Project — GUARD (ADMX Tool)

Overview

In a corporate Active Directory, hundreds of group policies (GPOs) configure Windows, Office and Edge across workstations. No one can simply answer: which policies are actually applied on this machine, where do they come from, are they compliant with Microsoft's security recommendations, and why does this machine behave differently from the others? The native tools fragment the work and the reports come out as raw XML.

GUARD answers these four questions in a single tool. It reads the real state of a workstation, compares it to what the domain prescribes, and explains every gap in plain language — from the reference catalogue down to the Word or Excel report. In production since April 2026 with incremental releases, it is now at version 1.7.0 and used daily by the IT team.

From the real machine to the domain's intent: scan the workstation, compare it to what the domain prescribes, and explain every gap.

◆ Four questions, one answer

Four questions, one answer

A

What is actually applied?

The real state of Windows, Office and Edge policies on a given machine, read straight from the registry — not a guess from the management console.

B

Where does it come from?

Every value is traced back to the GPO that wrote it, precedence conflicts resolved: you see the winning policy and the ones that were overridden.

C

Is it compliant?

The machine is measured against Microsoft's security baselines (Security Compliance Toolkit): a quantified, documented gap, not a gut feeling.

D

Why does this machine differ?

Drift detection isolates what was changed by hand, a policy that wasn't applied, or a "tattooed" setting left behind with no legitimate source.

◆ Key features

Key features

01

Reference catalogue

A native parser for Microsoft's ADMX/ADML files builds a readable catalogue of every policy available for Windows, Office and Edge.

02

Workstation scan

Multi-profile registry reads with no administrator rights. Multi-machine collection runs remotely through a PowerShell script, without elevation.

03

Traceability & conflicts

Each setting is traced back to its GPO by reading the SYSVOL Registry.pol files and the local application history, with precedence resolved (winner / overridden).

04

Drift detection

Gaps between a machine's real state and what the domain prescribes are isolated and explained one by one: changed value, missing policy, tattooed setting with no source.

05

Measured compliance

Continuous compliance measurement against Microsoft's security baselines, with a score and the detail of the gaps to fix.

06

Change requests

A proposal → review → approval → apply workflow, automated Word and Excel reports, and an activity timeline per policy.

Architecture & engineering

GUARD is a WPF desktop application (.NET 10), in MVVM with CommunityToolkit.Mvvm. Data is persisted in SQL Server through Entity Framework Core, with a schema driven by versioned SQL migrations rather than EF migrations — schema evolution stays readable and traceable in the repository.

The technical core is a binary parser for Microsoft's PReg format: it reads the SYSVOL Registry.pol files and the local history to reconstruct, value by value, which GPO won and which were overridden. Field collection relies on PowerShell operations scripts run without elevation, and document generation goes through OpenXML.

Delivery is industrialised: a GitLab CI/CD pipeline on a self-hosted runner chains tests, a self-contained build and a tag-driven automated release, with production secrets injected at build time. 215 xUnit unit tests hold the safety net, and every version is validated on test machines before any production rollout.

What this project demonstrates

GUARD brings together two kinds of expertise rarely held by the same person: expert-level Windows / Active Directory / GPO administration — RSoP, LSDOU, SYSVOL, security baselines — and full software engineering, from architecture to deployment.

Above all, it shows the ability to turn a fuzzy team need into a product used every day, delivered with discipline: frequent releases, zero regressions, fixes validated in the field the same day.

Technologies

.NET 10 C# WPF MVVM CommunityToolkit.Mvvm EF Core SQL Server PReg / Registry.pol PowerShell OpenXML xUnit GitLab CI/CD Microsoft SCT

GUARD