Docs / AugmentedIntelligence Enterprise Policy

AugmentedIntelligence Enterprise Policy

AugmentedIntelligence reads enterprise policy from:

HKLM\Software\Policies\AugmentedIntelligence
HKCU\Software\Policies\AugmentedIntelligence

Computer policy is read first. User policy is read second unless DisableUserOverride=1 is set under HKLM.

Group Policy Template

Copy these files to a domain Central Store or a local policy definitions folder:

enterprise\admx\AugmentedIntelligence.admx
enterprise\admx\en-US\AugmentedIntelligence.adml

Typical Central Store target:

\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\AugmentedIntelligence.admx
\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\en-US\AugmentedIntelligence.adml

Then open Group Policy Management Editor and configure:

Computer Configuration or User Configuration
  Administrative Templates
    AugmentedIntelligence

Policy Values

Registry value	Type	Effect
`EnableAugmentedIntelligence`	`REG_DWORD`	`0` disables startup and command execution.
`RequireDomainJoined`	`REG_DWORD`	`1` requires an AD domain user context.
`DisableUserOverride`	`REG_DWORD`	HKLM only. `1` ignores HKCU policy values.
`RequiredADGroups`	`REG_SZ` or `REG_MULTI_SZ`	Semicolon-separated AD security groups. User must be in at least one.
`FullAccessADGroups`	`REG_SZ` or `REG_MULTI_SZ`	Operators — members may run all command categories (bypass allow-list).
`AllowedCommandCategories`	`REG_SZ` or `REG_MULTI_SZ`	If empty or `*`/`all`/`full`, all categories. Else only listed categories.
`BlockedCommandCategories`	`REG_SZ` or `REG_MULTI_SZ`	Always deny these categories.
`LogAllowedCommands`	`REG_DWORD`	`1` logs allowed command decisions.
`LogDeniedCommands`	`REG_DWORD`	`1` logs denied command decisions.
`CentralLogPath`	`REG_SZ`	Full log file path, or directory ending in `\`.

Feature gate values are REG_DWORD where 0 disables the category and 1 enables it:

EnableLLM
EnableCloudLLM
EnableWindowsAutomation
EnableMinecraft
EnableROS
EnableIRC
EnableWordPress
EnableOsTicket
EnableNetworking
EnableRemoteCommands
EnableDeveloperTools
EnableSettings
EnableAutomation
EnableGaming
EnableDatabase
EnableFileEditor
EnableSpeech
EnablePerception
EnableMemory

Command Categories

Use these names in AllowedCommandCategories and BlockedCommandCategories:

llm; windows; minecraft; ros; irc; wordpress; osticket; network; remote;
developer; settings; automation; gaming; database; file; speech; perception;
memory; enterprise; safety; general

Emergency shutdown and ad/policy status commands remain reachable.

Full access to all commands (operators)

To let an AD security group run every typed command (minecraft, llm, nn, settings, …):

1. Create an AD group (example)

AugmentedIntelligence_Operators

Add domain users who should have full _AI command access.

2. GPO / registry (recommended)

HKLM\Software\Policies\AugmentedIntelligence
  EnableAugmentedIntelligence = 1
  RequireDomainJoined         = 1
  RequiredADGroups            = CONTOSO\AugmentedIntelligence_Operators
  FullAccessADGroups          = CONTOSO\AugmentedIntelligence_Operators
  AllowedCommandCategories    = *          ; optional; empty also means all

Or leave AllowedCommandCategories empty and put operators only in FullAccessADGroups.

3. Local settings (no GPO)

In settings.txt / MySQL settings:

ad_group_requirement_enabled=true
required_ad_domain_group=CONTOSO\AugmentedIntelligence_Operators

When that is set, the same group is also treated as a full-access group unless GPO overrides FullAccessADGroups.

4. Environment

set AI_FULL_ACCESS_AD_GROUPS=CONTOSO\AugmentedIntelligence_Operators

5. Verify

ad identity
ad full-access
ad authorize minecraft dqn status
ad authorize nn access map
ad check CONTOSO\AugmentedIntelligence_Operators

full_command_access=yes means the current Windows user may run all categories.

Every typed command is checked in SpeechCommands via _ActiveDirectory::IsCommandAllowed before execution.

Runtime Commands

ad status
ad identity
ad reload
ad check DOMAIN\Group
ad full-access
ad authorize minecraft status
ad password status
ad password connect
ad password apply
ad password keys
policy status

ad authorize <command> shows the inferred category and whether current policy would allow it.
ad full-access reports whether the user is in an operators / FullAccessADGroups group.

Program password store (Settings)

All program passwords (MySQL, FTP, computer, Whisper, LLM, SMTP, WordPress, MyBB, Google Speech key) can be resolved through Active Directory–backed storage instead of plaintext settings.txt.

Resolution order

Windows Credential Manager target AugmentedIntelligence/<key>
GPO / registry under Software\Policies\AugmentedIntelligence\Secrets\<key>
(or Secret.<key> on the policy key)
Environment AI_SECRET_<KEY_UPPER> (e.g. AI_SECRET_MYSQL_PASSWORD)
Local settings.txt / in-memory value (if not the @AD placeholder)

Settings toggles

ad_password_store_enabled=true
ad_password_require_domain=false
ad_password_redact_settings_file=true

When redaction is on, settings.txt writes @AD for secrets so plaintext is not on disk. Settings menus (MySQL / FTP / Computer / Whisper) call _Settings::SetProgramPassword, which writes Credential Manager and updates the runtime global.

Computer Settings menu: items 14–18 manage the AD password store.

Backward Compatibility

The previous local settings still work:

ad_group_requirement_enabled=true
required_ad_domain_group=AugmentedIntelligence_Operators
required_ad_domain=

GPO values are applied on top of those settings.

Generated from the project markdown docs on 2026-07-24. This is a static, self-contained site.