Deployment - Enterprise Setup

1. Registry Configuration

All settings are read from a single registry key. Deploy via GPO Preferences, Intune OMA-URI, SCCM, or any registry tool.

Registry Path

HKLM\SOFTWARE\Policies\MDE-Toolkit

1.1 Background Collector

Value Name	Type	Default	Description
`EnableBackgroundCollector`	DWORD	0	1 = enable, 0 = off
`CollectionIntervalMinutes`	DWORD	480	Minutes between collections (min 5)
`CacheFolder`	SZ	%ProgramData%\MDE-Toolkit\cache	Local cache folder
`MaxCacheFiles`	DWORD	48	Rolling file count
`CacheRetentionDays`	DWORD	30	Delete older than N days (0 = no limit)

1.2 Upload: Function App

Value Name	Type	Default	Description
`EnableUpload`	DWORD	0	1 = enable upload
`FunctionAppUrl`	SZ		e.g. `https://func-mde-toolkit.azurewebsites.net/api/HealthReportIngestion`
`FunctionAppAudience`	SZ		e.g. `api://mde-toolkit-func`
`UploadIntervalMinutes`	DWORD	480	Upload frequency (min 5)
`UploadTimeoutSeconds`	DWORD	30	HTTP POST timeout (5–300)
`UploadRetryCount`	DWORD	2	Retries on failure (0–10)

1.3 Upload: Direct Blob Storage (Alternative)

Value Name	Type	Default	Description
`EnableBlobUpload`	DWORD	0	1 = enable blob upload
`BlobStorageAccountName`	SZ		Storage account name
`BlobContainerName`	SZ	mde-telemetry	Container name
`BlobEndpointSuffix`	SZ		e.g. `blob.core.usgovcloudapi.net`

1.4 Identity / Authentication

Value Name	Type	Default	Description
`TenantId`	SZ	(auto)	Auto-detected from PRT if blank
`PreferredAuthMethod`	SZ	Default	`Default` \| `WAM` \| `DeviceCode` \| `ManagedIdentity`
`AzureEnvironment`	SZ	Public	`Public` \| `USGov` \| `China` \| `Germany`

1.5 Data Scope

Control which telemetry categories are collected. All DWORD, 1 = on, 0 = off.

Value Name	Default	Description
`CollectDefenderStatus`	1	RTP, Tamper, Signatures
`CollectDefenderPolicies`	1	ASR, NP, CFA, Device Control
`CollectFirewallStatus`	1	Domain/Private/Public profiles
`CollectFirewallRules`	0	Individual rules (can be large)
`CollectDeviceControl`	1	Device Control policies
`CollectAppControl`	1	WDAC status
`CollectDeviceGuard`	1	VBS, HVCI, Credential Guard
`CollectIntuneEnrollment`	1	Intune / ConfigMgr info
`CollectSecurityScore`	0	Computed security score

1.6 Tagging / Organization

Value Name	Type	Description
`DeviceTag`	SZ	Freeform label — e.g. `Finance`
`OrgUnit`	SZ	e.g. `US-East`
`Environment`	SZ	`Production` \| `Staging` \| `Dev`

1.7 UI / Feature Flags

Control the interactive WPF application (not the background collector). All DWORD, default 0.

Value Name	Description
`DisableAiFeatures`	Hide AI analysis panels
`DisableExportButtons`	Hide PDF/JSON export
`DisableRemoteTarget`	Prevent targeting remote machines
`ForceReadOnlyMode`	Disable all write operations

1.8 Example: GPO / Intune Deployment

PowerShell — Set registry for enterprise collection + upload

$regPath = "HKLM:\SOFTWARE\Policies\MDE-Toolkit"
New-Item -Path $regPath -Force | Out-Null

Set-ItemProperty $regPath -Name EnableBackgroundCollector -Value 1 -Type DWord
Set-ItemProperty $regPath -Name EnableUpload             -Value 1 -Type DWord
Set-ItemProperty $regPath -Name FunctionAppUrl      -Value "https://func-mde-toolkit.azurewebsites.net/api/HealthReportIngestion"
Set-ItemProperty $regPath -Name FunctionAppAudience -Value "api://mde-toolkit-func"
Set-ItemProperty $regPath -Name AzureEnvironment -Value "Public"
Set-ItemProperty $regPath -Name DeviceTag -Value "Finance"
Set-ItemProperty $regPath -Name OrgUnit   -Value "US-East"
Set-ItemProperty $regPath -Name CacheRetentionDays -Value 30 -Type DWord

2. MSI Deployment

The MDE Toolkit ships as a WiX v5 MSI installer, suitable for SCCM, Intune, or GPO.

