Highwind Administrative Template Group Policy settings for Highwind. Manages HKLM\SOFTWARE\Policies\Highwind. Highwind 3.0 or later Highwind 3.3.1 or later Highwind 3.3.2 or later Highwind 3.5.0 or later Highwind 3.7.0 or later Highwind Settings for Highwind, a free monitoring and management tool for Microsoft Defender for Endpoint. All settings write to HKLM\SOFTWARE\Policies\Highwind. Any setting left Not Configured uses the application's built-in default, so you only need to configure what you want to change. Highwind was called MDE Toolkit up to version 3.4.0 and read HKLM\SOFTWARE\Policies\MDE-Toolkit. Upgrading to 3.5.0 copies those values across for you, and the application still falls back to the old key for anything the new key does not define. Configure new deployments here; the old key is left in place and is not removed. Background Collector Controls the unattended collector that gathers a security health snapshot from this device and writes it to a local cache. The collector runs as SYSTEM from a scheduled task created by the MSI. It performs no network activity of its own; uploading is a separate step configured under Telemetry Upload. Telemetry Upload Controls how cached health snapshots reach Azure. Two destinations are supported and may be enabled independently: an Azure Function App (recommended, writes to Table Storage) or direct upload to Azure Blob Storage. Uploads run as the signed-in user and authenticate with that user's Entra ID identity. No keys, secrets or connection strings are stored on the endpoint. Identity and Authentication Controls how the toolkit authenticates to Azure and which cloud it targets. Leave everything Not Configured for a standard Entra ID joined device in the commercial cloud. Data Collection Scope Selects which categories of telemetry the background collector gathers. All categories are collected by default. Disabling a category reduces what leaves the device but also removes the corresponding columns from your reporting. Device Tagging Free-form labels written into every health snapshot and promoted to their own columns in Azure Table Storage, so fleet dashboards can filter and group by them. Application Lockdown Restricts what a user of the interactive application may do. These settings apply to the desktop application, not to the background collector. These are guardrails against accident and drift. They are not a security boundary against a determined local administrator, who retains the ability to run the underlying Windows commands directly. ASR Exclusion Guardrails Restricts the Attack Surface Reduction exclusions an administrator may create from within the toolkit. Every exclusion created through the toolkit requires a written justification and is recorded in a local audit ledger, including who created it, when, why, the exact commands used, and its expiry. Temporary exclusions revert themselves from a scheduled task, so they still expire when the application is closed. Logging and Diagnostics Controls the local service log written by the background collector and the upload loop. Page Visibility Controls which pages appear in the application, and to whom. Each page can be hidden entirely, shown only when the application is running elevated, shown only to standard users, or shown to both. Hiding a page removes it from navigation; it does not by itself prevent the underlying Windows functionality from being used by other means. Enable the background collector Determines whether this device collects a security health snapshot on a schedule. If you enable this setting, the collector gathers the categories selected under Data Collection Scope and writes them to the local cache folder. If you disable this setting, no unattended collection takes place. The interactive application still works normally. If you do not configure this setting, collection is off. Registry value: EnableBackgroundCollector (REG_DWORD). Default: 0. Collection interval Sets how often the background collector produces a new snapshot. The scheduled task created by the MSI runs every 8 hours, so values well below 480 minutes have no practical effect unless you also change the task trigger. Values below 5 minutes are rejected. If you do not configure this setting, the interval is 480 minutes (8 hours). Registry value: CollectionIntervalMinutes (REG_DWORD). Default: 480. Cache folder Sets the folder where snapshot JSON files are written before upload. The default location is protected by an access control list restricting it to SYSTEM and Administrators. If you point this at a different folder, secure it equivalently; snapshots describe the device's security posture. If you do not configure this setting, %ProgramData%\Highwind\cache is used. Registry value: CacheFolder (REG_SZ). Maximum cached snapshots Sets how many snapshot files are kept before the oldest are rotated out. If you do not configure this setting, 48 files are kept. Registry value: MaxCacheFiles (REG_DWORD). Default: 48. Cache retention period Deletes cached snapshots older than the number of days you specify. Set to 0 to keep files regardless of age, subject only to the maximum file count. If you do not configure this setting, snapshots older than 30 days are deleted. Registry value: CacheRetentionDays (REG_DWORD). Default: 30. Enable upload to an Azure Function App Determines whether cached snapshots are posted to your Azure Function App ingestion endpoint. You must also configure the Function App endpoint setting, or nothing will be uploaded. If you do not