The Ultimate Microsoft Group Policy Intelligence Platform
Stop guessing what policies do. Start engineering Windows environments with precision.
PolicyForge is an open-source intelligence platform for Microsoft Group Policy, ADMX, MDM CSP, and Intune. It bridges the gap between:
- 📄 Raw ADMX files that are unreadable at scale
- 🖥️ Group Policy Editor that provides zero context
- ☁️ Intune with its completely different language (CSP)
- 🔒 Security baselines that are rigid and undocumented
PolicyForge is not documentation. It is infrastructure for IT decision-making.
🌐 Live Web UI: ms-gpo.vercel.app — Search policies, filter by risk level & category, view MITRE ATT&CK mappings, registry paths, PowerShell commands, and Intune OMA-URIs in one place.
| Feature | Status |
|---|---|
| 80+ policies indexed with context, impact & use cases | ✅ Live |
| MITRE ATT&CK mapping for every security policy | ✅ Live |
| GPO → Intune OMA-URI translations | ✅ Live |
| Registry ↔ PowerShell reference | ✅ Live |
| ADMX auto-parser (batch-generates Markdown) | ✅ Live |
| Policy Diff Tracker (Windows 10 vs 11 vs Server) | ✅ Live |
| PowerShell translation engine (GPO → Intune CSV) | ✅ Live |
| Enterprise hardening template (CIS L2 / STIG) | ✅ Live |
| Gaming optimization template | ✅ Live |
| Kiosk / lockdown template | ✅ Live |
| Red team evasion research (MITRE-mapped) | ✅ Live |
| Microsoft Edge security policies (EDGE-001→013) | ✅ Live |
| Microsoft Office macro security policies (OFFICE-001→005) | ✅ Live |
| Web UI policy search dashboard | ✅ Live — ms-gpo.vercel.app |
| AI policy recommendation engine | 🔜 Phase 4 |
✅ Phase 1 — Foundation (Complete)
├── Repository structure
├── POLICY_SCHEMA.json (standardized schema)
├── 3 seed policies with full MITRE/CSP/Registry mapping
└── ADMX parser engine (automation/admx-parser/)
✅ Phase 2 — Scale (Complete)
├── 80+ policies across Windows Security, Privacy, Defender, Edge, Office, Account Policies
├── GPO → Intune OMA-URI translation mappings
├── PowerShell translation engine (GPO → Intune CSV export)
├── Policy Diff Tracker (automation/policy-diff/)
├── Registry ↔ PowerShell bulk reference
├── Templates: Enterprise Hardening, Gaming, Kiosk, Red Team
└── Post-deployment verification scripts
✅ Phase 3 — Web UI (Complete)
├── Next.js search dashboard → https://ms-gpo.vercel.app
├── Filter by: category (Defender, Edge, Office, Network, Privacy, Security)
├── Filter by: risk level (Critical, High, Medium, Low)
├── Real-time search across policies, registry, MITRE, OMA-URI
└── Policy cards with MITRE ATT&CK tags, risk badges, category labels
🔜 Phase 4 — AI Layer (Q4 2026)
├── Natural language policy query: "Harden 50 SMB endpoints"
├── Auto-generate GPO pack from environment description
├── Policy simulator: "What happens if I enable this?"