What the MSI Does

Installs to C:\Program Files\MDE-Toolkit\ (self-contained .NET 8)
Creates C:\ProgramData\MDE-Toolkit\cache\
Writes HKLM\SOFTWARE\MDE-Toolkit with Version and InstallPath
Creates scheduled task MDE Toolkit Collect (SYSTEM, every 8h)
Creates scheduled task MDE Toolkit Upload (interactive user, every 8h)
Adds desktop and Start Menu shortcuts

Silent Install

Command Line

msiexec /i MDE-Toolkit-3.1.1.msi /qn
msiexec /i MDE-Toolkit-3.1.1.msi /qn /l*v install.log

# Intune detection: HKLM\SOFTWARE\MDE-Toolkit\Version exists

3. Scheduled Tasks

The MSI creates two tasks. Both use -StartWhenAvailable so missed runs catch up when the device comes back online.

Offline resilience. If the machine is asleep or off at the scheduled time, Windows runs the task as soon as it wakes. One catch-up run fires — correct for telemetry.

3.1 Collect (SYSTEM)

PowerShell equivalent

$action    = New-ScheduledTaskAction `
  -Execute '"C:\Program Files\MDE-Toolkit\MDE Monitoring App.exe"' `
  -Argument '--collect --no-upload'
$trigger   = New-ScheduledTaskTrigger -Once -At (Get-Date) `
  -RepetitionInterval (New-TimeSpan -Hours 8)
$principal = New-ScheduledTaskPrincipal `
  -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
$settings  = New-ScheduledTaskSettingsSet `
  -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
Register-ScheduledTask -TaskName 'MDE Toolkit Collect' `
  -Action $action -Trigger $trigger -Principal $principal `
  -Settings $settings -Force

3.2 Upload (Interactive User)

PowerShell equivalent

$action    = New-ScheduledTaskAction `
  -Execute '"C:\Program Files\MDE-Toolkit\MDE Monitoring App.exe"' `
  -Argument '--upload'
$trigger   = New-ScheduledTaskTrigger -Once -At (Get-Date) `
  -RepetitionInterval (New-TimeSpan -Hours 8)
$principal = New-ScheduledTaskPrincipal `
  -GroupId 'BUILTIN\Users' -RunLevel Highest
$settings  = New-ScheduledTaskSettingsSet `
  -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
Register-ScheduledTask -TaskName 'MDE Toolkit Upload' `
  -Action $action -Trigger $trigger -Principal $principal `
  -Settings $settings -Force

3.3 Settings Summary

Setting	Collect	Upload
Run as	SYSTEM	BUILTIN\Users (interactive)
Interval	Every 8 hours	Every 8 hours
`StartWhenAvailable`	✅	✅
`AllowStartIfOnBatteries`	✅	✅
WakeToRun	❌	❌

No GUI. Both modes run headless. The WPF window is never created.

User must be logged on. Upload uses interactive logon — deferred via StartWhenAvailable if no session is active.

4. Verification

4.1 Test Collection

PowerShell (Admin)

& "C:\Program Files\MDE-Toolkit\MDE Monitoring App.exe" --collect --no-upload
Get-Content "C:\ProgramData\MDE-Toolkit\cache\latest.json" | ConvertFrom-Json | Select hostname, healthScore, overallStatus

4.2 Test Upload

PowerShell (logged-on user)

& "C:\Program Files\MDE-Toolkit\MDE Monitoring App.exe" --upload
Get-Content "C:\ProgramData\MDE-Toolkit\cache\service.log" -Tail 10

4.3 Verify Tasks

PowerShell

Get-ScheduledTask -TaskName "MDE Toolkit*" | Format-Table TaskName, State, @{N='RunAs';E={$_.Principal.GroupId ?? $_.Principal.UserId}}

4.4 Verify Table Row

Azure CLI

az storage entity query \
  --table-name HealthReports \
  --account-name stmdetoolkit \
  --filter "Hostname eq 'YOUR-PC-NAME'"

4.5 Expected Output

Check	Expected
Exit code	`0`
`latest.json`	Exists with `hostname`, `healthScore`
Service log	`Function App upload succeeded (200)`
Table row	`HealthScore > 0`
Registry	`HKLM\SOFTWARE\MDE-Toolkit\Version = 3.1.1`

← Previous Azure & Function App Next → Power BI