feat(gui-client): add MDM config for Windows

[thomaseizinger]

This PR adds the equivalent MDM configuration that we already have for MacOS & iOS for the GUI client on Windows. These options are retrieved from the Windows registry when the Client is started. Specifically, the key for these is: HKEY_CURRENT_USER\Software\Policies\Firezone.

At moment, these cannot be configured or seen by the user. They are also not "watched" for whilst the Client is running. If an admin pushes a new MDM configuration, the Client will have to be restarted in order for that new config to take effect.

Windows Policy templates are structured into two files:

• An .admx file that defines the structure of the policy, like the kinds of values it has, where it is stored, which versions it is supported on and which category it belongs to.
• An .adml file that defines defines all strings and presentation logic, like the actual text of the policies and how the values are presented in the GUI in e.g. Intune.

Internally, we differentiate between MdmSettings and AdvancedSettings. The MdmSettings are cross-platform, however on Linux, we always fallback to the defaults and therefore, they are always "unset". Eventually, it might make sense to wrap both of these into a more general Settings struct that acts as as a proxy for the two.

Related: #4505

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
firezone	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	May 27, 2025 1:21am

[Copilot]

Pull Request Overview

This PR adds MVP support for MDM-based configuration in the Windows GUI client, enabling registry-backed policies for account_slug and dont_check_for_updates.

• Reads two MDM policies from HKEY_CURRENT_USER\Software\Policies\Firezone on Windows
• Integrates MdmSettings into the startup flow to disable update checks and configure account slug
• Updates documentation, changelog, and provides ADMX/ADML templates for Microsoft Intune

Reviewed Changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
website/src/components/Changelog/GUI.tsx	Added an “Unreleased” changelog item for Windows Intune support
website/src/app/kb/client-apps/windows-gui-client/readme.mdx	Added an MDM configuration section with Intune setup instructions
rust/gui-client/src-tauri/src/settings/windows.rs	Implemented registry reader for MDM settings
rust/gui-client/src-tauri/src/settings/macos.rs	Stubbed MDM loader on macOS
rust/gui-client/src-tauri/src/settings/linux.rs	Stubbed MDM loader on Linux
rust/gui-client/src-tauri/src/settings.rs	Introduced MdmSettings, platform modules, and load_mdm_settings
rust/gui-client/src-tauri/src/gui.rs	Integrated disabling of the update checker via MdmSettings
rust/gui-client/src-tauri/src/controller.rs	Added mdm_settings to Controller and pass-through to auth
rust/gui-client/src-tauri/src/auth.rs	Extended Request::to_url to include an optional account_slug
policy-templates/windows/firezone_en-US.adml	New ADML template for MDM policy UI strings
policy-templates/windows/firezone.admx	New ADMX template defining two policies under Software\Policies\Firezone

Comments suppressed due to low confidence (2)

rust/gui-client/src-tauri/src/settings.rs:59

• [nitpick] The field name dont_check_for_updates is a negative boolean, leading to double negation. Consider renaming it to disable_update_check for readability and to simplify logic.

pub dont_check_for_updates: Option<bool>,

rust/gui-client/src-tauri/src/settings.rs:64

• Rust's Option<T> does not have an is_none_or method. Consider using map_or or unwrap_or to implement the same logic, for example: self.dont_check_for_updates.map_or(true, |no_check| !no_check).

self.dont_check_for_updates.is_none_or(|no_check| !no_check)

[thomaseizinger]

At moment, these cannot be configured or seen by the user.

@jamilbk I've decided that we don't need this for the MVP of MDM. The way I thought this makes more sense is to have a dedicated MdmSettings struct that represents what is set in the registry although them coming from the registry is an implementation detail of Windows. On Linux, these will most likely come from a file in /etc somewhere.

In case we deem some of these to be user-configurable as well, then we probably want to store that again in a config file somewhere and then simply check, which one is set and define a priority, i.e. value in registry always has a higher priority than config on disk.

Eventually, we might fully move to platform-specific configuration and get rid of the config file on Windows entirely and store everything in the registry. But that is too much work to change right now.

[jamilbk]

They are also not "watched" for whilst the Client is running.

Ok for an MVP I think. Bear in mind once an admin requests "force Firezone to always be running" which is a common request for VPN apps then this won't fly, so I already handle live updates where appropriate in #9196.

Here is the current General Settings screen from that PR:

[thomaseizinger]

They are also not "watched" for whilst the Client is running.

Ok for an MVP I think. Bear in mind once an admin requests "force Firezone to always be running" which is a common request for VPN apps then this won't fly

People still reboot their machines though - esp. on Windows - so it will eventually be restarted.

We already have the code for watching it so we can extract that eventually. It is just buried in the network-change detection so I need to tear that apart first and couldn't be bothered yet.

Things changed

[thomaseizinger]

@jamilbk This is ready for the final review. I've tested the ADMX file by uploading it to Intune and applying it to my VM and building a client with this branch. Successfully read all settings:

[Copilot]

Pull Request Overview

This PR adds support for Windows MDM configuration for the GUI client by reading policy values from the Windows registry. Key changes include:

• Adding UI elements and documentation for Windows-specific MDM configurations.
• Introducing new ADMX policy templates and associated registry loading code.
• Integrating MDM settings into the advanced settings update flow and system tray UI.

Reviewed Changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
website/src/components/Changelog/GUI.tsx	Added change item for Windows MDM configuration.
website/src/app/kb/deploy/clients/readme.mdx	Updated documentation on configuring MDM for Windows.
website/public/policy-templates/windows/*	New ADMX and ADML files for Windows policy configuration.
rust/gui-client/src/settings.ts	Refactored settings to use new managed keys and disable inputs when managed.
rust/gui-client/src-tauri/src/settings/*	Added platform-specific MDM loading and integrated MdmSettings into settings.
rust/gui-client/src-tauri/src/gui/* and controller.rs	Updated GUI and controller logic to account for MDM settings.
rust/gui-client/src-admx-macro/*	New proc macro to generate Windows registry loading code from ADMX templates.

[thomaseizinger]

GitHub CI is shitting itself :(

[jamilbk]

LGTM, left some non-blocking suggestions.

[jamilbk]

Out of curiosity, are you aware of any XML standardization best practices these templates should follow? In the https://github.com/ProfileManifests/ProfileManifests repo I was instructed to use plutil -convert xml1 <file> before submission to lint/fix style before submission.

[thomaseizinger]

I looked for linters online but couldn't find anything unfortunately.

[jamilbk]

Opened this issue to get the General settings added:

#9240