└── Conflict prediction engine
🔜 Phase 5 — SaaS (2027)
├── PolicyForge Cloud: web dashboard + API
├── Tenant-aware policy recommendations
├── Compliance reporter (CIS, DISA STIG, NIST 800-53)
└── MDE / Defender for Business integration
PolicyForge/
│
├── 📁 policies/
│ ├── windows/security/ # 19 hardening policies (WIN-SECURITY-001→019)
│ ├── windows/privacy/ # 3 privacy policies (WIN-PRIVACY-001→003)
│ ├── windows/network/ # Network isolation policies
│ ├── windows/account-policies/ # 13 account policies (ACC-001→013)
│ ├── windows/applocker/ # AppLocker policies
│ ├── windows/audit/ # Audit policies
│ ├── windows/bitlocker/ # BitLocker policies
│ ├── windows/credentials/ # Credential protection policies
│ ├── windows/firewall/ # Windows Firewall policies
│ ├── windows/smb/ # SMB hardening policies
│ ├── windows/update/ # Windows Update policies
│ ├── windows/user-rights/ # User Rights Assignment policies
│ ├── windows/wdac/ # Windows Defender App Control policies
│ ├── defender/ # 10 Defender policies (DEF-001→DEF-010)
│ ├── edge/ # 13 Edge browser policies (EDGE-001→EDGE-013)
│ ├── office/ # 5 Office macro policies (OFFICE-001→OFFICE-005)
│ └── server/ # Windows Server policies (Phase 3)
│
├── 📁 templates/
│ ├── security-baselines/ # Enterprise baseline (CIS L2 / STIG)
│ ├── enterprise-hardening/ # 5-layer hardening + verify.ps1
│ ├── gaming-optimization/ # Performance tuning for gaming PCs
│ ├── kiosk-mode/ # Full lockdown + assigned access
│ └── redteam-evasion/ # Offensive research (authorized use)
│
├── 📁 translations/
│ ├── gpo-to-intune/ # GPO → OMA-URI mappings + PS engine
│ └── registry-mapping/ # Registry ↔ PowerShell reference
│
├── 📁 automation/
│ ├── admx-parser/ # ADMX → Markdown generator
│ └── policy-diff/ # Windows version diff tracker
│
├── 📁 dashboards/
│ └── web-ui/ # Phase 3 — Next.js (Live: ms-gpo.vercel.app)
│
├── README.md
├── CONTRIBUTING.md
├── CHANGELOG.md
├── SECURITY.md
├── POLICY_SCHEMA.json
└── LICENSE
| Category | Count | Directory |
|---|---|---|
| Windows Security | 19 | policies/windows/security/ |
| Windows Account Policies | 13 | policies/windows/account-policies/ |
| Microsoft Edge | 13 | policies/edge/ |
| Microsoft Defender | 10 | policies/defender/ |
| Microsoft Office | 5 | policies/office/ |
| Windows Privacy | 3 | policies/windows/privacy/ |
| Windows Firewall, SMB, AppLocker, BitLocker, Audit, Update, User Rights, WDAC, Network, Credentials | 10+ | policies/windows/*/ |
| Total | 80+ |
| Goal | PolicyForge Resource |
|---|---|
| Harden endpoints against ransomware | templates/enterprise-hardening/ + policies/defender/DEF-006 |
| Block macro malware (Emotet/QakBot) | policies/office/OFFICE-001 + policies/office/OFFICE-002 |
| Migrate GPO to Intune | translations/gpo-to-intune/windows-security.md |
| Block LLMNR poisoning attacks | policies/windows/security/WIN-SECURITY-003 |
| Enforce Edge SmartScreen for all users | policies/edge/EDGE-003 |
| Lock down a kiosk / POS terminal | templates/kiosk-mode/ |
| Find policies deprecated in Windows 11 | automation/policy-diff/policy_diff.py |
| Optimize a gaming PC via GPO | templates/gaming-optimization/ |
| Validate hardening post-deployment | templates/enterprise-hardening/verify.ps1 |
| Search & explore all policies visually | ms-gpo.vercel.app |
Visit ms-gpo.vercel.app to search all policies by name, registry path, MITRE technique, or OMA-URI. Filter by category and risk level instantly — no setup required.
# Browse policies by category
ls policies/defender/
ls policies/windows/security/
ls policies/edge/
ls policies/office/
# Every policy file includes: registry path, PowerShell, Intune CSP, MITRE mapping
cat policies/office/OFFICE-002-block-macros-from-internet.md# Batch-generate Markdown from all ADMX files on your Windows machine
python automation/admx-parser/admx_parser.py \
--admx-dir "C:\Windows\PolicyDefinitions" \
--output-dir ./generated-policies# Scan live registry and export Intune OMA-URI CSV
.\translations\gpo-to-intune\translation-engine.ps1 -OutputCsv .\intune-export.csv
# Then import CSV into: Intune > Devices > Configuration > Create > Custom# Run as Administrator after applying enterprise hardening
.\templates\enterprise-hardening\verify.ps1
# Outputs PASS/FAIL/MISSING for 13 critical controlsPolicyForge grows through community intelligence. Every contribution makes the platform more valuable for the global sysadmin community.
Ways to contribute:
- 📝 Add a new policy explanation (copy
policies/_TEMPLATE.md) - 🔄 Submit a GPO → Intune mapping we're missing
- 🧪 Share a real-world deployment config
- 🔴 Document an attack path and its defensive fix
- 🌐 Translate policies for non-English documentation
See CONTRIBUTING.md for full guidelines, badge rewards, and the contributor leaderboard.
MIT License — see LICENSE for details.
Made with ❤️ by the PolicyForge community
🌐 Try the Live Web UI ·
⭐ Star this repo if it helps you