configure this setting, upload is off. Registry value: EnableFunctionAppUpload (REG_DWORD). Default: 0. The legacy value name EnableUpload is still honoured but is deprecated. Azure Function App endpoint Specifies the ingestion endpoint and the Entra ID audience the upload token is requested for. The URL is the full HTTPS address of your ingestion function. The audience is the Application ID URI of the Entra ID application protecting it. Registry values: FunctionAppUrl and FunctionAppAudience (both REG_SZ). Upload interval Sets how often cached snapshots are uploaded. Values below 5 minutes are rejected. If you do not configure this setting, the interval is 480 minutes (8 hours). Registry value: UploadIntervalMinutes (REG_DWORD). Default: 480. Upload timeout Sets the HTTP timeout for a single upload attempt, in seconds. Values are clamped to the range 5 to 300. If you do not configure this setting, the timeout is 30 seconds. Registry value: UploadTimeoutSeconds (REG_DWORD). Default: 30. Upload retry count Sets how many times a failed upload is retried before the snapshot is left in the cache for the next cycle. Values are clamped to the range 0 to 10. If you do not configure this setting, 2 retries are attempted. Registry value: UploadRetryCount (REG_DWORD). Default: 2. Enable direct upload to Azure Blob Storage Determines whether cached snapshots are written directly to an Azure Storage blob container, bypassing the Function App. This is an alternative to Function App upload, intended for environments where hosting a function is not practical. It requires each endpoint's user identity to hold a data-plane role on the container, which is a broader grant than the Function App design. Prefer the Function App where possible. If you do not configure this setting, direct blob upload is off. Registry value: EnableBlobUpload (REG_DWORD). Default: 0. Azure Blob Storage destination Specifies the storage account, container and endpoint suffix used for direct blob upload. Leave the endpoint suffix blank for the commercial cloud. For sovereign clouds supply the appropriate suffix, for example blob.core.usgovcloudapi.net. If the container name is left blank, mde-telemetry is used. Registry values: BlobStorageAccountName, BlobContainerName and BlobEndpointSuffix (all REG_SZ). Entra ID tenant Specifies the Entra ID tenant identifier used when acquiring tokens. If you do not configure this setting, the tenant is detected automatically from the device's Primary Refresh Token. Set it explicitly only in multi-tenant or guest scenarios where automatic detection picks the wrong tenant. Registry value: TenantId (REG_SZ). Preferred authentication method Selects how the toolkit acquires an Entra ID token. Default uses the standard credential chain and is correct for almost all deployments. Windows Account Manager forces broker-based sign-in. Device code is intended for hosts without an interactive desktop session. Managed identity is for Azure-hosted machines with an assigned identity. If you do not configure this setting, Default is used. Registry value: PreferredAuthMethod (REG_SZ). Default: Default. Azure cloud environment Selects the Azure cloud whose endpoints the toolkit talks to. If you do not configure this setting, the commercial (Public) cloud is used. Registry value: AzureEnvironment (REG_SZ). Default: Public. Entra ID authority override Overrides the Entra ID authority URI used for sign-in. Use this only where the cloud environment setting does not produce the correct authority, such as air-gapped or specialised sovereign deployments. An example value is https://login.microsoftonline.us/. Registry value: AuthorityHostOverride (REG_SZ). Collect Defender antivirus status Includes real-time protection state, tamper protection, signature, engine and platform versions, and last scan times in each snapshot. If you do not configure this setting, this data is collected. Registry value: CollectDefenderStatus (REG_DWORD). Default: 1. Collect Defender policy configuration Includes Attack Surface Reduction, Network Protection, Controlled Folder Access and Device Control configuration in each snapshot. If you do not configure this setting, this data is collected. Registry value: CollectDefenderPolicies (REG_DWORD). Default: 1. Collect Windows Firewall status Includes the state of the Domain, Private and Public firewall profiles in each snapshot. If you do not configure this setting, this data is collected. Registry value: CollectFirewallStatus (REG_DWORD). Default: 1. Collect App Control (WDAC) status Includes Windows Defender Application Control enforcement state and the number of deployed policies in each snapshot. If you do not configure this setting, this data is collected. Registry value: CollectAppControl (REG_DWORD). Default: 1. Collect management enrollment details Includes Intune and Configuration Manager enrollment information in each snapshot. If you do not configure this setting, this data is collected. Registry value: CollectIntuneEnrollment (REG_DWORD). Default: 1. Collect Device Guard status Includes Virtualization-based Security, Hypervisor-protected Code Integrity and Credential Guard state in each snapshot. If you do not configure this setting, this data is collected. Registry value: CollectDeviceGuard (REG_DWORD). Default: 1. Device tag, organizational unit and environment Applies free-form labels to this device. Each label is written into the snapshot and promoted to its own column in Azure Table Storage, so dashboards can filter and group by them. Typical