Have a system that doesn't quite fit?
Tell us what you need it to do. We'll scope it with you.
A Windows baseline that can't drift silently
A reviewed, hash-pinned Windows tune-up for every managed desktop, with a weekly check for upstream changes.
The challenge
Business desktops collect telemetry, bloat and background load. Popular community tweak scripts change daily, and running them unreviewed across client machines is a risk.
What we built
- A weekly check compares the approved settings with the latest community release and opens an issue when anything changes
- The fleet launcher refuses to run anything whose fingerprint (SHA-256) doesn't match the approved manifest
- A restore point first, then telemetry, Recall, widgets and background extras off, applied to every user profile
- Workstations only: servers are skipped automatically
- Tested in Windows Sandbox, with every change listed in the repo
How it works
Watching and enforcing are kept apart. The weekly checker never touches a desktop, and the launcher never reads the internet's latest version. Changing what runs on the fleet takes a reviewed change to the pinned manifest, which then rolls out through the RMM tool after Patch Tuesday.
- Upstream release
- Weekly drift check
- Human review
- Pinned manifest
- RMM
- Desktops
By the numbers
- Drift check every Wednesday
- Fleet run monthly, after Patch Tuesday
- Open source on GitHub