Skip to content

Preferences

Jump to bottom
Rod Christiansen edited this page Sep 5, 2026 · 1 revision

Preferences

BootstrapMate for Windows is configured through the registry: a machine policy key that Intune or Group Policy writes, a machine settings key that the MSI writes, and a per-user key that the GUI writes. This page is the reference for every value name, where it lives, and which ones the command-line tool actually reads.

Precedence

ConfigManager builds one effective configuration per run. Sources are applied lowest first, so a later source overwrites an earlier one:

  1. BootstrapMateConstants.DefaultManifestUrl baked into the binary
  2. HKCU\SOFTWARE\BootstrapMate\Settings
  3. HKLM\SOFTWARE\BootstrapMate\Settings — read in the 64-bit view, then the 32-bit view
  4. HKLM\SOFTWARE\Policies\BootstrapMate — the policy / Intune CSP key
  5. Command-line switches

So policy beats machine settings, machine settings beat user settings, and a command-line switch beats all of them. Two consequences are worth knowing before you debug a value that will not stick:

  • Because the 32-bit view of HKLM\SOFTWARE\BootstrapMate\Settings is read after the 64-bit view, a 32-bit value overrides the 64-bit one at the same path.
  • --url does not go through ConfigManager at all — it is assigned directly, so it wins regardless of what any registry key says.

Only one command-line switch is wired into ConfigManager (--no-dialog). Every other switch is read from the argument array directly, which is why several config values below have no command-line equivalent and several policy values have no effect. See Command Line Reference.

ManagementDetector resolves policy value names through an alias table, so more than one spelling is accepted for some keys. Aliases are listed per setting below. A value existing under the policy key also makes the GUI mark that control Managed by Policy and refuse to write it to HKCU.

Registry locations

Purpose Path
Policy / Intune CSP (highest precedence) HKLM\SOFTWARE\Policies\BootstrapMate
Machine settings (written by the MSI) HKLM\SOFTWARE\BootstrapMate\Settings
User settings (written by the GUI) HKCU\SOFTWARE\BootstrapMate\Settings

The Intune OMA-URI form documented in the ADMX header is:

./Device/Vendor/MSFT/Policy/Config/BootstrapMate~Policy~BootstrapMate/{ValueName}

String values are REG_SZ. Boolean values are REG_DWORD 1 or 0; the loader also accepts a REG_SZ that parses as a boolean or an integer. Integer values are REG_DWORD.

Summary

Key Type Required Default Summary
ManifestUrl String No built-in default URL The manifest to download and execute
AuthorizationHeader String No none Authorization header, sent to the manifest host only
FollowRedirects Boolean No 0 No effect in the CLI
Reboot Boolean No 0 No effect in the CLI
DryRun Boolean No 0 No effect in the CLI
SilentMode Boolean No 0 No effect in the CLI — use --silent
VerboseMode Boolean No 0 No effect in the CLI — use --verbose
EnableDialog Boolean No 1 No effect in the CLI — use NoDialog
NoDialog Boolean No 0 Suppress the progress dialog
DialogTitle String No Setting Up Your Device Progress dialog window title
DialogMessage String No Please wait while we install required software... Progress dialog body text
DialogIcon String No none No effect in the CLI
BlurScreen Boolean No 0 Run the progress dialog fullscreen
CustomInstallPath String No C:\Program Files\BootstrapMate No effect in the CLI
NetworkTimeout Integer No 120 No effect in the CLI
ReportingUrl String No none POST target for the run summary
ReportingHeader String No none Authorization header on the reporting POST
VerifyPackageSignatures Boolean No 1 Authenticode-gate MSI and EXE installers
ExpectedPublisher String No none Require the signer to contain this value
AllowUnsigned Boolean No 0 Permit an untrusted or unsigned installer

Nine of these are configurable but inert. They are marked below and collected on Troubleshooting and Gotchas.