uses are a business unit for the device tag, a region or site for the organizational unit, and Production, Staging or Dev for the environment. Any value is accepted; consistency across your fleet is what makes them useful. The fleet agent also reports these labels to the management service. The console groups, filters and sorts devices by them, queries can target every device carrying a label, and an administrator can limit an operator to the devices carrying given labels. A local administrator can change these values, so treat them as labels that separate operators, not as a boundary against the device's own administrator. Values longer than 64 characters are ignored by the fleet agent. The agent reads them when it starts; restart the HighwindFleetAgent service after a change. Registry values: DeviceTag, OrgUnit and Environment (all REG_SZ). Block data export from the application Determines whether users may export data out of the application. If you enable this setting, every export path is blocked, including report PDF and HTML, triage reports, scan results, ASR event and Advanced Hunting exports, App Control and WDAC policy files, firewall migration files, and investigation details. A blocked attempt shows a dialog naming this policy, so the button does not simply appear broken. If you disable or do not configure this setting, export is permitted. Registry value: DisableExportButtons (REG_DWORD). Default: 0. This setting is genuinely enforced from version 3.3.2 onward; in earlier versions it was documented but had no effect. Restrict the application to the local machine Determines whether the application may be pointed at another computer. If you enable this setting, the target machine box is disabled and any non-local value is rejected and reset to localhost. Enforcement sits at the single point every remote-capable service reads from, so no remote path is reachable even if the target is set programmatically. If you disable or do not configure this setting, remote targeting over WinRM or PsExec is permitted. Registry value: DisableRemoteTarget (REG_DWORD). Default: 0. This setting is genuinely enforced from version 3.3.2 onward; in earlier versions it was documented but had no effect. Force read-only mode Determines whether the application may change anything on the device. If you enable this setting, all write operations are blocked, including remediation actions, policy changes, and the creation or removal of ASR exclusions. The application becomes a viewer and reporter only. If you disable or do not configure this setting, write operations are permitted subject to the user holding administrative rights. Registry value: ForceReadOnlyMode (REG_DWORD). Default: 0. This setting is genuinely enforced from version 3.3.1 onward. Show preview features Determines whether features still marked as preview appear in the application. Machine Investigator is currently a preview feature. Preview features are functional but may change between releases. Consider enabling this for a pilot group before rolling it out broadly. If you disable or do not configure this setting, preview features are hidden. Registry value: ShowPreviewFeatures (REG_DWORD). Default: 0. Allow permanent ASR exclusions Determines whether an administrator may create an Attack Surface Reduction exclusion that never expires. If you disable this setting, the Permanent option is removed and every exclusion created through the toolkit must have an expiry. If you enable or do not configure this setting, permanent exclusions are permitted. Disable both this setting and Allow temporary ASR exclusions to prevent exclusion creation through the toolkit entirely. Registry value: AsrAllowPermanentExclusions (REG_DWORD). Default: 1. Allow temporary ASR exclusions Determines whether an administrator may create a time-limited Attack Surface Reduction exclusion. If you disable this setting, all temporary durations are removed from the menu. If you enable or do not configure this setting, temporary exclusions are permitted. Registry value: AsrAllowTemporaryExclusions (REG_DWORD). Default: 1. Maximum ASR exclusion duration Sets an absolute ceiling, in hours, on how long any Attack Surface Reduction exclusion created through the toolkit may last. Set to 0 for no ceiling. This cap is applied last, so it cannot be widened by the custom duration list. Enforcement happens where the exclusion is written, not only in the user interface. If you do not configure this setting, there is no ceiling. Registry value: AsrExclusionMaxHours (REG_DWORD). Default: 0. ASR exclusion duration choices Replaces the list of durations offered when creating a temporary Attack Surface Reduction exclusion. Supply a comma-separated list of whole hours, for example 4,24,168. Entries that cannot be parsed are ignored and reported to the user rather than being dropped silently. The maximum duration setting still applies on top of this list. If you do not configure this setting, the choices are 4, 24, 168 and 720 hours. Registry value: AsrExclusionDurationsHours (REG_SZ). Default: 4,24,168,720. Service log level Sets how much detail the background collector and upload loop write to the service log. Use Verbose only while troubleshooting; it produces a large volume of output. None disables logging entirely, which makes deployment problems considerably harder to diagnose. If you do not configure this setting, Info is used. Registry value: LogLevel (REG_SZ). Default: Info. Service log file path Specifies a custom path for the service log