Products
Two products that work together. The Highwind Client is free and runs on every machine; Highwind Fleet is the licensed management portal that brings all of those machines into one view. Both are built for a real enterprise — signed installers, registry-driven configuration, and no telemetry back to us.
Highwind Client
Microsoft Defender for Endpoint monitoring & management
A WPF desktop application that reports what Defender for Endpoint is actually doing on a machine: security score, ASR rule state and where it came from, WDAC / App Control policies, Device Control events, firewall posture and onboarding health — and, since 3.5.0, what has changed on it over the last 30 days. Runs locally or against a remote target, and scales to fleet-wide collection with Azure ingestion and Power BI dashboards.
- Endpoint Posture Score with remediation guidance
- Highwind AI — ask in plain English, answers cite their sources
- 30 days of settings history: what changed, when, and whether protection dropped
- ASR rules merged from Intune, GPO and
Get-MpPreference - WDAC / App Control policy discovery and export
- Background collection + Azure Table / Blob / Sentinel ingestion
Highwind Fleet
Central management portal for Highwind devices
Run your own Highwind management API and portal in your Azure tenant and see every device’s security posture, App Control state and firewall activity in one place. Devices register, report in and answer approved read-only questions; you decide who sees what, and every request is audited.
- Fleet posture, baselines and drift, with your own checks
- App Control governance: decisions, drift and rule recommendations
- Endpoint firewall reporting: what is blocked, allowed and why
- Entra ID sign-in, roles by group and tag, full audit log
- Azure and Azure Government; deployed by script in about an hour
Looking for MDE Toolkit? It was renamed to Highwind in 3.5.0. Same project, same maintainer — existing links and older releases refer to the same tool.