fix: make all Windows baselines enforceable

AGENTS.md

@@ -19,12 +19,12 @@ The following release references were verified on 2026-08-06:
 
 | Line | Reference | State |
 |---|---|---|
-| `main` | `v0.3.102` | Current Windows/Linux release. It fixes pre-deploy Audit compatibility with OSConfig 1.4.3 single-resource array responses. |
+| `main` | `v0.3.103` | Current Windows/Linux release. All 12 Windows Server role baselines pass native Azure Audit and ApplyAndAutoCorrect with OSConfig 1.4.3. |
 | `mac-author-build` | `mac-v0.3.101-author.1` | Current author-only macOS release, published as a prerelease with the compatible baseline, authoring, packaging, and security fixes. |
 
 On `mac-author-build`, the root package, desktop package, and lockfile records
 use `0.3.101-author.1`. The current macOS Author release is
-`mac-v0.3.101-author.1`. The Full-edition package versions are `0.3.102`; do not copy
+`mac-v0.3.101-author.1`. The Full-edition package versions are `0.3.103`; do not copy
 macOS package metadata to `main`.
 
 ### Current feature inventory

CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.3.103] - 2026-08-09
+
+### Fixed
+
+- Make every bundled Windows Server baseline safe for Machine Configuration
+  enforcement with Microsoft.OSConfig 1.4.3. Windows Server 2016 and 2019
+  account-policy controls now use the same non-mutating Test wrappers as the
+  repaired 2022 profiles, controls without an authoritative value are
+  informational instead of permanently noncompliant, 2022 domain firewall
+  defaults accept the effective unset state, and role-managed 2025 NTP state
+  is informational.
+- Validate all 12 role baselines on native Azure Server 2016, 2019, 2022, and
+  2025 VMs. Every Audit report has its exact expected resource count and zero
+  unread entries; ApplyAndAutoCorrect finishes Compliant with zero remaining
+  noncompliant resources and changes the regression probe from `0` to `1`.
+
 ## [0.3.102] - 2026-08-08
 
 ### Fixed

INSTALL.md

@@ -8,9 +8,9 @@ ConfigForge has two editions:
   and Audit Pack export are available. Device Deploy, Audit, and Revert are
   intentionally omitted.
 
-The current Windows/Linux release is `v0.3.102`. The current macOS Author
+The current Windows/Linux release is `v0.3.103`. The current macOS Author
 release is `mac-v0.3.101-author.1`; both are published as prereleases. The
-package versions are `0.3.102` for the Full edition and `0.3.101-author.1`
+package versions are `0.3.103` for the Full edition and `0.3.101-author.1`
 for the macOS Author edition.
 
 ConfigForge does **not** bundle the OSConfig CLI. To use the Full edition's Deploy, Audit, or Revert features against a real Windows or Linux machine, install `oscfg` separately from its upstream source.

README.md

@@ -6,9 +6,9 @@
 
 > The `oscfg` binary is **not** bundled. Editor, Microsoft Baselines, Diff, Benchmark Mapping, and Audit Pack PDF/Markdown export all work without it, including in the macOS Author edition. Deploy, device Audit, and Revert require the Full edition and the CLI. See [`INSTALL.md`](./INSTALL.md) for platform-by-platform install steps.
 
-The current Windows/Linux release is `v0.3.102`. The current macOS Author
+The current Windows/Linux release is `v0.3.103`. The current macOS Author
 release is `mac-v0.3.101-author.1`; both are published as prereleases. The
-package versions are `0.3.102` for the Full edition and `0.3.101-author.1`
+package versions are `0.3.103` for the Full edition and `0.3.101-author.1`
 for the macOS Author edition.
 
 ## Export to Azure Machine Configuration
@@ -250,7 +250,8 @@ is not a universal binary.
 
 | Version | Highlights |
 |---|---|
-| **0.3.102** (current Windows/Linux release) | Fixes pre-deploy Audit with OSConfig 1.4.3 so single-resource CSP, Registry, Test, and User Rights reads are evaluated instead of reported as indeterminate |
+| **0.3.103** (current Windows/Linux release) | Makes all 12 Windows Server role baselines enforceable with OSConfig 1.4.3 and validates exact-count Audit plus fully compliant ApplyAndAutoCorrect on native Azure VMs |
+| **0.3.102** (prior Windows/Linux release) | Fixes pre-deploy Audit with OSConfig 1.4.3 so single-resource CSP, Registry, Test, and User Rights reads are evaluated instead of reported as indeterminate |
 | **0.3.101** (prior Windows/Linux release) | Clears the remaining GitHub security alerts with patched DOMPurify, fast-uri, ip-address, React Router, and Undici releases |
 | **0.3.100** (prior Windows/Linux release) | Updates js-yaml to the patched 4.3.1 release for `GHSA-5p4m-2wfm-xmqj` |
 | **0.3.99** (prior Windows/Linux release) | Verifies Enforce results, preserves exact QWords, keeps Revert safe, repairs WS2022 readability, and adds Machine Configuration Set compatibility |