file. If you do not configure this setting, the log is written to service.log inside the cache folder. Registry value: LogFilePath (REG_SZ). Maximum log file size Sets the size in megabytes at which the service log is rotated. Values are clamped to the range 1 to 500. If you do not configure this setting, the log rotates at 10 MB. Registry value: MaxLogSizeMb (REG_DWORD). Default: 10. Controls whether this page appears in the application, and to whom. Hidden removes the page for everyone. Administrators only shows it when the application is running elevated. Standard users only shows it when the application is not elevated. Both shows it in either case. If you do not configure this setting, the application's built-in default for this page applies. Value data: 0 hidden, 1 administrators only, 2 standard users only, 3 both. ASR Rules overview page ASR Rules events page Firewall page WFP events page WFP filters page Firewall migration page App Control Advanced Hunting page Machine Investigator page Device Control policies page Defender policies page Advanced networking page CiTool page Highwind AI (AI Analysis) page Controls whether the Machine Investigator page appears in the application, and to whom. Machine Investigator queries Advanced Hunting for up to 25 devices and produces a triage verdict for each. It is a preview feature, so it also requires the Show preview features setting to be enabled. Results are limited to what the signed-in user's Defender for Endpoint permissions allow, so showing this page does not by itself grant access to data. If you do not configure this setting, the page is shown to administrators only. Value data: 0 hidden, 1 administrators only, 2 standard users only, 3 both. Controls whether the AI Analysis page appears in the application, and to whom. The page opens on the built-in Highwind AI agent, which runs on this device and needs no endpoint or key. The optional Microsoft Foundry or OpenAI mode sends collected configuration data to an endpoint you configure, and stays inactive until an endpoint and credential are configured. If you do not configure this setting, the page is shown to both administrators and standard users. Set it to Hidden to remove the page entirely. Value data: 0 hidden, 1 administrators only, 2 standard users only, 3 both. Fleet Agent (Preview) Controls the Highwind Fleet Agent, the optional Windows service that connects this device to a Highwind Management API you host. The agent is installed only when the MSI is run with INSTALLFLEETAGENT=1, and does nothing until "Enable the fleet agent" is enabled. Every setting in this category is ignored while that master switch is off. The agent never accepts inbound connections. It registers, sends heartbeats and polls for work over outbound HTTPS, and only runs a fixed catalogue of read-only operations that both the device and the tenant have approved. This feature is in preview. Pilot it on a small group of devices first. Enable the fleet agent Master switch for the Highwind Fleet Agent. If you enable this setting, the agent validates the remaining Fleet Agent settings at startup. A missing management service address, a non-HTTPS address, or a missing audience in Entra ID mode stops the agent and is written to its log. If you disable or do not configure this setting, the agent does nothing and every other setting in this category is ignored. Registry value: FleetDistributedAgentsEnabled (REG_DWORD). Default: 0. Allow the agent to register this device Allows the agent to register this device with the management service. Registration is the first step: without it the device has no identity at the service and cannot send heartbeats or receive work. Depending on the tenant's settings a new registration is approved automatically, or waits for an administrator to approve it in the management portal. Requires "Enable the fleet agent". Registry value: FleetAgentRegistrationEnabled (REG_DWORD). Default: 0. Allow the agent to send heartbeats Allows the agent to report liveness and basic health to the management service at the interval set in "Fleet agent timing". Requires "Enable the fleet agent" and a registered device. Registry value: FleetAgentHeartbeatsEnabled (REG_DWORD). Default: 0. Allow the agent to advertise its capabilities Allows the agent to tell the management service which read-only operations it can run. The service only sends a device operations that the device has advertised and the tenant has approved. Requires "Enable the fleet agent". Registry value: FleetCapabilityDiscoveryEnabled (REG_DWORD). Default: 0. Allow the agent to receive requests Allows the agent to poll the management service for requests and return results. Requests are limited to a fixed catalogue of read-only operations, such as agent health, agent version and Defender status. The agent cannot be asked to run arbitrary commands. Requires "Enable the fleet agent". Registry value: FleetBrokeredMessagingEnabled (REG_DWORD). Default: 0. Allow App Control management reporting Allows the agent to report two read-only answers for the optional App Control management module in the management console: - Installed applications: the entries Windows lists in Programs and Features (machine and loaded per-user Uninstall keys) and provisioned packaged apps. Name, publisher, version, scope, MSI product code and package family only. Uninstall commands, install locations and user SIDs are not read or sent. At most 400 entries. - App Control events: Code Integrity audit (3076) and block (3077) events