AugmentedIntelligence reads enterprise policy from:

[text]
HKLM\Software\Policies\AugmentedIntelligence
HKCU\Software\Policies\AugmentedIntelligence

Computer policy is read first. User policy is read second unless DisableUserOverride=1 is set under HKLM.

Group Policy Template

Copy these files to a domain Central Store or a local policy definitions folder:

[text]
enterprise\admx\AugmentedIntelligence.admx
enterprise\admx\en-US\AugmentedIntelligence.adml

Typical Central Store target:

[text]
\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\AugmentedIntelligence.admx
\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\en-US\AugmentedIntelligence.adml

Then open Group Policy Management Editor and configure:

[text]
Computer Configuration or User Configuration
  Administrative Templates
    AugmentedIntelligence

Policy Values

Registry value	Type	Effect
EnableAugmentedIntelligence	REG_DWORD	0 disables startup and command execution.
RequireDomainJoined	REG_DWORD	1 requires an AD domain user context.
DisableUserOverride	REG_DWORD	HKLM only. 1 ignores HKCU policy values.
RequiredADGroups	REG_SZ or REG_MULTI_SZ	Semicolon-separated AD security groups. User must be in at least one.
AllowedCommandCategories	REG_SZ or REG_MULTI_SZ	If populated, only these categories can run.
BlockedCommandCategories	REG_SZ or REG_MULTI_SZ	Always deny these categories.
LogAllowedCommands	REG_DWORD	1 logs allowed command decisions.
LogDeniedCommands	REG_DWORD	1 logs denied command decisions.
CentralLogPath	REG_SZ	Full log file path, or directory ending in \.

Feature gate values are REG_DWORD where 0 disables the category and 1 enables it:

[text]
EnableLLM
EnableCloudLLM
EnableWindowsAutomation
EnableMinecraft
EnableROS
EnableIRC
EnableWordPress
EnableOsTicket
EnableNetworking
EnableRemoteCommands
EnableDeveloperTools
EnableSettings
EnableAutomation
EnableGaming
EnableDatabase
EnableFileEditor
EnableSpeech
EnablePerception
EnableMemory

Command Categories

Use these names in AllowedCommandCategories and BlockedCommandCategories:

[text]
llm; windows; minecraft; ros; irc; wordpress; osticket; network; remote;
developer; settings; automation; gaming; database; file; speech; perception;
memory; enterprise; safety; general

Emergency shutdown and ad/policy status commands remain reachable.

Runtime Commands

[text]
ad status
ad identity
ad reload
ad check DOMAIN\Group
ad authorize minecraft status
ad password status
ad password connect
ad password apply
ad password keys
policy status

ad authorize <command> shows the inferred category and whether current policy would allow it.

Program password store (Settings)

All program passwords (MySQL, FTP, computer, Whisper, LLM, SMTP, WordPress, MyBB, Google Speech key)

can be resolved through Active Directory–backed storage instead of plaintext settings.txt.

Resolution order

1. Windows Credential Manager target AugmentedIntelligence/<key>
2. GPO / registry under Software\Policies\AugmentedIntelligence\Secrets\<key> 

   (or Secret.<key> on the policy key)

• Environment AI_SECRET_<KEY_UPPER> (e.g. AI_SECRET_MYSQL_PASSWORD)
• Local settings.txt / in-memory value (if not the @AD placeholder)

Settings toggles

[text]
ad_password_store_enabled=true
ad_password_require_domain=false
ad_password_redact_settings_file=true

When redaction is on, settings.txt writes @AD for secrets so plaintext is not on disk.

Settings menus (MySQL / FTP / Computer / Whisper) call _Settings::SetProgramPassword, which

writes Credential Manager and updates the runtime global.

Computer Settings menu: items 14–18 manage the AD password store.

Backward Compatibility

The previous local settings still work:

[text]
ad_group_requirement_enabled=true
required_ad_domain_group=AugmentedIntelligence_Operators
required_ad_domain=

GPO values are applied on top of those settings.

---

Filed under: Uncategorized - @ July 18, 2026 6:31 am