{"id":1978,"date":"2026-07-18T06:31:39","date_gmt":"2026-07-18T13:31:39","guid":{"rendered":"http:\/\/macdaddy4sure.ai\/?p=1978"},"modified":"2026-07-18T06:31:39","modified_gmt":"2026-07-18T13:31:39","slug":"augmentedintelligence-enterprise-policy","status":"publish","type":"post","link":"http:\/\/macdaddy4sure.ai\/index.php\/2026\/07\/18\/augmentedintelligence-enterprise-policy\/","title":{"rendered":"AugmentedIntelligence Enterprise Policy"},"content":{"rendered":"\n

AugmentedIntelligence reads enterprise policy from:<\/p>\n\n\n\n

[text]
<\/em>HKLM\\Software\\Policies\\AugmentedIntelligence
HKCU\\Software\\Policies\\AugmentedIntelligence<\/p>\n\n\n\n

Computer policy is read first. User policy is read second unless DisableUserOverride=1 is set under HKLM.<\/p>\n\n\n\n

Group Policy Template<\/h2>\n\n\n\n

Copy these files to a domain Central Store or a local policy definitions folder:<\/p>\n\n\n\n

[text]
<\/em>enterprise\\admx\\AugmentedIntelligence.admx
enterprise\\admx\\en-US\\AugmentedIntelligence.adml<\/p>\n\n\n\n

Typical Central Store target:<\/p>\n\n\n\n

[text]
<\/em>\\\\<domain>\\SYSVOL\\<domain>\\Policies\\PolicyDefinitions\\AugmentedIntelligence.admx
\\\\<domain>\\SYSVOL\\<domain>\\Policies\\PolicyDefinitions\\en-US\\AugmentedIntelligence.adml<\/p>\n\n\n\n

Then open Group Policy Management Editor and configure:<\/p>\n\n\n\n

[text]
<\/em>Computer Configuration or User Configuration
  Administrative Templates
    AugmentedIntelligence<\/p>\n\n\n\n

Policy Values<\/h2>\n\n\n\n
Registry value<\/strong><\/td>Type<\/strong><\/td>Effect<\/strong><\/td><\/tr>
EnableAugmentedIntelligence<\/td>REG_DWORD<\/td>0 disables startup and command execution.<\/td><\/tr>
RequireDomainJoined<\/td>REG_DWORD<\/td>1 requires an AD domain user context.<\/td><\/tr>
DisableUserOverride<\/td>REG_DWORD<\/td>HKLM only. 1 ignores HKCU policy values.<\/td><\/tr>
RequiredADGroups<\/td>REG_SZ or REG_MULTI_SZ<\/td>Semicolon-separated AD security groups. User must be in at least one.<\/td><\/tr>
AllowedCommandCategories<\/td>REG_SZ or REG_MULTI_SZ<\/td>If populated, only these categories can run.<\/td><\/tr>
BlockedCommandCategories<\/td>REG_SZ or REG_MULTI_SZ<\/td>Always deny these categories.<\/td><\/tr>
LogAllowedCommands<\/td>REG_DWORD<\/td>1 logs allowed command decisions.<\/td><\/tr>
LogDeniedCommands<\/td>REG_DWORD<\/td>1 logs denied command decisions.<\/td><\/tr>
CentralLogPath<\/td>REG_SZ<\/td>Full log file path, or directory ending in \\.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Feature gate values are REG_DWORD where 0 disables the category and 1 enables it:<\/p>\n\n\n\n

[text]
<\/em>EnableLLM
EnableCloudLLM
EnableWindowsAutomation
EnableMinecraft
EnableROS
EnableIRC
EnableWordPress
EnableOsTicket
EnableNetworking
EnableRemoteCommands
EnableDeveloperTools
EnableSettings
EnableAutomation
EnableGaming
EnableDatabase
EnableFileEditor
EnableSpeech
EnablePerception
EnableMemory<\/p>\n\n\n\n

Command Categories<\/h2>\n\n\n\n

Use these names in AllowedCommandCategories and BlockedCommandCategories:<\/p>\n\n\n\n

[text]
<\/em>llm; windows; minecraft; ros; irc; wordpress; osticket; network; remote;
developer; settings; automation; gaming; database; file; speech; perception;
memory; enterprise; safety; general<\/p>\n\n\n\n