Connection

ManifestUrl

  • Type: String
  • Default: a build-time URL compiled into the binary. Run managedbootstrapinstall --help on the build you have deployed to see the value it carries, and set this key explicitly rather than relying on it.
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → ManifestUrl
  • Settings value: HKLM\SOFTWARE\BootstrapMate\Settings → ManifestUrl, or the same path under HKCU
  • Policy aliases: ManifestUrl, url, jsonUrl, JsonUrl, ConfigURL, BootstrapUrl

The URL BootstrapMate downloads and executes. Setting it removes the need to pass --url.

A default URL is compiled into the binary and the MSI writes the same URL into HKLM\SOFTWARE\BootstrapMate\Settings\ManifestUrl at install time, so an effective URL is in practice always resolvable. Running with no arguments and no configuration therefore almost never prints the usage block — it runs against the built-in URL. Set your own value before deploying. See Serving Manifests and Packages.

AuthorizationHeader

  • Type: String
  • Default: none
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → AuthorizationHeader
  • Policy aliases: AuthorizationHeader, headers, Headers

The complete value of an Authorization request header. It is sent verbatim, so include the scheme (for example Bearer <token>).

The header is attached to the manifest request, and to a package download only when the package URL's host matches the manifest URL's host, compared case-insensitively. A package hosted anywhere else is fetched without it, and the run logs Authorization header withheld for cross-host download: {url} at Debug level. This scoping is deliberate: it keeps the credential from reaching third-party hosts, and it avoids the 403 Forbidden that some object stores return for public objects requested with an Authorization header they cannot validate.

There is no command-line switch that sets this value. The GUI emits --headers, which the CLI ignores.

FollowRedirects

  • Type: Boolean
  • Default: 0
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → FollowRedirects

This setting has no effect on the command-line tool. The value is read into the configuration object and never consulted by any execution path. Downloads use a default HttpClient, which follows redirects regardless of what you set here. The only place the value is honoured anywhere in the product is the GUI's "Preview manifest" button. See Troubleshooting and Gotchas.

Behavior

Reboot

  • Type: Boolean
  • Default: 0
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → Reboot

This setting has no effect. No reboot handling exists: /norestart is passed to every msiexec invocation, nothing detects a pending reboot, and nothing reboots at the end of a run. See Troubleshooting and Gotchas.

DryRun

  • Type: Boolean
  • Default: 0
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → DryRun

This setting has no effect. There is no dry-run mode. A run configured with DryRun enabled downloads and installs exactly as it otherwise would. See Troubleshooting and Gotchas.

SilentMode

  • Type: Boolean
  • Default: 0
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → SilentMode
  • Policy aliases: SilentMode, silent

The configuration value has no effect. Console suppression is decided by scanning the argument list for --silent before the configuration is loaded. Pass --silent on the command line instead.

VerboseMode

  • Type: Boolean
  • Default: 0
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → VerboseMode
  • Policy aliases: VerboseMode, verbose

The configuration value has no effect. Verbose console output is decided by scanning the argument list for --verbose or -v. Pass one of those instead. The log file always receives Debug lines whether or not verbose is on.

Dialog

The progress dialog is an optional external binary at C:\Program Files\csharpDialog\dialog.exe. When it is absent every dialog call is a silent no-op and the only trace is a Debug-level log line.

EnableDialog

  • Type: Boolean
  • Default: 1
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → EnableDialog

This setting has no effect on the command-line tool. The CLI reads NoDialog, not EnableDialog. Disabling EnableDialog in policy leaves the dialog enabled. Use NoDialog or --no-dialog.

NoDialog

  • Type: Boolean
  • Default: 0
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → NoDialog

Suppresses the progress dialog. Equivalent to the --no-dialog switch, which is the one command-line flag routed through ConfigManager.

DialogTitle

  • Type: String
  • Default: Setting Up Your Device
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → DialogTitle

The dialog window title. --dialog-title overrides it for a single run.

DialogMessage

  • Type: String
  • Default: Please wait while we install required software...
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → DialogMessage

The message shown above the progress bar. --dialog-message overrides it for a single run.

DialogIcon

  • Type: String
  • Default: none
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → DialogIcon

This setting has no effect on the command-line tool. The CLI always initialises the dialog with a null icon, so a configured path is never passed through. See Troubleshooting and Gotchas.

