Windows Fleet Configuration Deployment

Deploy ntkDrive configs at scale. Zero margin for error.

Schema-driven profiles. Fail-closed preflight. Audit-logged rollouts across thousands of Windows devices.

Download for Windows Read the Docs
Fail-Closed Deploy Gate Local-Only · No Cloud mTLS + ABAC Enforced
Status Report Live 


              
              
            

          


          
          

            

              

                
                ntkdeploy.status
              

              
gate_status: connected
preflight:   pass
snapshot:    verified

            

          


        

      

    


    
    

      


        

          

            Everything an administrator needs.
          

        


        


          

            
Schema-driven Profiles

            

              Build ntkDrive configurations in a validated form editor with
              live JSON preview. Version history and side-by-side diff included.
            

          


          

            
Deployment Wizard

            

              Multi-step guided rollout. Preflight gates, snapshot verification,
              and per-device status tracking through every phase.
            

          


          

            
Fail-Closed Gate

            

              Connectivity gate + ownership mapping + preflight + snapshot —
              all four must pass before a single byte is written to any device path.
            

          


          

            
ABAC Policy Enforcement

            

              Integrates with Policy Manager V2 via mTLS. Attribute-based
              access control baked into every deployment artifact via
              deterministic snapshots.
            

          


          

            
People & Enrollment

            

              Device ownership registry with approval workflow. Approve or
              reject enrollment requests. Bulk ownership import via CSV.
            

          


          

            
Audit Log

            

              Append-only deployment history. Every action traced: who, what,
              when, which devices, which policy snapshot was in effect.
            

          


        

      

    


    
    

      


        

          
How it works.

        


        


          

            
01

            
Create a Profile

            

              Build a configuration profile using the schema editor.
              The live JSON preview shows the exact payload that will reach devices.
            

          


          

          

            
02

            
Assign & Preflight

            

              Assign the profile to a device group. The deploy gate verifies
              policy connectivity, device ownership, preflight, and snapshot
              before enabling deployment.
            

          


          

          

            
03

            
Deploy & Audit

            

              Each UNC target receives an artifact backed by a deterministic
              policy snapshot. Every outcome is logged with a full audit trace.
            

          


        


        

          Detailed architecture
        


      

    


    
    

      

        


          

            

              Fail-closed by design.
            

            

              ntkDeploy blocks deployment unless all four verification layers pass:
              connectivity gate, device ownership, preflight bulk verify, and snapshot
              retrieval. No partial writes. No silent failures.
            

            Read the security model
          


          

            

              

                
                deploy_gate.check
              

              
gate_check:  /capabilities → pass
             /readyz       → pass
ownership:   all_paths_assigned
preflight:   no_blocking_findings
snapshot:    hash_verified
─────────────────────────────────────
status:      DEPLOY ENABLED

            

          


        

      

    


    
    

      

        

          

            Built for Windows. Deployed as MSIX.
          

          

            Self-signed fleet deployment via GPO, Intune, or SCCM.
            CA-signed packages available for unmanaged installs.
          

          
            Download for Windows
          
          

            Flutter 3.35 · Windows 10/11 · Local SQLite · No cloud dependency