Emergency shutdown and ad\/policy status commands remain reachable.<\/p>\n\n\n\n

Runtime Commands<\/h2>\n\n\n\n

[text]
<\/em>ad status
ad identity
ad reload
ad check DOMAIN\\Group
ad authorize minecraft status
ad password status
ad password connect
ad password apply
ad password keys
policy status<\/p>\n\n\n\n

ad authorize <command> shows the inferred category and whether current policy would allow it.<\/p>\n\n\n\n

Program password store (Settings)<\/h2>\n\n\n\n

All program passwords (MySQL, FTP, computer, Whisper, LLM, SMTP, WordPress, MyBB, Google Speech key)<\/p>\n\n\n\n

can be resolved through Active Directory\u2013backed storage instead of plaintext settings.txt.<\/p>\n\n\n\n

Resolution order<\/h3>\n\n\n\n
    \n
  1. Windows Credential Manager<\/strong> target AugmentedIntelligence\/<key><\/li>\n\n\n\n
  2. GPO \/ registry<\/strong> under Software\\Policies\\AugmentedIntelligence\\Secrets\\<key>\u00a0<\/li>\n<\/ol>\n\n\n\n

       (or Secret.<key> on the policy key)<\/p>\n\n\n\n

      \n
    • Environment<\/strong> AI_SECRET_<KEY_UPPER> (e.g. AI_SECRET_MYSQL_PASSWORD)<\/li>\n\n\n\n
    • Local<\/strong> settings.txt \/ in-memory value (if not the @AD placeholder)<\/li>\n<\/ul>\n\n\n\n

      Settings toggles<\/h3>\n\n\n\n

      [text]
      <\/em>ad_password_store_enabled=true
      ad_password_require_domain=false
      ad_password_redact_settings_file=true<\/p>\n\n\n\n

      When redaction is on, settings.txt writes @AD for secrets so plaintext is not on disk.<\/p>\n\n\n\n

      Settings menus (MySQL \/ FTP \/ Computer \/ Whisper) call _Settings::SetProgramPassword, which<\/p>\n\n\n\n

      writes Credential Manager and updates the runtime global.<\/p>\n\n\n\n

      Computer Settings menu: items 14\u201318<\/strong> manage the AD password store.<\/p>\n\n\n\n

      Backward Compatibility<\/h2>\n\n\n\n

      The previous local settings still work:<\/p>\n\n\n\n

      [text]
      <\/em>ad_group_requirement_enabled=true
      required_ad_domain_group=AugmentedIntelligence_Operators
      required_ad_domain=<\/p>\n\n\n\n

      GPO values are applied on top of those settings.<\/p>\n","protected":false},"excerpt":{"rendered":"

      AugmentedIntelligence reads enterprise policy from: [text]HKLM\\Software\\Policies\\AugmentedIntelligenceHKCU\\Software\\Policies\\AugmentedIntelligence Computer policy is read first. User policy is read second unless DisableUserOverride=1 is set under HKLM. Group Policy Template Copy these files to a domain Central Store or a local policy definitions folder: [text]enterprise\\admx\\AugmentedIntelligence.admxenterprise\\admx\\en-US\\AugmentedIntelligence.adml Typical Central Store target: [text]\\\\<domain>\\SYSVOL\\<domain>\\Policies\\PolicyDefinitions\\AugmentedIntelligence.admx\\\\<domain>\\SYSVOL\\<domain>\\Policies\\PolicyDefinitions\\en-US\\AugmentedIntelligence.adml Then open Group Policy Management Editor and configure: [text]Computer Configuration […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1978","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"http:\/\/macdaddy4sure.ai\/index.php\/wp-json\/wp\/v2\/posts\/1978","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/macdaddy4sure.ai\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/macdaddy4sure.ai\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/macdaddy4sure.ai\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/macdaddy4sure.ai\/index.php\/wp-json\/wp\/v2\/comments?post=1978"}],"version-history":[{"count":1,"href":"http:\/\/macdaddy4sure.ai\/index.php\/wp-json\/wp\/v2\/posts\/1978\/revisions"}],"predecessor-version":[{"id":1979,"href":"http:\/\/macdaddy4sure.ai\/index.php\/wp-json\/wp\/v2\/posts\/1978\/revisions\/1979"}],"wp:attachment":[{"href":"http:\/\/macdaddy4sure.ai\/index.php\/wp-json\/wp\/v2\/media?parent=1978"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/macdaddy4sure.ai\/index.php\/wp-json\/wp\/v2\/categories?post=1978"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/macdaddy4sure.ai\/index.php\/wp-json\/wp\/v2\/tags?post=1978"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}