# 19 workstations under control from the owner's phone

What was broken

The owner already had a simple bot: turn the server on or off and check its state. Everything else went through the admin: who is working right now, how to block a login, a new employee, a restart. The owner wanted to do it himself, from his phone, without remote desktop or a console.

Client requirements

• Everything from a phone, clear to someone without a technical background.
• Several people with different rights. The idea: the owner runs administration himself instead of calling the admin.
• Critical actions (power, blocks, new employees) — only with a PIN.
• A block must not destroy anyone’s work: the session is kept and the person continues where they left off.
• Deleting an employee means disabling them. Data stays, access can be restored.

Constraints

• The old bot keeps working until testing ends and is not touched.
• Don’t touch the office accounting software: the bot may only read its state.
• No monitoring of employees’ screens and no screenshots — a firm requirement.
• All work was remote: no physical access to the office.
• Every change is a ready PowerShell script with a backup, a separate rollback script and a syntax check before delivery.

The solution

The bot lives on the host that runs the office virtual machine and controls it from inside. It only connects out — to Telegram and to the tunnel — so no port is open to the outside.

owner-bot.svg

OWNER'S PHONE

Mini Appa panel inside Telegram: overview, staff, access, settings

Bot chatshort alerts and "Allow / Deny" buttons

3 roles

owneradminmanager

HTTPS

CONNECTION

Cloudflare Tunnelthe server dials out itself; the panel gets HTTPS

Telegram Bot APIthe bot polls Telegram itself

Protection

HMAC-SHA256 signaturePIN · PBKDF20 inbound ports

tunnel

HYPER-V HOST

Bot · PowerShell 5.1one process: listens to Telegram and serves the panel; long jobs run in the background

JSON + action logbot data and every action with time and author

Watchdogstarts with the system, checks every 5 min, no second copy

PS Direct

OFFICE

Work serverthe VM: PowerShell Direct with no network, WTS API — who works and for how long

WireGuardkeys are added and disabled on the fly

19 employeesa block keeps the session — no work is lost

The bot only connects out — to Telegram and to the tunnel. No port is open to the outside.

• One PowerShell 5.1 process. It’s already in every Windows Server; nothing to install. It listens to Telegram and serves the panel at the same time. Long jobs run in the background so the bot doesn’t freeze.
• Telegram Mini App. A web page that opens inside Telegram like an app. The chat stays for short alerts and “Allow / Deny” buttons.
• Cloudflare Tunnel. The server dials out itself and the panel gets an HTTPS address. The panel itself listens only on the host’s local address.
• Telegram signature check (HMAC-SHA256). Every request from the panel carries a cryptographic seal from Telegram. It can’t be forged without the bot token, so a foreign request won’t pass.
• PIN hashed with PBKDF2. A hash is a “fingerprint” of the PIN that can’t be turned back into the PIN. PBKDF2 is deliberately slow, so brute force makes no sense. After 5 mistakes — a block.
• PowerShell Direct. A channel between the Hyper-V host and its VM that doesn’t go over the network at all. The bot signs in with a service account that is barred from normal logins. Its password is encrypted with DPAPI — Windows’ built-in encryption tied to the machine.
• WTS API. A built-in Windows interface that tells who is connected to the server and for how long. Employee statuses come from it.
• WireGuard. The VPN employees connect through. The bot adds and disables keys on the fly without dropping other connections.
• Data in JSON files plus an action log. A database for a dozen bot users is one more thing to maintain.
• Watchdog. A scheduled task starts the bot with the system and checks it every 5 minutes. A second copy won’t start.

Development story

The bot grew from a stub to version 1.11 over 20 updates. Each touched only the new bot’s files and had its own rollback script.

Smaller bugs found along the way

• In PowerShell, returning a list from a function with return , $list broke filtering further down the pipeline — invitations and the notification counter were miscounted. Now the result goes into a variable first.
• Two panel styles had the same name and broke the timer’s look. Renamed.
• Telegram’s forwarding ban would have blocked handing the archive to a new employee. Removed it; protection comes from the 15-minute lifetime.
• To test the interface I built a local bench: the real bot code runs against a mock of Telegram and the server. Panel layout was checked there before each delivery.

Lessons

• Deploy the new next to the old, not instead of it. A separate test bot allowed testing on the live server, and the owner never spent a day without control.
• Small updates with a rollback are cheaper than one big one. The add-employee and staff-list timeout bugs were fixed in the very next update because it was clear exactly what broke.
• PowerShell variable names are case-insensitive. You can’t see that bug by eye, so an automatic check now catches it.
• Ask the system once, not in a loop. The difference was a 12-second timeout versus 75 ms.
• Secrets don’t go to the chat. The chat keeps everything forever; the panel shows a password for 15 minutes and forgets it.
• Platform limits shape the interface. A bot can’t message first, so one-time invitations replaced the contact book.
• One message that updates beats five new ones. The owner sees the restart state in one place and the chat stays clean.
• A local bench is faster than the live server. Layout and scenarios show up in seconds; the live server is for the final check.

Result

Version 1.11 runs on the live server and the bot has been handed over to the owner. Tested live:

• adding, disabling and restoring an employee;
• a new password and a broadcast to screens;
• a restart with a countdown and the server status;
• notifications and downloading a new employee’s archive.

The bot comes with a step-by-step guide for the owner.