ADMX templates

Policy controls

The templates decide what the Highwind client shows and allows on a managed device. They need no Azure resources.

These settings are guardrails, not a security boundary. See Security model.

Download

Prefer the individual files? Highwind.admx · en-US/Highwind.adml · README.md

Install the templates

Central Store: recommended for domain environments

Copy the two files into your domain’s Central Store. Every administrator who opens the Group Policy editor then sees the settings, with no per-workstation installation.

\\<your-domain>\SYSVOL\<your-domain>\Policies\PolicyDefinitions\Highwind.admx
\\<your-domain>\SYSVOL\<your-domain>\Policies\PolicyDefinitions\en-US\Highwind.adml

$domain = $env:USERDNSDOMAIN
$store  = "\\$domain\SYSVOL\$domain\Policies\PolicyDefinitions"

New-Item -ItemType Directory -Path "$store\en-US" -Force | Out-Null
Copy-Item .\Highwind.admx        -Destination $store          -Force
Copy-Item .\en-US\Highwind.adml  -Destination "$store\en-US"  -Force

Single machine

For a lab, or where you administer policy from one workstation:

C:\Windows\PolicyDefinitions\Highwind.admx
C:\Windows\PolicyDefinitions\en-US\Highwind.adml

Local policy on a non-domain machine

After copying to C:\Windows\PolicyDefinitions, open gpedit.msc and browse to the same location. Note that gpedit.msc is not present on Home editions.

Where the settings appear

Computer Configuration
  └── Policies
        └── Administrative Templates
              └── Highwind
                    ├── Background Collector
                    ├── Telemetry Upload
                    ├── Identity and Authentication
                    ├── Data Collection Scope
                    ├── Device Tagging
                    ├── Application Lockdown
                    ├── ASR Exclusion Guardrails
                    ├── Logging and Diagnostics
                    └── Page Visibility

Common configurations

Four starting points. Each one is a handful of settings, not a wholesale lockdown.

Verify a deployment

gpupdate /target:computer /force

# Everything the toolkit will read
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Highwind" | Format-List

# Which pages are policy-controlled
Get-Item "HKLM:\SOFTWARE\Policies\Highwind" |
    Select-Object -ExpandProperty Property |
    Where-Object { $_ -like "Visibility*" }

Run gpresult /h gpreport.html for a report showing which GPO supplied each value; useful when two policies disagree.

Using Intune instead

Intune imports the same template, so cloud-managed devices get the same settings, names and help text as Group Policy. The values land in the same key, HKLM\SOFTWARE\Policies\Highwind.

1. In the Intune admin center, go to Devices → Configuration → Import ADMX and choose Import.
2. Select Highwind.admx as the ADMX file and en-US\Highwind.adml as the ADML file, then Create. Refresh until State shows Available.
3. Go to Devices → Configuration → Create → New policy. Platform Windows 10 and later, profile type Templates → Imported Administrative templates (Preview).
4. Under Computer Configuration → Highwind, set the same values you would in Group Policy, then assign the profile to a device group.

A PowerShell script deployed through Intune is often simpler for a one-off rollout. The registry reference lists every value, its type and its default.

Notes and caveats

• Computer scope only. There are no user-scope settings; everything applies to the machine.
• Version awareness. Each setting declares which toolkit version introduced it under Supported on. Applying a setting to an older build is harmless; it is simply ignored.
• Upgrades are safe. The MSI seeds each value at its built-in default but never overwrites an existing one, so policy-set values survive.
• Two settings changed behaviour in 3.3.2. DisableExportButtons and DisableRemoteTarget were previously documented but had no effect. They are now genuinely enforced. If you set either speculatively and still want export or remote targeting, set them back to Disabled before rolling out 3.3.2.
• Seven values were removed in 3.3.2. They are ignored if present, and are deliberately absent from these templates. See the 3.3.2 release notes.
• English only for now. Only en-US resources are supplied. Copy the ADML into another language folder to have it load in that locale; the text will remain English.

Download ADMX (.zip) Registry reference