with their signature detail (3089), and AppLocker MSI and Script audit (8028) and block (8029) events, from today and yesterday (UTC). They are counted per file, policy and day on the device; every user-profile folder name in a path is replaced by * and event message text is never sent. At most 250 groups. The management service asks for these only when an administrator has turned on Application inventory or Local App Control events under Admin, App Control management: installed applications about once a day and events about once an hour. If you disable or do not configure this setting, the agent does not offer either answer and the module shows no applications or events from this device. Restart the HighwindFleetAgent service after a change. Requires "Allow the agent to receive requests". Registry value: FleetAppControlReportingEnabled (REG_DWORD). Default: 0. Allow persistence audit Allows the management service to ask this device for a read-only inventory of things that start with Windows or a sign-in: local administrators, scheduled tasks outside the Microsoft task tree, Run and RunOnce values and Startup folder files. It reports names, locations, commands, SHA-256 hashes and signature state, never file contents or credentials. Restart the Highwind service after changing this setting. Disabled or Not configured: the device does not offer the inventory. Allow software trust report Allows the management service to ask this device which programs are running and who signed them: file name, SHA-256, version, product, whether the signature is embedded or from a Windows catalog, and the signing chain to its root certificate. It reads running programs only, builds the chain offline without checking revocation, and never reads file contents. Restart the Highwind service after changing this setting. Disabled or Not configured: the device does not offer the report. Allow kernel assurance report Allows the management service to ask this device for its kernel protections and loaded drivers: Secure Boot, TPM, virtualization-based security, memory integrity (HVCI), Credential Guard, kernel code integrity, the vulnerable driver blocklist setting, and for each running driver its file name, SHA-256, version, publisher, signature and file creation time. The service turns this into an explained Kernel Trust score. It reads metadata only, never file contents, and builds signature chains offline. Restart the Highwind service after changing this setting. Disabled or Not configured: the device does not offer the report. Allow policy provenance report Allows the management service to ask this device where its policy settings come from: whether it is enrolled in MDM (Intune), has applied Group Policy objects, or has the Configuration Manager client, and which of the Group Policy and MDM policy stores hold settings for Microsoft Defender, Windows Firewall and Device Guard. It reads registry key names, the MDM enrollment provider name and counts only, never a policy value, user name, server address or secret. Highwind uses this to say which management authority could have changed a security setting. Restart the Highwind service after changing this setting. Disabled or Not configured: the device does not offer the report. Allow policy settings report Allows the management service to ask this device for every setting in its Group Policy store (SOFTWARE\Policies, excluding browser policy), its MDM policy tree (PolicyManager\current\device) and Microsoft Defender's own configuration, with each value and, where the device can say, what set it: the MDM winning provider (Intune or another enrollment) or the Group Policy object. Highwind uses this to show every setting on a machine, who set it and which settings change. It reads policy configuration values only and never credentials, secrets, user names or browser policy. Enrollment user names are not sent. Restart the Highwind service after changing this setting. Disabled or Not configured: the device does not offer the report. Allow health signals report Allows the management service to ask this device how often ordinary problems happened on it in the last 72 hours, in whole-hour counts: application crashes and hangs, Windows Error Reporting entries, service failures, unexpected restarts, driver load failures, App Control (Code Integrity) block and audit events, Microsoft Defender attack surface reduction block and audit events, Defender protection turned off, and failed sign-ins. It counts events only. It never reads event text, user names, file paths, program names or machine names. The management service uses the counts to show what normal looks like before a change, and asks more often, for a limited time, for devices that an administrator chose to observe in a What If run. Failed sign-ins are counted from the Security log, which needs the SYSTEM account that the Highwind service runs as. Restart the Highwind service after changing this setting. Disabled or Not configured: the device does not offer the report. Allow firewall reporting Allows the management service to ask this device about its Windows Firewall: the state of the Domain, Private and Public profiles, the effective rules (what each rule allows or blocks, where it applies, which program, where it came from), and a summary of allowed and blocked connections. Connection summaries are grouped by hour, program, port and remote address and carry no packet contents. They are read from the Windows Security log, so the audit policies Filtering Platform Connection and