Deployment - Enterprise Setup

1. Registry Configuration

All settings are read from a single registry key. Deploy via GPO Preferences, Intune OMA-URI, SCCM, or any registry tool.

Registry Path

HKLM\SOFTWARE\Policies\MDE-Toolkit

1.1 Background Collector

Value Name	Type	Default	Description
`EnableBackgroundCollector`	DWORD	0	1 = enable, 0 = off
`CollectionIntervalMinutes`	DWORD	480	Minutes between collections (min 5)
`CacheFolder`	SZ	%ProgramData%\MDE-Toolkit\cache	Local cache folder
`MaxCacheFiles`	DWORD	48	Rolling file count
`CacheRetentionDays`	DWORD	30	Delete older than N days (0 = no limit)

1.2 Upload: Function App

Value Name	Type	Default	Description
`EnableUpload`	DWORD	0	1 = enable upload
`FunctionAppUrl`	SZ		e.g. `https://func-mde-toolkit.azurewebsites.net/api/HealthReportIngestion`
`FunctionAppAudience`	SZ		e.g. `api://mde-toolkit-func`
`UploadIntervalMinutes`	DWORD	480	Upload frequency (min 5)
`UploadTimeoutSeconds`	DWORD	30	HTTP POST timeout (5–300)
`UploadRetryCount`	DWORD	2	Retries on failure (0–10)

1.3 Upload: Direct Blob Storage (Alternative)

Value Name	Type	Default	Description
`EnableBlobUpload`	DWORD	0	1 = enable blob upload
`BlobStorageAccountName`	SZ		Storage account name
`BlobContainerName`	SZ	mde-telemetry	Container name
`BlobEndpointSuffix`	SZ		e.g. `blob.core.usgovcloudapi.net`

1.4 Identity / Authentication

Value Name	Type	Default	Description
`TenantId`	SZ	(auto)	Auto-detected from PRT if blank
`PreferredAuthMethod`	SZ	Default	`Default` \| `WAM` \| `DeviceCode` \| `ManagedIdentity`
`AzureEnvironment`	SZ	Public	`Public` \| `USGov` \| `China` \| `Germany`
`AuthorityHostOverride`	SZ	(auto)	Custom Entra authority URI for sovereign / air-gapped clouds (e.g. `https://login.microsoftonline.us/`)

1.5 Data Scope

Control which telemetry categories are collected. All DWORD, 1 = on, 0 = off.

Value Name	Default	Description
`CollectDefenderStatus`	1	RTP, Tamper, Signatures, engine + platform versions, scan times
`CollectDefenderPolicies`	1	ASR, NP, CFA, Device Control
`CollectFirewallStatus`	1	Domain/Private/Public profiles
`CollectFirewallRules`	0	Individual rules (can be large)
`CollectWfpFilters`	0	Windows Filtering Platform filters (very large)
`CollectDeviceControl`	1	Device Control policies
`CollectAppControl`	1	WDAC status + `.cip` policy count
`CollectDeviceGuard`	1	VBS, HVCI, Credential Guard
`CollectIntuneEnrollment`	1	Intune / ConfigMgr info
`CollectNetworkInfo`	0	Network adapters / routes / DNS
`CollectSecurityScore`	0	Computed security score

1.6 Tagging / Organization

These values are written to the JSON snapshot and promoted to their own columns (DeviceTag, OrgUnit, Environment) in the Azure Table so Power BI can slice on them.

Value Name	Type	Description
`DeviceTag`	SZ	Freeform label — e.g. `Finance`
`OrgUnit`	SZ	e.g. `US-East`
`Environment`	SZ	`Production` \| `Staging` \| `Dev`

1.7 UI / Feature Flags

Control the interactive WPF application (not the background collector). All DWORD, default 0.

Value Name	Description
`DisableAiFeatures`	Hide AI analysis panels
`DisableExportButtons`	Hide PDF/JSON export
`DisableAdvancedNetworking`	Hide the Advanced Networking window
`DisableRemoteTarget`	Prevent targeting remote machines
`ForceReadOnlyMode`	Disable all write operations (remediation, policy push)

1.8 Logging

Local service log written by the background collector and upload loops.

