Step 2: Deployment

1. Registry Configuration

All settings are read from a single registry key. Deploy via GPO Preferences, Intune OMA-URI, SCCM, or any registry tool.

HKLM\SOFTWARE\Policies\MDE-Toolkit

1.1 Background Collector

1.2 Upload: Function App

1.3 Upload: Direct Blob Storage (Alternative)

1.4 Identity / Authentication

1.5 Data Scope

Control which telemetry categories are collected. All DWORD, 1 = on, 0 = off.

1.6 Tagging / Organization

These values are written to the JSON snapshot and promoted to their own columns (DeviceTag, OrgUnit, Environment) in the Azure Table so Power BI can slice on them.

1.7 UI / Feature Flags

Control the interactive WPF application (not the background collector). All DWORD, default 0.

1.8 ASR Exclusion Guardrails

Restrict what administrators may create from ASR Rules → Events. All values are optional; a device with none of them set behaves as before (4h / 24h / 7d / 30d plus Permanent).

reg add "HKLM\SOFTWARE\Policies\MDE-Toolkit" /v AsrAllowPermanentExclusions /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\MDE-Toolkit" /v AsrExclusionMaxHours /t REG_DWORD /d 4 /f

1.9 Page Visibility

Show or hide individual pages in the interactive application, per elevation level. All DWORD.

1.10 Logging

Local service log written by the background collector and upload loops.

1.11 Example: GPO / Intune Deployment

$regPath = "HKLM:\SOFTWARE\Policies\MDE-Toolkit"
New-Item -Path $regPath -Force | Out-Null

Set-ItemProperty $regPath -Name EnableBackgroundCollector -Value 1 -Type DWord
Set-ItemProperty $regPath -Name EnableUpload             -Value 1 -Type DWord
Set-ItemProperty $regPath -Name FunctionAppUrl      -Value "https://func-mde-toolkit.azurewebsites.net/api/HealthReportIngestion"
Set-ItemProperty $regPath -Name FunctionAppAudience -Value "api://mde-toolkit-func"
Set-ItemProperty $regPath -Name AzureEnvironment -Value "Public"
Set-ItemProperty $regPath -Name DeviceTag -Value "Finance"
Set-ItemProperty $regPath -Name OrgUnit   -Value "US-East"
Set-ItemProperty $regPath -Name CacheRetentionDays -Value 30 -Type DWord

1.12 New Table Columns (v3.2+)

Recent client + Function App updates added the following columns to each row upserted into Azure Table Storage. Existing Power BI reports do not need to change — new columns simply become available for slicing.

1.13 Fields fixed in v3.3.3

These columns existed in the schema but were never populated by the collector: they were uploaded at their default value on every device. A dashboard reading them saw false or 0 and could not tell that apart from a real measurement.

3. Scheduled Tasks

The MSI creates two tasks. Both use -StartWhenAvailable so missed runs catch up when the device comes back online. A third task is registered at runtime — see 3.4.

3.1 Collect (SYSTEM)

$action    = New-ScheduledTaskAction `
  -Execute '"C:\Program Files\MDE-Toolkit\MDE Monitoring App.exe"' `
  -Argument '--collect --no-upload'
$trigger   = New-ScheduledTaskTrigger -Once -At (Get-Date) `
  -RepetitionInterval (New-TimeSpan -Hours 8)
$principal = New-ScheduledTaskPrincipal `
  -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
$settings  = New-ScheduledTaskSettingsSet `
  -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
Register-ScheduledTask -TaskName 'MDE Toolkit Collect' `
  -Action $action -Trigger $trigger -Principal $principal `
  -Settings $settings -Force

3.2 Upload (Interactive User)

$action    = New-ScheduledTaskAction `
  -Execute '"C:\Program Files\MDE-Toolkit\MDE Monitoring App.exe"' `
  -Argument '--upload'
$trigger   = New-ScheduledTaskTrigger -Once -At (Get-Date) `
  -RepetitionInterval (New-TimeSpan -Hours 8)
$principal = New-ScheduledTaskPrincipal `
  -GroupId 'BUILTIN\Users' -RunLevel Highest
$settings  = New-ScheduledTaskSettingsSet `
  -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
Register-ScheduledTask -TaskName 'MDE Toolkit Upload' `
  -Action $action -Trigger $trigger -Principal $principal `
  -Settings $settings -Force

3.3 Settings Summary

3.4 ASR Exclusion Sweep (registered at runtime)

\MDE Toolkit\ASR Exclusion Sweep is not created by the MSI. It is registered the first time an administrator creates a temporary ASR exclusion, and runs as SYSTEM every 15 minutes. Defender has no native expiry for exclusions, so this task is what reverts them when the toolkit itself is closed.