SECURITY.md

@@ -6,7 +6,7 @@ Security fixes are evaluated for the current tagged source lines.
 
 | Edition | Current version | Security updates |
 | --- | --- | --- |
-| Full edition for Windows and Linux | `v0.3.102` | Supported published prerelease |
+| Full edition for Windows and Linux | `v0.3.103` | Supported published prerelease |
 | macOS Author edition | `mac-v0.3.101-author.1` | Supported published prerelease |
 | Older versions | Earlier tags | Not supported |
 

apps/desktop/PACKAGING.md

@@ -9,7 +9,7 @@
 > flavor lives on the `mac-author-build` branch and uses its own
 > `electron-builder.author.yml`.
 >
-> **Current through v0.3.102:** the release pipeline generates a
+> **Current through v0.3.103:** the release pipeline generates a
 > CycloneDX SBOM per platform, enforces
 > `npm audit --omit=dev --audit-level=high` as a release gate,
 > pins `electron-builder` invocation via `npx --no-install`, and

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@configforge/desktop",
-  "version": "0.3.102",
+  "version": "0.3.103",
   "private": true,
   "description": "ConfigForge \u2014 OSConfig Baseline Editing tool",
   "main": "./dist/electron/main.js",

apps/desktop/src/data/windows-baseline-enforceability.test.ts

@@ -0,0 +1,126 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+import { describe, expect, it } from "vitest";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import yaml from "js-yaml";
+
+interface OscResource {
+  name: string;
+  type: string;
+  properties?: {
+    value?: unknown;
+    expression?: string;
+    template?: string;
+    resource?: {
+      type?: string;
+      properties?: Record<string, unknown>;
+    };
+  };
+}
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const BASELINE_DIR = path.resolve(HERE, "../../../../public/_baselines");
+const LEGACY_PROFILES = [
+  ["ws2016-domain-controller.osc.yaml", 13],
+  ["ws2016-domain-member.osc.yaml", 13],
+  ["ws2016-workgroup-member.osc.yaml", 9],
+  ["ws2019-domain-controller.osc.yaml", 13],
+  ["ws2019-domain-member.osc.yaml", 13],
+  ["ws2019-workgroup-member.osc.yaml", 9],
+] as const;
+const WINDOWS_PROFILES = [
+  ...LEGACY_PROFILES.map(([file]) => file),
+  "ws2022-domain-controller.osc.yaml",
+  "ws2022-domain-member.osc.yaml",
+  "ws2022-workgroup-member.osc.yaml",
+  "ws2025-domain-controller.osc.yaml",
+  "ws2025-member-server.osc.yaml",
+  "ws2025-workgroup-member.osc.yaml",
+];
+const INFORMATIONAL_TEMPLATE =
+  "The value {value} is informational for this control.";
+const FIREWALL_DEFAULT_EXPRESSION =
+  "((((value == 1)) || ((value == null))))";
+const FIREWALL_DEFAULT_TEMPLATE =
+  "The value {value} must be one of 1, (not set).";
+
+function readResources(file: string): OscResource[] {
+  const document = yaml.load(
+    readFileSync(path.join(BASELINE_DIR, file), "utf8"),
+  ) as { resources?: OscResource[] };
+  return document.resources ?? [];
+}
+
+function findResource(resources: OscResource[], name: string): OscResource {
+  const resource = resources.find((candidate) => candidate.name === name);
+  expect(resource, name).toBeDefined();
+  return resource!;
+}
+
+describe("Windows baseline enforceability", () => {
+  it.each(WINDOWS_PROFILES)(
+    "%s has no direct AccountPolicy or null-valued direct resources",
+    (file) => {
+      const resources = readResources(file);
+      expect(
+        resources.filter(
+          (resource) => resource.type === "Microsoft.Windows/AccountPolicy",
+        ),
+      ).toEqual([]);
+      expect(
+        resources.filter(
+          (resource) =>
+            resource.type !== "Microsoft.OSConfig/Test" &&
+            resource.type !== "Microsoft.OSConfig/Group" &&
+            resource.properties !== undefined &&
+            Object.hasOwn(resource.properties, "value") &&
+            resource.properties.value === null,
+        ),
+      ).toEqual([]);
+    },
+  );
+
+  it.each(LEGACY_PROFILES)(
+    "%s wraps all %i account-policy controls as Tests",
+    (file, expectedCount) => {
+      const resources = readResources(file);
+      const accountPolicyTests = resources.filter(
+        (resource) =>
+          resource.type === "Microsoft.OSConfig/Test" &&
+          resource.properties?.resource?.type ===
+            "Microsoft.Windows/AccountPolicy",
+      );
+      expect(accountPolicyTests).toHaveLength(expectedCount);
+    },
+  );
+
+  it.each([
+    "ws2022-domain-controller.osc.yaml",
+    "ws2022-domain-member.osc.yaml",
+  ])("%s accepts the effective default firewall inbound action", (file) => {
+    const resources = readResources(file);
+    for (const name of [
+      "FirewallDomainProfileInboundConnection",
+      "FirewallPrivateProfileInboundConnection",
+      "FirewallPublicProfileInboundConnection",
+    ]) {
+      const resource = findResource(resources, name);
+      expect(resource.properties?.expression).toBe(
+        FIREWALL_DEFAULT_EXPRESSION,
+      );
+      expect(resource.properties?.template).toBe(FIREWALL_DEFAULT_TEMPLATE);
+    }
+  });
+
+  it.each([
+    "ws2025-domain-controller.osc.yaml",
+    "ws2025-member-server.osc.yaml",
+  ])("%s treats role-managed NTP client state as informational", (file) => {
+    const resource = findResource(readResources(file), "EnabledNTPClient");
+    expect(resource.properties?.expression).toBe("true");
+    expect(resource.properties?.template).toBe(INFORMATIONAL_TEMPLATE);
+  });
+});

