# MDE Toolkit — Administrative Templates (ADMX/ADML)

Group Policy definitions for MDE Toolkit. Every setting writes to
`HKLM\SOFTWARE\Policies\MDE-Toolkit`.

## Contents

```
MDE-Toolkit.admx
en-US\MDE-Toolkit.adml
```

## Install — Central Store (recommended, domain-joined)

```
\\<your-domain>\SYSVOL\<your-domain>\Policies\PolicyDefinitions\MDE-Toolkit.admx
\\<your-domain>\SYSVOL\<your-domain>\Policies\PolicyDefinitions\en-US\MDE-Toolkit.adml
```

If the `PolicyDefinitions` folder does not exist, create it and copy the contents of
`C:\Windows\PolicyDefinitions` from a current Windows machine into it first.

## Install — single machine

```
C:\Windows\PolicyDefinitions\MDE-Toolkit.admx
C:\Windows\PolicyDefinitions\en-US\MDE-Toolkit.adml
```

## Where the settings appear

Group Policy Management Editor →
**Computer Configuration → Policies → Administrative Templates → MDE Toolkit**

| Folder | Covers |
|---|---|
| Background Collector | Enable collection, interval, cache folder, retention |
| Telemetry Upload | Function App endpoint, blob storage, timeouts, retries |
| Identity and Authentication | Tenant, auth method, cloud environment, authority override |
| Data Collection Scope | Which telemetry categories are gathered |
| Device Tagging | DeviceTag, OrgUnit, Environment |
| Application Lockdown | Export block, local-only mode, read-only mode, preview features |
| ASR Exclusion Guardrails | Permanent/temporary exclusions, max duration, duration menu |
| Logging and Diagnostics | Log level, log path, rotation size |
| Page Visibility | Show/hide each page, per elevation level |

## Notes

- Every setting is optional. **Not Configured** means the application uses its built-in
  default, so you only need to configure what you actually want to change.
- All settings are **Computer Configuration** only. There are no user-scope settings.
- The MSI seeds each value at its built-in default so it is visible in `regedit`.
  Existing values are never overwritten, so Group Policy settings survive upgrades.
- Version compatibility is declared per setting via *Supported on*. Settings introduced in
  3.3.1 or 3.3.2 are marked accordingly.

## Verify a deployment

```powershell
gpupdate /target:computer /force
Get-ItemProperty "HKLM:\SOFTWARE\Policies\MDE-Toolkit" | Format-List
```

Full documentation: https://github.com/chlaplan/MDE-Monitoring-App