Skip to content

MDE Toolkit 3.0.9

Choose a tag to compare

View all tags
@chlaplan chlaplan released this 08 Jun 19:03
· 6 commits to master since this release
3.0.9
d1835c0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Firewall → Intune Migration
Resolved built-in rule names and descriptions. Built-in Windows Firewall rules store their Name, Description, and Group fields in the registry as MUI indirect references (e.g. @FirewallAPI.dll,-37507). Previous releases passed those raw references through to the migrated Intune Settings Catalog policies, leaving rules with unreadable names.

This release adds a MuiStringResolver that calls SHLoadIndirectString(string, StringBuilder, int, IntPtr) (the same Win32 API used by wf.msc and Get-NetFirewallRule) to translate those references into their real localized strings. Resolution happens at parse time for both the registry and WMI paths, with results cached for performance.

What you'll see:
• Firewall rule list now shows friendly names like "Cast to Device functionality (qWave-TCP-In)" instead of @FirewallAPI.dll,-37507
• Exported Intune Settings Catalog JSON now contains real names and descriptions in the _name and _description child settings
• Works for Local, GPO, and MDM policy stores
• Falls back to the original string if a DLL is missing or a resource ID is invalid (rules still migrate)

Support Bundle / Diagnostics
New: dedicated MDEClientAnalyzerResult.zip analyzer
The diagnostics workflow now has two analyzer services — one for MpCmdRun -GetFiles CABs and a new one (MdeAnalyzerService) tuned for the much richer MDEClientAnalyzerResult.zip produced by the MDE Client Analyzer. The new analyzer extracts the ZIP and parses:
• Analyzer XML, onboarding info, and onboarding policy
• Connectivity test results (MDETestResult.txt, MDEClientAnalyzerTest.txt)
• dsregcmd /status output
• Security management config (Intune/MDE-managed)
• All .evtx event logs (recursive) — Application, System, Security, Sense, UTC, MDM, PowerShell, WMI, AAD, Code Integrity, Defender Operational, etc.
• System info logs and component versions
• Certificate validation and SCHANNEL configuration
• Proxy configuration (WinHTTP, WPAD, IE)
• Enforcement reports
• Service status (service.txt, service list)
• MpComputerStatus.txt — RTP state, tamper protection, signature/scan age
• MpPreference.txt — exclusions, MAPS, sample submission, cloud block, PUA, IOAV, network protection
• hosts file
• Running processes (process.txt)
• Crash dumps (SenseCE_, SenseNdr_, SenseTVM_, etc.) — surfaced as critical issues
• Effective config (MPSupportEffectiveConfig.json)
• Defender AV policy text exports
• Device Guard settings and Network Protection diagnostic state
• npdiag logs and RegOffboardingInfo.json

Event Logs tab — full coverage
All .evtx files in the bundle (CAB or ZIP) are now imported into the shared event collection. Each event tracks its source file, provider, ID, level, timestamp, and full message text. Per-file capacity raised to 10,000 events and message truncation removed so row expansion shows complete details.

Assets 3
Loading