Skip to main content

Deploy Glean Tau on Windows

Use machine policy to manage Glean Tau preferences, approval choices, and feature availability on Windows. Check the support boundary before applying a policy written for macOS.

Check policy support​

Windows supports policy delivery and a required sandbox, but not managed network confinement. Check which controls Windows supports:

ControlWindows support
Managed app preferencesSupported through verified machine registry policy and server-managed settings
Approval mode restrictionsSupported, including removal of Full access
Feature allowlists and denylistsSupported
Protected device enrollmentSupported
Required process sandboxSupported. Leave danger-full-access out of allowedSandboxModes.
Managed network proxy from permissions.networkNot enforced. The policy doesn't block agent work.
Read denials from permissions.filesystem.denyReadSupported. Commands can't run outside the sandbox while a read denial applies.
Network confinement from networkAccess set to falseUnsupported. Policy validation rejects it.
Administrator policy from the current-user registry or a local JSON fileUnsupported

On Windows, Glean Tau runs sandboxed commands through its Windows sandbox and blocks a command when it can't enforce a filesystem rule. A policy that sets networkAccess to false is rejected on Windows. A managed proxy policy is accepted but not enforced, so commands can still reach destinations outside the allow list. The app doesn't treat an approval-only policy as equivalent protection. Don't use registry delivery as evidence that a command is sandboxed.

Prerequisites​

Before you deploy, complete the following:

  • Obtain the approved Windows Glean Tau installer from your Glean representative and confirm its policy-format support
  • Select the installer for each device architecture
  • Have permission to deploy machine registry policy through Intune, Group Policy, or an equivalent endpoint management service, as described in Deploy machine policy
  • Prepare a standard-user test device for each supported architecture

Confirm the installation context and detection rules for the package you receive. The existing per-user installer is described in Deploy Glean for Desktop for Windows. Verify that those instructions apply to your Glean Tau package before reuse.

Deploy machine policy​

Store the entire administrator JSON document in the following location:

Registry fieldValue
HiveHKEY_LOCAL_MACHINE
KeySOFTWARE\Policies\Glean\Desktop
Value namedesktopSettings
Recommended value typeREG_SZ
Registry view64-bit

For example, deploy this JSON as the value data:

{
  "schemaVersion": 1,
  "enrollment": true,
  "features": {
    "deny": ["computer-use", "browser-use"]
  },
  "settings": {
    "core.authority.requirements": {
      "allowedApprovalPolicies": ["untrusted", "on-request"]
    }
  }
}

Download the Windows policy example. It excludes Full access and two broad interaction features. Because it doesn't restrict allowedSandboxModes, users can still turn off Sandbox Mode. To require sandboxing, add "allowedSandboxModes": ["read-only", "workspace-write"].

Keep the registry value under 1 MiB. REG_EXPAND_SZ and joined REG_MULTI_SZ data are also accepted, but the reader doesn't expand environment variables. Prefer REG_SZ for predictable delivery.

Glean Tau doesn't read HKEY_CURRENT_USER as administrator policy. It doesn't use a C:\ProgramData\Glean\managed-settings.json equivalent of the macOS policy file.

Protect registry ownership and access​

The policy key and its ancestors must have trusted ownership and access control lists (ACLs). Glean Tau accepts ownership and mutation rights for SYSTEM, Administrators, and TrustedInstaller. A standard user must not be able to change the policy.

An unreadable key, unsafe ACL, or malformed JSON can block managed operation. Use your endpoint management service to correct policy access. Running Glean Tau as Administrator isn't a policy repair procedure.

Configure Windows privacy and desktop access​

Windows doesn't use macOS Privacy Preferences Policy Control (PPPC) profiles. Configure microphone, screen capture, and desktop interaction through the Windows controls that apply to your enabled features.

Computer Use operates with the signed-in user's privileges. Elevated windows, protected content, a locked desktop, or endpoint security rules can prevent an operation. Keep Glean Tau running as a standard user. Use an approved administrative workflow for tasks that need elevation.

A privacy grant doesn't override a feature denial. A feature allowance doesn't bypass Windows security controls.

Verify the rollout​

Validate the signed package on real Windows devices:

  1. Confirm the installer architecture and app version.
  2. Confirm the policy is in the 64-bit machine registry view.
  3. Open Glean Tau as a standard user and verify the expected approval choices and managed preferences.
  4. Verify that denied features remain unavailable.
  5. Update policy, restart, and test source recovery and enrollment removal.
  6. Repeat on each architecture you distribute.

For read-only inspection from a command prompt, use:

reg query "HKLM\SOFTWARE\Policies\Glean\Desktop" /v desktopSettings /reg:64

This command confirms stored data, not app acceptance. Treat its output as configuration information and share it only through approved support channels.

See also​

Last updated on
© 2026, Glean Technologies, Inc.
Was this page helpful?
On this page