Create, compare, and share OSConfig security baselines—before changing a device. Start with a Microsoft baseline or your own settings, review them visually, and export a baseline or review report. No CLI, administrator access, or Azure subscription is needed for authoring.
Experimental, community-maintained, and provided as-is. ConfigForge is not an officially supported Microsoft product and is not intended for production use. Use it for learning and evaluation at your own risk. Support boundaries
Download releases · Documentation · First baseline walkthrough
| Your computer | Download | What you can do |
|---|---|---|
| Windows or Linux (x64) | Full — v0.3.104 | Author, validate, compare, and export. Optional local Deploy, Audit, and Revert require the separately installed oscfg CLI. |
| macOS on Apple Silicon (M1 or later) | Author — mac-v0.3.104-author.1 | The same authoring and review workflows, including Audit Pack export; no device operations. ARM64 only—not Intel or universal. |
Both releases are prereleases. Full-edition package versions are 0.3.104;
the macOS Author package version is 0.3.104-author.1.
Downloads are unsigned; macOS builds are also not notarized. Download only from this repository's release page, compare the asset's SHA-256 with the published checksum, and follow your organization's software policy. Checksums check file integrity, not publisher identity or safety. Do not disable SmartScreen or Gatekeeper globally. See installation and download warnings before opening an installer. Building from reviewed source is another option, not a safety guarantee.
A baseline is a set of desired settings. A manifest is the YAML or JSON document that describes those settings. Register means save a baseline to your ConfigForge workspace—not apply it to a device.
- Install and open the edition for your computer. If the Welcome dialog appears, choose Author baselines anywhere.
- Open Microsoft Baselines, choose a baseline to explore, and select Use as Template.
- Give your copy a unique name, review its settings in Visual or Code, and select Register Baseline.
- Open it from My Baselines and choose Export → YAML to save a portable copy.
Success: your baseline appears in My Baselines and you have an exported
.osc.yaml file. You have not deployed or audited anything. A Full-edition
Editor mode, CLI not installed indicator is expected and does not block
this workflow.
For screenshots, alternative starting points, and a small YAML example, follow Your first baseline.
| Your goal | Guide | Extra requirements |
|---|---|---|
| Edit settings or import YAML, JSON, CSV, or XLSX | Baseline editor | None for authoring |
| Compare two baselines or a matrix of up to ten | Diff | None |
| Map settings to a benchmark | Benchmark Mapping | Your own legally licensed benchmark data; CIS data is not bundled |
| Record why settings changed | Rationale and history | None |
| Export a PDF or Markdown review report | Audit Pack | Uses available saved data; does not run a device Audit |
| Evaluate a local lab device | Authoring vs deploying | Full edition, matching Windows/Linux host, CLI, and appropriate privileges |
| Evaluate a baseline through Azure Policy | Machine Configuration | Separate packaging environment and Azure permissions |
Benchmark coverage is not proof of device compliance. A mapped setting
does not establish that its value is correct or that a device uses it. An
Audit Pack is an exported report; Audit checks a device through oscfg.
Missing or old device results must not be presented as a current audit.
Screenshots illustrate the workflows; exact layout varies by release and edition. Device controls shown in Full-edition screenshots are absent on macOS.
Explore the editor, comparison, and report screenshots
Browse Windows Server role baselines, Defender, LAPS, Secured Core, and the Linux Security Baseline. Use as Template creates your own editable copy.
Start a baseline, browse Microsoft Baselines, or compare existing work. The Full edition also surfaces CLI and device health.
Search and filter baselines, open persistent tabs, and compare selected items. Unsaved-edit prompts help protect work when closing a tab or navigating away.
Review Code or Visual views, edit settings, and export your work.
Edit cells, add supported setting types, or remove selected rows. Nested Test/Group structure, typed values, and exact QWord integers are preserved.
Export PDF or Markdown from saved baseline, history, and available review data. No device audit is performed when generating the report.
Start a custom Windows/Linux baseline, choose a template, import a baseline file, import a spreadsheet, or load a public URL.
Two selected baselines open Pairwise; three through ten open Matrix. The CIS view requires user-supplied benchmark data.
Use the data folder shown in Benchmark Mapping, then re-check the catalog. See the data setup guide.
The percentage measures unique benchmark rules covered by matching settings, not device compliance or certification.
The native oscfg
CLI is not bundled. It is separate from the PowerShell modules used for
Machine Configuration packaging. The targeted CLI is oscfg 1.3.9-preview11;
see INSTALL.md for setup.
Start with Audit on a disposable, matching-platform device. Enforce changes settings; Revert is not a substitute for a machine backup. On Windows, the preview CLI requires elevation even for Audit. Authoring does not.
This is an advanced, optional workflow, not a prerequisite for using the app:
ConfigForge baseline → MOF → resolved MOF → Machine Configuration ZIP → Azure Storage → generated policy JSON → policy definition → assignment
On the packaging machine, New-GuestConfigurationPackage needs the
Microsoft.OSConfig PowerShell module version 1.4.10 or later to bundle the
OSConfig DSC resource. Install it with
Install-Module -Name Microsoft.OSConfig -MinimumVersion 1.4.10.
This is a module version, not a PowerShell runtime version. PowerShell 7
and the separate GuestConfiguration packaging toolkit are also required.
The complete Machine Configuration guide
checks for a qualifying installed module, binds the exported
ModuleVersion = "0.0.0" placeholder to that exact version, and creates an
Audit-first package. Keep each ZIP and its URI immutable after policy
generation: the policy contains the package hash. Test the baseline and
module combination; the minimum version is not a claim that every OSConfig
issue is resolved. Module release
Source builds are optional. Follow Build from source for the separate Full and macOS Author commands and the supported Node toolchain. You do not need Node.js to run a downloaded desktop build.
See desktop packaging for platform-specific commands, build-host requirements, and smoke checks. Full Linux installer builds require Linux; macOS Author builds require Apple Silicon.
The desktop app uses Electron, React, Fluent UI, and Vite. Its shared core
lives in packages/core; the documentation site lives in docs.
See the system overview and
module map for developer details.
- Documentation site and source navigation.
- Troubleshooting, support, and privacy.
- Developer references: design contract, platform UX, packaging, and CI/release workflow.
See CONTRIBUTING.md and AGENTS.md for ownership, active-branch, review, release, and cherry-pick guidance. Report reproducible bugs through GitHub Issues; include the edition, version, OS, and a minimal non-sensitive example.
See CHANGELOG.md for detailed historical validation and the documentation changelog for a shorter summary. Past module-version validation records are not current packaging prerequisites.
This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.
To report a security vulnerability, follow SECURITY.md. Do not file security issues as public GitHub issues. ConfigForge does not collect telemetry; see PRIVACY.md.
Licensed under the MIT License. Third-party components are described in NOTICE and THIRDPARTYNOTICES.md.
This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.