Highwind Client documentation

Install Highwind, learn what each page does, and set up the permissions for Application Control and Advanced Hunting.

Overview

Highwind is a free Windows application that shows how Microsoft Defender for Endpoint is actually configured on a device, and helps you fix it.

It reads what Windows is enforcing after Group Policy, Intune and local settings are merged. It does not only show what was assigned. Everything on this page is about the client on one machine. If you manage many devices, see Highwind for organizations and Highwind Fleet.

Nothing is uploaded by default. A new install collects and sends nothing off the device. Network connections happen only when you sign in to Advanced Hunting, connect an AI engine, or an administrator turns on reporting.

Install

  1. Download the MSI from GitHub Releases.
  2. Run it. The MSI includes .NET 10, so nothing else is needed.
  3. Start Highwind from the Start menu. For full functionality, right-click and choose Run as administrator. See Permissions at a glance.
RequirementDetail
WindowsWindows 10 version 1809 or later, or Windows 11
AdministratorRecommended. Highwind starts without it, and pages that need it tell you.
CiToolNeeds Windows 11 22H2 or later, or Windows Server 2025 or later
Defender for EndpointNeeded only for Advanced Hunting and Machine Investigator

What each page does

Pages are in the navigation tree on the left. This is each one in the order it appears.

PageWhat it shows or does
OverviewOne-screen health summary of Defender on this device.
Endpoint Posture ScoreA score with category breakdowns and what to fix first.
Anti-Virus
Status, Events, Threat History		Engine and signature state, Defender events, and detected threats.
ASR Rules
Overview, Events		Every Attack Surface Reduction rule with its mode and where the setting comes from (Intune, Group Policy or local). Events groups blocks and warn-bypasses by rule and process, and lets you add audited exclusions. See ASR rules and events.
Firewall
Events, WFP Events, WFP Filters, Policies, Migrate to Intune		Firewall log analysis, Windows Filtering Platform drops and filters, rule browser, and a helper to move Group Policy firewall rules to Intune.
Application Control
Overview, Local Endpoint, Investigate, Deploy, Policy Management		Policies on this device, what App Control would block in your tenant, and building or merging policies. See Application Control permissions and the full guide.
Device Control
Overview, Events, Policies		USB and removable-device policies, events, and a visual policy editor.
Policies
All Policies, MDE Settings		The policies and Defender settings in effect on this device.
Compliance DashboardEvaluate the device against baselines, including DISA STIG for Defender AV and Firewall.
Quick ActionsOne-click Defender maintenance tasks. These change the device, so they need Run as administrator.
Health SnapshotA point-in-time record of the device’s Defender health that you can review or export.
Live EventsDefender-related events as they happen.
DiagnosticsOpen a Defender support bundle (MpSupportFiles.cab), find problems and export a report.
Machine Investigator PreviewA verdict and evidence for up to 25 devices at once, from Advanced Hunting. See Machine Investigator.
Knowledge BaseReference for Defender components, ASR rules and common problems, with links to Microsoft documentation.

Permissions at a glance

Highwind only reads, except where a page says it writes a file or applies a setting. Each feature needs one of three things.

You want toYou need
View Defender status, settings, ASR, firewall, Device ControlRun Highwind normally. Some values only appear when run as administrator.
List or change local App Control policies, run CiTool, change Defender settings, run quick actionsLocal administrator (Run as administrator)
Query your tenant with Advanced HuntingA Microsoft Entra account that can run Advanced Hunting, and consent to a read-only permission. Steps below.
Check or monitor another machineAdministrator rights on that machine. Details below.

Application Control permissions, step by step

Application Control has two halves. The local half works on the device you are sitting at. The tenant half uses Advanced Hunting to see what would be blocked across all your devices. You can use either one without the other.

Part 1: Local policies on this device

  1. Close Highwind if it is open.
  2. Right-click Highwind in the Start menu and choose Run as administrator. Approve the Windows prompt. The account needs to be a local administrator.
  3. Open Application Control → Local Endpoint → Local Policies. Your active policies are listed.
  4. To run CiTool commands, open CiTool on the same menu. This needs Windows 11 22H2 or later, or Windows Server 2025 or later. On older Windows, Highwind reads the policy files instead and CiTool is unavailable.
  5. To change a policy file, Highwind writes a timestamped .orig.xml backup next to it first. You need write access to the folder holding the file.

Part 2: What would be blocked across your tenant

  1. Make sure devices are onboarded to Defender for Endpoint. Deploy an App Control policy in audit mode so the events reach Advanced Hunting.
  2. Connect Highwind to Advanced Hunting using the steps below.
  3. Open Application Control → Investigate → Advanced Hunting, load your policies, and run the query. The App Control guide walks through the workflow.