Value Name	Type	Default	Description
`LogLevel`	SZ	Info	`None` \| `Error` \| `Warning` \| `Info` \| `Verbose`
`LogFilePath`	SZ	(CacheFolder)\service.log	Custom log path
`MaxLogSizeMb`	DWORD	10	Rotate at this size (1–500 MB)

1.9 Example: GPO / Intune Deployment

PowerShell — Set registry for enterprise collection + upload

$regPath = "HKLM:\SOFTWARE\Policies\MDE-Toolkit"
New-Item -Path $regPath -Force | Out-Null

Set-ItemProperty $regPath -Name EnableBackgroundCollector -Value 1 -Type DWord
Set-ItemProperty $regPath -Name EnableUpload             -Value 1 -Type DWord
Set-ItemProperty $regPath -Name FunctionAppUrl      -Value "https://func-mde-toolkit.azurewebsites.net/api/HealthReportIngestion"
Set-ItemProperty $regPath -Name FunctionAppAudience -Value "api://mde-toolkit-func"
Set-ItemProperty $regPath -Name AzureEnvironment -Value "Public"
Set-ItemProperty $regPath -Name DeviceTag -Value "Finance"
Set-ItemProperty $regPath -Name OrgUnit   -Value "US-East"
Set-ItemProperty $regPath -Name CacheRetentionDays -Value 30 -Type DWord

1.10 New Table Columns (v3.2+)

Recent client + Function App updates added the following columns to each row upserted into Azure Table Storage. Existing Power BI reports do not need to change — new columns simply become available for slicing.

Column	Source	Notes
`DeviceTag`, `OrgUnit`, `Environment`	Registry (section 1.6)	Promoted from JSON body to top-level columns
`IpAddress`	First non-loopback IPv4	`NetworkInterface` enumeration
`LastBootTimeUtc`	`Environment.TickCount64`	ISO 8601 UTC
`LastQuickScanUtc`, `LastFullScanUtc`	`MSFT_MpComputerStatus` age fields, registry fallback	ISO 8601 UTC
`AntivirusEngineVersion`	`AMEngineVersion`, filesystem fallback	`MpEngine.dll` version
`PlatformVersion`	`AMProductVersion`, registry & folder-name fallbacks	Defender platform version
`SignatureVersion`	CIM + `AVSignatureVersion` registry	Definition version
`ServiceVersion`	`AMServiceVersion`	Defender service version
`MdeOrgId`	Registry `Windows Advanced Threat Protection\Status\OrgId`	Empty if not onboarded
`AppControlPolicyCount`	`C:\Windows\System32\CodeIntegrity\CIPolicies\Active\*.cip`	File count, not enforcement
`AppControlStatus`	KMCI + policy count	`Enforced` \| `Audit` \| `Configured (N policies, not enforced)` \| `NotConfigured`
`PowerShellExecutionPolicy`	Machine policy → per-shell → default	`Restricted` / `RemoteSigned` / `AllSigned` / `Bypass` / etc.
`SmartScreenExplorerMode`	Registry `Explorer\SmartScreenEnabled`	Raw string (`RequireAdmin`, `Warn`, `Off`)

Azure Table Storage is schemaless per row. Existing rows keep their original columns — only newly upserted rows carry the new fields.

2. MSI Deployment

The MDE Toolkit ships as a WiX v5 MSI installer, suitable for SCCM, Intune, or GPO.