Filtering Platform Packet Drop must be turned on by your own Group Policy or Intune policy; Highwind never changes audit policy and reports Not enabled or Partial when it is off. Allowed-connection auditing can be high-volume, so Highwind reads a bounded window, caps what it sends and reports how many events it dropped. Needs the SYSTEM account that the Highwind service runs as. Restart the Highwind service after changing this setting. Disabled or Not configured: the device does not offer firewall reporting. Allow Highwind to change this lab machine Lets this machine be a lab machine. The management service may ask it to change one Microsoft Defender attack surface reduction rule (Audit, Warn or Block) for a limited time. The agent only does this when the machine is tagged Lab or Test (Environment, DeviceTag or OrgUnit), only for a rule on its built-in list, and only to Audit, Warn or Block. It saves the old setting first, reads the new one back to check it, and puts the old setting back when the lab check ends, when the time is up, or after a restart. If another policy manages the rule, that policy wins and the change is reported as failed. This is the only setting Highwind ever changes. Never turn this on for a production or critical machine. Restart the Highwind service after changing this setting. Disabled or Not configured: the device is never changed. Allow AI security report Allows the management service to ask this device which AI products and MCP servers it has and what they can reach: AI desktop apps, coding agents, local model runtimes and editor extensions, the MCP servers named in their configuration files (command, arguments with secrets removed, program hash and signer, destination, variable names without values), local model files, ports AI runtimes listen on, and which credential stores (Azure, GitHub, SSH, AWS and similar) exist in each user profile. It reads configuration files and file names only. It never starts an MCP server, never sends a secret value or file contents, and does not read credential stores, only whether they exist. Restart the Highwind service after changing this setting. Disabled or Not configured: the device does not offer the report. Allow App Control application file scans Allows the management service to ask this device to list the executable files of one installed application, so an administrator can build App Control rules for it in the App Control management module. For each program, library, driver, installer and script file in the application's folder the agent reports its path relative to that folder, kind, size, version information (original file name, product name, file version), SHA-256 and Authenticode SHA-256 hashes, and the publisher, issuer and certificate TBS hashes of its embedded signature. The request names an application, never a folder. The agent finds the folder itself, from the application's own Uninstall entry (by MSI product code, or by name and publisher) or its installed package, and refuses drive roots, the Windows and system folders, Program Files, ProgramData, user profile folders themselves, network paths and removable drives. Nothing else is read: links and junctions are not followed, file contents are never sent, and every user-profile folder name in a path is replaced by *. At most 3000 files are read per request, within 90 seconds. If you disable or do not configure this setting, the agent does not offer file scans and the module cannot scan applications on this device. This setting does not depend on "Allow App Control management reporting". Restart the HighwindFleetAgent service after a change. Requires "Allow the agent to receive requests" (FleetBrokeredMessagingEnabled). Registry value: FleetAppControlFileScanEnabled (REG_DWORD). Default: 0. Accept client configuration from the management portal Lets the management portal (Admin, Client configuration) switch the agent's reports on or off for this device. Where the portal names a report, its value is used instead of the value set in local policy, including the Fleet report settings in this template. Reports the portal does not name stay under local policy. Only the reports listed in the portal can be set this way. The management service address, sign-in, the lab change setting and AI egress are never taken from the portal. If you enable or do not configure this setting, the portal's choices apply. If you disable it, the agent ignores the portal and uses local policy only. Restart the HighwindFleetAgent service after a change; a change made in the portal is applied by the agent at its next heartbeat without a restart. Registry value: FleetPortalConfigurationEnabled (REG_DWORD). Default: 1 (portal choices apply). Report the last signed-in user Controls whether the agent's security compliance answer names the account last signed in at this device, so the management portal can show it in the Last user column (Dashboard, Devices and the device page) and administrators can search devices by user. The agent reads the account and display name the Windows sign-in screen remembers (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI). Nothing else about the user is read or sent. If you enable or do not configure this setting, the account is reported. If you disable it, the agent reports that it does not share the account, and the management service deletes the account it held for this device at the next compliance answer. The account name is personal data: disable this setting where it may not leave the device. Restart the