistent challenge: how do you enforce consistent security controls when employees connect from devices you do not own, manage, or fully trust?

This case study examines how the SentryBay Armoured Client addresses that challenge through Zero Trust endpoint hardening on Windows 11, with a specific focus on protecting Virtual Desktop Infrastructure (VDI) sessions from unmanaged endpoints.

The Problem: Unmanaged Endpoints as the Weakest Link

Traditional perimeter-based security assumes the device connecting to your environment is known and controlled. Remote workforces shatter that assumption. When employees, contractors, or third-party users connect via personal or BYOD Windows 11 machines, the attack surface expands dramatically.

Keyloggers and screen-capture malware can operate silently on unmanaged devices
Credential theft at the endpoint bypasses even the most hardened server-side controls
VDI sessions, while logically isolated in the data centre, remain visually and behaviourally exposed on the local device
Conventional endpoint detection tools cannot be deployed on devices outside corporate management scope

The question becomes: how do you apply Zero Trust endpoint hardening to a device you cannot manage through standard means?

What Is the SentryBay Armoured Client?

The SentryBay Armoured Client is a lightweight security layer that installs on the local Windows 11 device without requiring full enterprise management of that device. Rather than attempting to remediate the entire endpoint, it creates a protected environment specifically around the application session, typically a VDI, cloud desktop, or web application that the user is accessing.

Its architecture is grounded in a principle central to Zero Trust: assume breach, then contain the blast radius. Instead of trusting the host operating system, the Armoured Client operates at a level that actively counters threats resident on that OS.

Zero Trust User Interface Isolation on Windows 11

Zero Trust user interface isolation on Windows 11 is a foundational capability of the Armoured Client. For Global E-Director, serving enterprises across the MENA region, the protected session window is isolated from other processes running on the local machine, preventing unauthorized applications from interacting with, reading or injecting into that session.

Anti-keylogging: Input events within the protected session are handled in a way that bypasses the standard Windows input chain, rendering conventional keyloggers unable to capture keystrokes
Anti-screen capture: The session rendering is protected against screen-scraping tools and screenshot APIs, including those operating with elevated privileges
Process isolation: Malicious or unauthorised processes running elsewhere on the device cannot read the memory or UI state of the protected session window

How to Secure Unmanaged Windows 11 Endpoints for VDI

Understanding how to secure unmanaged Windows 11 endpoints for VDI requires recognising that the data never actually leaves the data centre in a VDI model but the session itself is visible and interactive on the local screen. The Armoured Client addresses this residual risk without requiring device enrolment or MDM deployment.

The client can be delivered via a web portal or packaged installer with no dependency on corporate device management
On launch, it establishes the protected session context before the VDI connection is initiated
Throughout the session, active threat monitoring counters attempts to circumvent the isolation layer
On session termination, no persistent sensitive data remains on the local device

Technical Architecture: A Layered View

Layer	Threat Addressed	Armoured Client Control
Input	Keylogging, credential theft	Anti-keylogging input handling
Display	Screen capture, visual eavesdropping	Render protection against capture APIs
Process	Memory scraping, injection attacks	UI isolation and process boundary enforcement
Session	Session hijacking, data residue	Secure session teardown, no local data persistence

Why Windows 11 Introduces Both Opportunity and Complexity

Windows 11 brings security improvements at the OS level hardware-based isolation, secure boot enhancements, and tighter application controls. However, these gains primarily benefit managed, corporate-enrolled devices.

Unmanaged Windows 11 endpoints may lack Secure Boot enforcement, TPM configuration or updated driver stacks, meaning the OS-level improvements do not automatically translate into a secure environment for VDI sessions.

Threat actors have adapted to Windows 11 environments with updated tooling
Kernel-level malware and driver exploits remain viable on unmanaged machines
The SentryBay Armoured Client operates independently of whether the underlying OS configuration meets corporate baseline requirements

Deployment Considerations for Security Teams

For security leadership such as teams at Global E-Director, serving enterprises and government organizations in the MENA region evaluating Zero Trust endpoint hardening strategies for remote workforces, the following practical points apply when considering the Armoured Client approach:

No MDM dependency: Deployment does not require the device to be enrolled in Microsoft Intune or any other mobile device management platform
Compatibility: The client is designed to operate alongside existing VDI platforms and remote access gateways without architectural changes
Audit and compliance: Session activity within the protected environment can support compliance requirements without exposing personal data from the unmanaged device
User friction: The installation and launch process is designed to be straightforward for non-technical end users, reducing support overhead

Aligning with Zero Trust Principles

The Zero Trust model holds that no device, user or network segment should be implicitly trusted. Applied to endpoints, this means security controls must function even when the host device is considered hostile. The SentryBay Armoured Client operationalises this by:

Treating the local OS as an untrusted environment by default
Applying controls at the session and UI layer rather than relying on host integrity
Enforcing Zero Trust user interface isolation on Windows 11 regardless of the device's security posture
Providing a consistent security baseline across a heterogeneous device population

Conclusion

Securing remote workforces on unmanaged devices is not a problem that can be solved by extending corporate management controls further out toward the edge. The device population is too varied and too large. A more practical approach is to protect the session itself and that is the architectural premise behind the SentryBay Armoured Client.

For organisations like Global E-Director, serving enterprises and public sector institutions across the MENA region, looking to advance their Zero Trust endpoint hardening posture without requiring full device management, understanding how to secure unmanaged Windows 11 endpoints for VDI through session-layer controls represents a technically sound and operationally realistic path forward.

To explore how this approach applies to your specific environment and workforce model, contact us to arrange a technical discussion.