What the MSI Does

Installs to C:\Program Files\MDE-Toolkit\ (self-contained .NET 8)
Creates C:\ProgramData\MDE-Toolkit\cache\
Writes HKLM\SOFTWARE\MDE-Toolkit with Version and InstallPath
Creates scheduled task MDE Toolkit Collect (SYSTEM, every 8h)
Creates scheduled task MDE Toolkit Upload (interactive user, every 8h)
Adds desktop and Start Menu shortcuts

Silent Install

Command Line

msiexec /i MDE-Toolkit-3.2.1.msi /qn
msiexec /i MDE-Toolkit-3.2.1.msi /qn /l*v install.log

# Intune detection: HKLM\SOFTWARE\MDE-Toolkit\Version exists

3. Scheduled Tasks

The MSI creates two tasks. Both use -StartWhenAvailable so missed runs catch up when the device comes back online.

Offline resilience. If the machine is asleep or off at the scheduled time, Windows runs the task as soon as it wakes. One catch-up run fires — correct for telemetry.

3.1 Collect (SYSTEM)

PowerShell equivalent

$action    = New-ScheduledTaskAction `
  -Execute '"C:\Program Files\MDE-Toolkit\MDE Monitoring App.exe"' `
  -Argument '--collect --no-upload'
$trigger   = New-ScheduledTaskTrigger -Once -At (Get-Date) `
  -RepetitionInterval (New-TimeSpan -Hours 8)
$principal = New-ScheduledTaskPrincipal `
  -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
$settings  = New-ScheduledTaskSettingsSet `
  -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
Register-ScheduledTask -TaskName 'MDE Toolkit Collect' `
  -Action $action -Trigger $trigger -Principal $principal `
  -Settings $settings -Force

3.2 Upload (Interactive User)

PowerShell equivalent

$action    = New-ScheduledTaskAction `
  -Execute '"C:\Program Files\MDE-Toolkit\MDE Monitoring App.exe"' `
  -Argument '--upload'
$trigger   = New-ScheduledTaskTrigger -Once -At (Get-Date) `
  -RepetitionInterval (New-TimeSpan -Hours 8)
$principal = New-ScheduledTaskPrincipal `
  -GroupId 'BUILTIN\Users' -RunLevel Highest
$settings  = New-ScheduledTaskSettingsSet `
  -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
Register-ScheduledTask -TaskName 'MDE Toolkit Upload' `
  -Action $action -Trigger $trigger -Principal $principal `
  -Settings $settings -Force

3.3 Settings Summary

Setting	Collect	Upload
Run as	SYSTEM	BUILTIN\Users (interactive)
Interval	Every 8 hours	Every 8 hours
`StartWhenAvailable`	✅	✅
`AllowStartIfOnBatteries`	✅	✅
WakeToRun	❌	❌

No GUI. Both modes run headless. The WPF window is never created.

User must be logged on. Upload uses interactive logon — deferred via StartWhenAvailable if no session is active.

4. Verification

4.1 Test Collection

PowerShell (Admin)

& "C:\Program Files\MDE-Toolkit\MDE Monitoring App.exe" --collect --no-upload
Get-Content "C:\ProgramData\MDE-Toolkit\cache\latest.json" | ConvertFrom-Json | Select hostname, healthScore, overallStatus

4.2 Test Upload

PowerShell (logged-on user)

& "C:\Program Files\MDE-Toolkit\MDE Monitoring App.exe" --upload
Get-Content "C:\ProgramData\MDE-Toolkit\cache\service.log" -Tail 10

4.3 Verify Tasks

PowerShell

Get-ScheduledTask -TaskName "MDE Toolkit*" | Format-Table TaskName, State, @{N='RunAs';E={$_.Principal.GroupId ?? $_.Principal.UserId}}

4.4 Verify Table Row

Azure CLI

az storage entity query \
  --table-name HealthReports \
  --account-name stmdetoolkit \
  --filter "Hostname eq 'YOUR-PC-NAME'"

4.5 Expected Output

Check	Expected
Exit code	`0`
`latest.json`	Exists with `hostname`, `healthScore`
Service log	`Function App upload succeeded (200)`
Table row	`HealthScore > 0`
Registry	`HKLM\SOFTWARE\MDE-Toolkit\Version = 3.2.1`

← Previous Azure & Function App Next → Power BI