HighwindFleetAgent service after a change. Registry value: FleetReportLastLoggedOnUser (REG_DWORD). Default: 1 (reported). Allow administrator-defined custom checks Allows the agent to answer custom checks written by a Highwind.Admin in the management console: whether a registry value, file or service on this device matches what the administrator expects. The agent validates every check against rules compiled into it before reading anything, whatever the management service sent: - Registry: only under HKLM\SOFTWARE and HKLM\SYSTEM\CurrentControlSet. A value whose name looks like a credential (password, secret, token and similar) can be checked for existence only, and its data is never returned. - Files: only under Program Files, ProgramData and Windows. Existence, file version and SHA-256 only; junctions and links are not followed and file contents are never returned. - Services: existence, state and start type. Nothing is written, started, stopped or executed. At most 25 checks per request. If you disable or do not configure this setting, the agent does not offer custom checks and the console reports them as unavailable on this device. Restart the HighwindFleetAgent service after a change. Requires "Allow the agent to receive requests". Registry value: FleetCustomChecksEnabled (REG_DWORD). Default: 0. Fleet management service Identifies the Highwind Management API this device reports to. Management service URL: the base HTTPS address of the API, for example https://highwind-api.contoso.com/. Required. HTTP addresses are refused. Entra ID audience: the Application ID URI of the API app registration, for example api://<api-app-id>. Required in Entra ID mode; not used in client certificate or device certificate mode. Expected tenant ID: optional. When set, the agent checks it against the tenant the device is actually joined to and stops on a mismatch instead of guessing. Registry values: FleetManagementServiceUri, FleetManagementAudience, FleetExpectedTenantId (REG_SZ). Fleet agent authentication mode Selects how the agent proves its identity to the management service. Entra ID (default): the agent obtains a token for the audience configured in "Fleet management service". The service runs as LocalSystem and does not use the device's Entra join, so it needs its own identity holding the Highwind.Agent role: an agent app registration with a certificate in the service environment, or the managed identity of an Azure VM or Arc-enabled server. See enterprise-fleet.html#endpoints. Client certificate: the agent presents a machine certificate over mutual TLS. Use this for Active Directory only devices. Configure the certificate in "Fleet agent client certificate", and register the issuing CA with the management service. Device certificate (recommended for Entra joined and hybrid joined devices): nothing to distribute. The agent proves the device's identity once with its Entra device certificate, and the management service issues it its own certificate (30 days by default, renewed automatically). The key is created in the TPM and never leaves the device. Requests are signed, so this works behind Azure App Service. The audience is not used in this mode. New devices wait for approval in the portal unless the tenant has an auto-approve rule. The management service must have device identity turned on (Deploy-HighwindFleet.ps1 does this). Require a hardware-protected key: in Device certificate mode, refuse to use a software key when the device has no usable TPM. Leave cleared to fall back to a non-exportable software key, which the service records and never auto-approves. Any other value stops the agent at startup. Registry values: FleetAuthenticationMode (REG_SZ): EntraId, ClientCertificate or DeviceCertificate. Default: EntraId. FleetRequireHardwareKey (REG_DWORD): 1 or 0. Default: 0. Fleet agent client certificate Selects the certificate the agent presents when the authentication mode is Client certificate. Ignored in Entra ID mode. Set exactly one of thumbprint or subject. Setting both, or neither, stops the agent at startup. Thumbprint: the certificate's SHA-256 thumbprint, 64 hexadecimal characters. Spaces and colons are allowed. SHA-1 thumbprints are refused. Subject: matches every certificate with that subject and a private key, and uses the one that expires last. This is usually the better choice because it survives renewal. Store name: the certificate store to search. Default: My (Personal). Use the local machine store: leave enabled. The agent runs as LocalSystem, which has no user store. Registry values: FleetClientCertificateThumbprint, FleetClientCertificateSubject, FleetClientCertificateStoreName (REG_SZ); FleetUseMachineCertificateStore (REG_DWORD, default 1). Fleet agent timing Controls how often the agent contacts the management service. A value outside its range stops the agent at startup. Heartbeat interval: 30 to 86400 seconds. Default: 300. Request poll interval: 10 to 3600 seconds. Default: 60. Request timeout: 5 to 300 seconds. Default: 30. Registry values: FleetHeartbeatIntervalSeconds, FleetRequestPollIntervalSeconds, FleetRequestTimeoutSeconds (REG_DWORD). Fleet agent limits Caps how much the agent sends and accepts. A value outside its range stops the agent at startup. Maximum payload: 4096 to 8388608 bytes. Default: 262144. Messages per poll: 1 to 25. Default: 2. Maximum result length: 256 to 1048576 characters. Default: 65536. Registry values: FleetMaxPayloadBytes, FleetMaxMessagesPerPoll, FleetMaxResultCharacters (REG_DWORD). Enable