LaPlante Labs - Free Windows security tooling

Tools

Everything here is free, MIT licensed, and built to run in a real enterprise — signed installers, registry-driven configuration, and no telemetry back to us.

Highwind

Microsoft Defender for Endpoint monitoring & management

A WPF desktop application that reports what Defender for Endpoint is actually doing on a machine: security score, ASR rule state and where it came from, WDAC / App Control policies, Device Control events, firewall posture and onboarding health — and, since 3.5.0, what has changed on it over the last 30 days. Runs locally or against a remote target, and scales to fleet-wide collection with Azure ingestion and Power BI dashboards.

Endpoint Posture Score with remediation guidance
Highwind AI — ask in plain English, answers cite their sources
30 days of settings history: what changed, when, and whether protection dropped
ASR rules merged from Intune, GPO and Get-MpPreference
WDAC / App Control policy discovery and export
Background collection + Azure Table / Blob / Sentinel ingestion

v3.5.0 Windows 10/11 .NET 8 MIT

Open Highwind →

Looking for MDE Toolkit? It was renamed to Highwind in 3.5.0. Same project, same maintainer — existing links and older releases refer to the same tool.

About

LaPlante Labs is where I publish the Windows security tooling I build. The common thread is measurement rather than protection: these tools do not defend anything, they tell you what your existing controls are really doing and what to fix.

Everything is open source under the MIT License, distributed as signed installers, and free to use commercially. Nothing phones home — where a tool uploads data, it uploads to your Azure tenant, configured by you.

Found a bug, or want to report a security issue privately? Each project's repository has an issue tracker and a security policy.