Part 3: Checking the real file on another device

When Advanced Hunting does not carry a file detail, such as the signer, press Scan on a row. Highwind then scans the folder on a device that reported it through the administrative share (\\device\C$). You need administrator access to that device’s share, and the device must be reachable on the network.

Part 4 (optional): SharePoint decision store

Shares application decisions with people who do not use Highwind. It needs a registry value and a Microsoft Graph sign-in. The steps are in the App Control guide.

Connect to Advanced Hunting, step by step

Highwind asks Advanced Hunting questions as you. It uses a read-only permission, has no client secret and never writes to your tenant.

Before you start

  • Your tenant has Microsoft Defender for Endpoint (or Defender XDR) with devices onboarded.
  • Your account can run Advanced Hunting in the Microsoft Defender portal. Try Hunting → Advanced hunting there first. If it works there, it will work in Highwind. The built-in Security Reader role is enough for read access, or a custom role with the Security data basics (read) permission.
  • You know your cloud: Commercial, GCC, GCC High or DoD.

Sign in

  1. Open Application Control → Investigate → Advanced Hunting.
  2. Choose your cloud. Choose it before you sign in.
  3. Select Sign In. A Microsoft sign-in window opens. Sign in with the account from the checklist above. The window waits for 3 minutes. Cancel sign-in stops it sooner.
  4. If a Permissions requested screen appears, review and accept. This grants consent for your account only.
  5. When Highwind shows you as signed in, press Run. Rows appear if devices have reported events in the time range.

If you see “Need admin approval”

Your tenant does not let users consent on their own. Choose one of these.

  1. Request approval, if the button is shown. The request goes to the reviewers listed under Entra admin center → Enterprise applications → Admin consent settings. They approve it under Admin consent requests.
  2. Or forward the admin consent link. Highwind shows the link in its error message. Send it to a Cloud Application Administrator or Global Administrator. They open it, sign in and accept. Everyone in the tenant is then covered.
  3. Select Sign In again in Highwind after approval.

The permission requested

Sign-in pathResourceDelegated permission
Default (Microsoft Defender XDR)https://api.security.microsoft.comAdvancedHunting.Read
Legacy Defender for Endpointhttps://api.securitycenter.microsoft.comAdvancedQuery.Read
Microsoft Graphhttps://graph.microsoft.comThreatHunting.Read.All

By default Highwind signs in with the well-known Microsoft Graph Command Line Tools public client (14d82eec-204b-4c2f-b7e8-296a70dab67e). That is why the consent screen carries that name. To use your own app registration instead, create a public client with the redirect URI http://localhost and the same delegated permission, then enter its application ID in the Advanced Hunting settings.

The App Control guide covers how to review and remove grants.

Signing out

Select Sign out on the Advanced Hunting page. The saved token is dropped.

Remote machines

Highwind can check another computer over WinRM or PsExec. Remote answers describe the remote machine.

  1. Use an account that is a local administrator on the remote machine.
  2. For WinRM, the remote machine must allow it (Enable-PSRemoting) and be reachable on the network.
  3. For PsExec, the administrative share (\\device\ADMIN$) must be reachable.
  4. Enter the machine name in the remote target box and choose a method.

Organizations can hide or restrict remote targeting with the ADMX templates.

Settings history

A scheduled task running as SYSTEM records the security configuration every 8 hours and keeps a rolling 30 days. It does not depend on who was signed in. Use it to answer “what changed on this machine?”, including settings Windows does not log, such as firewall profiles, BitLocker and Remote Desktop.

Highwind AI uses the same history to explain a change and where the setting is controlled in Intune, Group Policy or the registry.

Highwind AI

Ask a question about a machine in plain English: status, what changed, threats, or how a Defender feature works. The answer includes its sources.

  • Local engine (default). Rule-based. Nothing leaves the machine and no account is needed.
  • Azure OpenAI or Microsoft Foundry (optional). Choose the engine in the AI settings and enter your endpoint to get richer wording. Only then is data sent to the service you chose.

Troubleshooting

SymptomWhat to do
A page says it needs administrator rights, or values are blankClose Highwind and start it with Run as administrator.
CiTool is greyed out or failsCiTool needs Windows 11 22H2 or later, or Windows Server 2025 or later.
Advanced Hunting sign-in never finishesThe window times out after 3 minutes. Select Sign In again, and check you chose the right cloud first.
“Need admin approval” or “Administrator consent is required”See Connect to Advanced Hunting.
Advanced Hunting signs in but returns no rowsWiden the Last N days range (30 days is the retention limit). Confirm devices are onboarded and an App Control policy is running in audit mode. Check the same query in the Defender portal.
Everything reads “Not Evaluated”Load your policies in the Policies drawer before you run the query.
A page is missingAn administrator may have hidden it with policy. See the ADMX templates.

More help