Windows enumeration

When rpcclient connects but user enumeration fails, record the exact call, identity and status. Use the operation coverage table to distinguish narrow successful queries from denied actions and retain the authorization boundary.