BlurScreen

  • Type: Boolean
  • Default: 0
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → BlurScreen

Passes --fullscreen to the dialog binary, so the dialog covers the screen behind it. Equivalent to the --blur-screen switch.

Advanced

CustomInstallPath

  • Type: String
  • Default: C:\Program Files\BootstrapMate
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → CustomInstallPath
  • Policy aliases: CustomInstallPath, InstallPath, iapath

This setting has no effect on the command-line tool. It is exposed only through a helper the CLI never calls; the install location is fixed by the MSI. See Troubleshooting and Gotchas.

NetworkTimeout

  • Type: Integer (seconds)
  • Default: 120
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → NetworkTimeout
  • Constraint: the ADMX declares a range of 10 to 600

This setting has no effect on the command-line tool. The manifest and package HttpClient instances are constructed with .NET's default 100-second timeout, and the reporting POST uses a hard-coded 15 seconds. Neither reads this value. See Retries and Timeouts.

Reporting

ReportingUrl

  • Type: String
  • Default: none
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → ReportingUrl
  • Policy aliases: ReportingUrl, ReportURL, reportingUrl

Where to POST the run summary. When empty, no report is sent. The POST fires on both the success and failure paths and never fails the run. See Logging and Reporting for the payload shape.

ReportingHeader

  • Type: String
  • Default: none
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → ReportingHeader
  • Policy aliases: ReportingHeader, ReportingAuthorizationHeader

Sent verbatim as the Authorization header on the reporting POST. Unlike AuthorizationHeader, this one is not host-scoped — it goes to whatever ReportingUrl names.

Security

VerifyPackageSignatures

  • Type: Boolean
  • Default: 1
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → VerifyPackageSignatures
  • Policy aliases: VerifyPackageSignatures, VerifySignatures

Enables the Authenticode gate on downloaded msi and exe installers before they are executed. Enabled by default. Setting it to 0 disables the gate entirely for all item types. See Security and Package Verification.

ExpectedPublisher

  • Type: String
  • Default: none
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → ExpectedPublisher
  • Policy aliases: ExpectedPublisher, Publisher

When set, the signer certificate's common name (or, if no CN can be extracted, its full subject) must contain this string, compared case-insensitively. This is a substring test, not an exact match. A manifest item may override it with its own expectedPublisher field.

AllowUnsigned

  • Type: Boolean
  • Default: 0
  • Required: No
  • Policy value: HKLM\SOFTWARE\Policies\BootstrapMate → AllowUnsigned

Permits an installer whose signature is missing, tampered with, or does not chain to a trusted root. A publisher mismatch is never bypassed by this setting. A manifest item may override it with its own allowUnsigned field.

The ADMX/ADML template

resources/BootstrapMate.admx and resources/en-US/BootstrapMate.adml define the policies above for Group Policy and for Intune's ADMX ingestion, so an administrator can set them from a policy editor instead of writing registry values by hand. Every policy in the template is class="Machine", targets key="SOFTWARE\Policies\BootstrapMate", and declares supportedOn windows:SUPPORTED_Windows_10_0. Boolean policies write 1 when enabled and 0 when disabled.

For Group Policy, the files go in the usual locations on the machine or in the central store:

C:\Windows\PolicyDefinitions\BootstrapMate.admx
C:\Windows\PolicyDefinitions\en-US\BootstrapMate.adml

As shipped, both files are malformed XML and will not import. Parsing BootstrapMate.admx fails with a mismatched tag at line 43: the Reporting category element is opened and never closed, so </categories> closes the wrong element, and the ReportingHeader policy closes its <elements> block without a closing </policy>. Parsing BootstrapMate.adml fails with a mismatched tag at line 193, where the ReportingHeader presentation is left unclosed. Group Policy will not load the template from PolicyDefinitions and Intune ADMX ingestion will reject it.

Until the files are repaired, configure BootstrapMate by writing the registry values directly — by Intune OMA-URI against the policy key, by a Group Policy registry preference, or by any scripted registry write. The registry values themselves are unaffected by the template defect; the code reads them the same way whatever wrote them.

See also

Introduction

The Manifest

Configuration

Operations

More

Clone this wiki locally