All paths are under HKLM\ or HKCU\. Segment-bounded matching — subkeys are allowed, but sibling keys are not.
MDM / Enrollment
-SOFTWARE\Microsoft\Enrollments
-SOFTWARE\Microsoft\EnterpriseDesktopAppManagement
-SOFTWARE\Microsoft\Provisioning
-SOFTWARE\Microsoft\PolicyManager
-SOFTWARE\Microsoft\Windows\CurrentVersion\MDM
-AAD / Entra Join
-SOFTWARE\Microsoft\IdentityStore
-SYSTEM\CurrentControlSet\Control\CloudDomainJoin
-Windows Update / WUfB
-SOFTWARE\Microsoft\WindowsUpdate
-SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
-BitLocker
-SOFTWARE\Microsoft\BitLocker
-SYSTEM\CurrentControlSet\Control\BitLockerStatus
-Network / Proxy
-SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
-SYSTEM\CurrentControlSet\Services\Tcpip
-Autopilot / OOBE / Setup
-SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
-SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE
-SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
-TPM
-SYSTEM\CurrentControlSet\Services\TPM
-SOFTWARE\Microsoft\Tpm
-Intune IME
-SOFTWARE\Microsoft\IntuneManagementExtension
-Certificates (SCEP)
-SOFTWARE\Microsoft\SystemCertificates
-SOFTWARE\Policies\Microsoft\SystemCertificates
+ {REGISTRY_PREFIX_CATEGORIES.map((cat, i) => ( +0 ? " pt-1" : ""}`}>{cat.category}
+ {cat.items.map((p) =>{p}
)} +Allowed WMI Classes
Win32_OperatingSystem
-Win32_ComputerSystem
-Win32_BIOS
-Win32_Processor
-Win32_BaseBoard
-Win32_Battery
-Win32_TPM
-Win32_NetworkAdapter
-Win32_NetworkAdapterConfiguration
-Win32_DiskDrive
-Win32_LogicalDisk
-SoftwareLicensingProduct
+ {ALLOWED_WMI_QUERY_PREFIXES.map((q) => { + const cls = q.replace(/^SELECT \* FROM /i, ""); + return{cls}
; + })}Allowed Path Prefixes
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs
-C:\Windows\CCM\Logs
-C:\Windows\Logs
-C:\Windows\Panther
-C:\Windows\SetupDiag
-C:\ProgramData\Microsoft\DiagnosticLogCSP
-C:\Windows\SoftwareDistribution\ReportingEvents.log
+ {ALLOWED_FILE_PREFIXES.map((p) =>{p}
)}Allowed Commands
# TPM and Security
-Get-Tpm
-Get-SecureBootPolicy
-Get-SecureBootUEFI -Name SetupMode
-# BitLocker
-Get-BitLockerVolume -MountPoint C:
-# Network
-Get-NetAdapter | Select-Object Name, Status, InterfaceDescription, MacAddress, LinkSpeed
-Get-DnsClientServerAddress | Select-Object InterfaceAlias, ServerAddresses
-Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv4Address, IPv4DefaultGateway, DNSServer
-netsh winhttp show proxy
-ipconfig /all
-# Domain / Identity
-nltest /dsgetdc:
-dsregcmd /status
-# Certificate
-certutil -store My
-# Windows Update
-Get-HotFix | Select-Object -First 10 HotFixID, InstalledOn, Description
+ {COMMAND_CATEGORIES.map((cat) => ( +# {cat.category}
+ {cat.items.map((cmd) =>{cmd}
)} +