docs/src/changelog.md

@@ -6,6 +6,18 @@ foundational work by theme.
 
 ## Unreleased
 
+## v0.3.103 - 2026-08-09
+
+- **Windows baseline enforcement compatibility:** Windows Server 2016 and
+  2019 account-policy controls now use safe Test wrappers, controls without an
+  authoritative value are informational, Windows Server 2022 domain firewall
+  defaults accept the effective unset state, and role-managed Windows Server
+  2025 NTP state is informational.
+- **Full Azure validation:** All 12 Windows Server role baselines pass native
+  Azure Machine Configuration Audit and ApplyAndAutoCorrect with exact
+  resource counts, zero unread entries, and zero remaining noncompliance on
+  Microsoft.OSConfig 1.4.3.
+
 ## v0.3.102 - 2026-08-08
 
 - **OSConfig 1.4.3 audit compatibility:** Pre-deploy Audit now unwraps the

docs/src/introduction.md

@@ -20,9 +20,9 @@ application** with two editions:
   and elevation methods under `system`) are intentionally omitted. Authors
   deploy later from the Full edition on Windows or Linux.
 
-The current Windows/Linux release is `v0.3.102`. The current macOS Author
+The current Windows/Linux release is `v0.3.103`. The current macOS Author
 release is `mac-v0.3.101-author.1`; both are published as prereleases. The
-package versions are `0.3.102` for the Full edition and `0.3.101-author.1`
+package versions are `0.3.103` for the Full edition and `0.3.101-author.1`
 for the macOS Author edition.
 
 If you've ever maintained a security baseline by editing GPO templates, exporting Defender for Endpoint settings to a spreadsheet, or copy-pasting between half a dozen runbooks - this app is for you.

docs/src/quick-start/install-run.md

@@ -8,9 +8,9 @@ Benchmark Mapping, history, rationale, and Audit Pack export while omitting
 device operations. The native `oscfg` CLI is **not bundled** and is **not
 required** for authoring in either edition.
 
-The current Windows/Linux release is `v0.3.102`. The current macOS Author
+The current Windows/Linux release is `v0.3.103`. The current macOS Author
 release is `mac-v0.3.101-author.1`; both are published as prereleases. The
-package versions are `0.3.102` for the Full edition and `0.3.101-author.1`
+package versions are `0.3.103` for the Full edition and `0.3.101-author.1`
 for the macOS Author edition.
 
 ## Prerequisites

package.json

@@ -1,6 +1,6 @@
 {
   "name": "configforge",
-  "version": "0.3.102",
+  "version": "0.3.103",
   "private": true,
   "license": "MIT",
   "description": "ConfigForge \u2014 Cross-platform Electron desktop app for OSConfig security baseline authoring",