the SharePoint decision store Makes the SharePoint Decision Store available on the App Control pages. When enabled, administrators can connect Highwind to a SharePoint list through Microsoft Graph and share allow/block decisions across the team. Access is limited to what the signed-in user's SharePoint permissions allow. If you disable or do not configure this setting, the SharePoint options are hidden and decisions are kept only in the local ledger on this device. Registry value: SharePointDecisionStoreEnabled (REG_DWORD). Default: 0. App Control Block Applications page App Control Allow Applications page App Control Impact Scanner page App Control Enforcement Readiness page App Control Rule Recommendations page App Control Local Policies page Entra ID (default) Client certificate (mutual TLS) Device certificate (Entra joined or hybrid joined) Highwind AI Controls what Highwind AI may reach and how far it may go. By default Highwind AI answers with a local engine that uses only data on this device. These settings decide whether it may also look things up online, send evidence to a Microsoft Foundry model, or watch for changes without being asked. These settings apply to the desktop application. Allow online documentation lookup Lets Highwind AI search Microsoft Learn, and during Deep Thinking the other sources allowed by "Research source ceiling", to explain a finding. Only the search terms are sent. Collected state, host names and configuration are never sent. If you disable this setting, Highwind AI stays entirely offline and its answers say that lookup is turned off by policy. If you enable it or do not configure it, lookup is allowed. Registry value: AllowAiOnlineLookup (REG_DWORD). Default: 1. Allow model reasoning (Microsoft Foundry) Lets Highwind AI send the evidence it gathers to your Microsoft Foundry model so the model can interpret it. This sends much more than online lookup does: host names, file paths, command lines and the configuration gaps the device is failing. Even when this is allowed, model reasoning runs only if the operator turns it on and an endpoint is configured. If you disable this setting, Highwind AI always uses the local engine, whatever the operator chooses or configures. If you enable it or do not configure it, the operator decides. Registry value: AllowAiModelReasoning (REG_DWORD). Default: 1. Allow the security watch Lets Highwind AI compare the collector's snapshots every two hours and tell the operator when a security setting on this device has been weakened. Findings appear as suggested questions the next time Highwind AI is opened. There are no pop-ups. The watch reads only snapshots this device has already written. It sends nothing anywhere. If you disable this setting, the watch does not start, whatever the operator has chosen. If you enable it or do not configure it, the watch runs unless the operator turns it off. Takes effect the next time Highwind starts. Registry value: AllowAiSecurityWatch (REG_DWORD). Default: 1. Maximum agent iterations Limits how many plan-and-observe rounds Highwind AI runs for one question, so a vague question cannot turn into an unbounded sweep of every tool against a remote machine. Range: 1 to 8. Default: 4. Deep Thinking adds up to 3 rounds, but never more than 8 in total. Registry value: AiAgentMaxIterations (REG_DWORD). Research source ceiling Limits which sources Highwind AI may consult when the operator turns on Deep Thinking. 1 = Microsoft documentation, Microsoft-owned GitHub repositories and practitioner Q&A sites (default) 2 = Microsoft documentation and Microsoft-owned GitHub repositories 3 = Microsoft documentation only A higher number is stricter. Has no effect if "Allow online documentation lookup" is disabled. Registry value: AiResearchTierCeiling (REG_DWORD). 1 - Microsoft, GitHub and practitioner sites (default) 2 - Microsoft documentation and GitHub 3 - Microsoft documentation only Default (recommended) Windows Account Manager (broker) Device code flow Managed identity Azure Public (commercial) Azure US Government Azure China Azure Germany None Error Warning Info (default) Verbose Hidden Administrators only Standard users only Both administrators and standard users Minutes between collections: Cache folder path: C:\ProgramData\Highwind\cache Snapshots to keep: Delete snapshots older than (days, 0 = no limit): Function App ingestion URL: https://func-mde-toolkit.azurewebsites.net/api/HealthReportIngestion Entra ID audience (Application ID URI): api://mde-toolkit-func Minutes between uploads: Timeout (seconds): Retries: Storage account name: Container name (blank = mde-telemetry): mde-telemetry Blob endpoint suffix (blank = commercial cloud): Entra ID tenant ID: Authentication method: Cloud environment: Authority URI: https://login.microsoftonline.us/ Device tag: Organizational unit: Environment: Maximum duration (hours, 0 = no limit): Durations in hours (comma-separated): 4,24,168,720 Log level: Log file path: Rotate at size (MB): Show this page to: Management service URL (HTTPS): Entra ID audience (Application ID URI): Expected tenant ID (optional): Authentication mode: Require a hardware-protected (TPM) key SHA-256 thumbprint (or leave blank and use subject): Subject (or leave blank and use thumbprint): Store name: My Use the local machine certificate store Heartbeat interval (seconds): Request poll interval (seconds): Request timeout (seconds): Maximum payload (bytes): Messages per poll: Maximum result length (characters): Maximum iterations: Allowed sources: