Settlyr

🇮🇹 Italiano · 🇬🇧 English

Windows desktop tool for auditing and enforcing a standard configuration baseline on workstations and servers.

---

What it is

Settlyr is a Windows Swing desktop application that compares the live state of a machine (registry keys, Group Policy entries, local security policy, local user accounts) against a baseline declared in a rule file, highlights the differences (compliant/non-compliant), and — on the operator's request — applies the corrections needed to bring the machine back to the baseline.

It's built for anyone who has to keep many Windows machines (client or server) aligned to a company standard, without manually repeating dozens of checks on the registry, group policies, and local accounts.

What it does, concretely

• Registry and Group Policy audit — reads a rule file (config/polkey.txt) and, for each row, checks the current value in the registry (REG QUERY) or in the user/machine registry.pol (via the PolicyFileEditor PowerShell module), showing the status in a color-coded table (green = compliant, red = non-compliant, orange = other cases).
• Local security policy audit — checks user rights assignments (Se*Privilege/Se*Right) and password/lockout settings (System Access) via the SecurityPolicy PowerShell module, backed by secedit.exe.
• One-click remediation — from the same table, a "Correggi"/"Fix" button applies only the non-compliant rows (registry write, Set-PolicyFileEntry, Set-UserRightsAssignment/Set-SecurityPolicy depending on the rule type), or deletes the key/entry if the rule states it shouldn't exist.
• Standard local user management — compares the machine's local accounts against a declared roster (config/users.txt: name, password, expiry, group, status) and can create the missing users, along with their Windows profile and per-user environment variables (config/EnvVar.txt).
• Password encryption utility — encrypts (AES) a password before it's placed in config/users.txt, so the file never holds plaintext passwords.
• Policy catalog — a browsable, filterable, sortable table with the full Windows 11 25H2 "Administrative Templates" catalog (sourced from a Microsoft Excel sheet), also used to enrich Group Policy rows on the main screen with the official name/category/description.
• Network and log utilities — a sweep of an IP range across TCP ports/ping/ARP to check host reachability, and a log-search engine (by date range, extension, optional recursion and .zip opening) with result export.
• Traceability — every change applied to the machine (registry, policy, security policy, users, environment variables) is logged (Settlyr.log), so what changed, when, and with what outcome can always be reconstructed.

How it works (architecture in brief)

• Java 21 / Swing application with the FlatLaf look-and-feel; built with Maven (also opens directly in NetBeans, which has native Maven support).
• No server-side component or database: it reads its configuration from disk (config/, plain-text/;-separated) and interacts with the operating system by shelling out to cmd.exe/powershell.exe (REG commands, cmdlets from the PolicyFileEditor and SecurityPolicy PowerShell modules, dedicated PowerShell scripts for users/profiles).
• The required PowerShell modules are vendored in the repository (librerie/PSModules/) and loaded directly from that folder (a per-process PSModulePath, no install step or admin-writable system folder needed), without depending on the PowerShell Gallery — this reduces supply-chain risk and the need for internet access on the target machine.
• Two distribution flavors:
• jar + Launch4j (store/Settlyr.jar + Settlyr.exe): requires a JRE 21+ already installed on the target machine.
• standalone via jpackage (dist-standalone/Settlyr/): bundles a Java runtime, no JRE required on the target machine.

Requirements

• Windows (the app shells out to Windows-specific commands: REG, secedit, policy/security-policy PowerShell modules — it does not run, and isn't meant to run, on other operating systems).
• Administrative privileges on the target machine, to read/write the registry, local Group Policy, security policy, and user accounts.
• For the jar+Launch4j distribution: JRE 21 or later already present on the target machine. The jpackage distribution has no such requirement (runtime bundled).

Build

# compile only
mvnw clean compile

# compile and produce the self-executing jar at store/Settlyr.jar
mvnw clean package

# also produce the standalone distribution (bundled runtime) in dist-standalone/Settlyr/
# requires a JDK 14+ providing jpackage on the build machine
mvnw verify -P jpackage-exe

mvnw/mvnw.cmd (Maven Wrapper) download the required Maven version automatically on first run (needs network access once); any locally installed Maven 3.9+ works too.

Configuration

The files an operator hand-edits to define an organization's baseline live in config/:

File	Content
config/polkey.txt	Registry/Group Policy/security policy rules to enforce (;-separated, # comments)
config/users.txt	Standard local user roster (AES-encrypted passwords)
config/EnvVar.txt	Per-user (or global) environment variables to enforce
config/chiave.key	AES key used to encrypt/decrypt the passwords in users.txt (generated automatically on first use, must never be committed)

These three are the actual files the program reads at runtime, but they are not part of this repository: only config/*.example.txt templates are versioned (polkey.example.txt, users.example.txt, EnvVar.example.txt), showing the expected format with placeholder data. To get started, copy each one to its real name (e.g. config/polkey.example.txt → config/polkey.txt) and edit it for your environment — the real files are gitignored, since their content is environment-specific (and, for users.txt, sensitive).

Once prepared, these files must be distributed alongside the executable to every target machine.

📖 Full guide to filling in these files: see CONFIGURAZIONE.en.md. For the codebase's internal conventions, see CLAUDE.md in the repository.

⚠️ Disclaimer / Warnings

Settlyr directly modifies a Windows machine's system configuration: registry, local Group Policy, security policy (secedit), local user accounts, and environment variables. These are potentially destructive operations, and in some cases hard to undo. Before using this tool on production machines, keep the following risks in mind:

• Loss of administrative access: a badly written S rule (UserRights/SystemAccess), or a policy that disables accounts/rights the wrong way, can lock out administrative access to the machine itself, including remotely (RDP included).
• System malfunction: deleting registry values or entire subkeys (the *canc* sentinel, DataType KEY) is irreversible through the application itself; applied to the wrong paths, it can break system services, drivers, or the machine's ability to boot.
• Service disruption: creating/modifying local users, applying password policies (minimum length, complexity, expiry) or lockout policies can block legitimate users' access if the values aren't consistent with the credentials actually in use.
• Delayed, not-immediately-visible effects: the *del* sentinel (PU/PM only — writes the native **del. registry.pol marker) has no effect on the live registry at the moment "Analizza"/"Correggi" ("Analyze"/"Fix") runs, only at the next Windows Group Policy refresh — a mistake can therefore surface long after the tool ran.
• Silent failures: malformed lines in config/polkey.txt (wrong field count) are ignored with no error and no log entry; a config/chiave.key that doesn't match the one used to encrypt config/users.txt produces wrong passwords with no warning.
• Elevated privileges required: the tool needs administrative privileges to work — the same privileges that let it apply corrections also let it damage the machine if the configured rules are wrong.

Good practices before rolling out a rule or user roster to production:

1. Always verify behavior with "Analizza"/"Analyze" (and, if needed, "Correggi"/"Fix") on a non-critical test machine before distributing to production machines.
2. Keep a recent backup (image/snapshot) of the machine before applying bulk corrections.
3. Review config/polkey.txt.bak after every change to see what differs from the previous version.
4. Never distribute a config/chiave.key that's out of sync with the config/users.txt in use: verify that standard users can log in after every deployment.

Limitation of liability. This software is provided "as is", without any express or implied warranty of merchantability, fitness for a particular purpose, or absence of defects. The author(s) of this project accept no responsibility for direct, indirect, incidental, or consequential damages arising from the use, misuse, or inability to use this tool, including — without limitation — data loss, service disruption, loss of access to systems, or any other damage to machines, networks, or infrastructure. Use of Settlyr is at your own risk: it is the user's responsibility to validate every rule in a test environment before applying it to production.

Versioning & releases

The version shown in the window title (Major.Minor.Patch, e.g. 1.00.001) comes from pom.xml and is the single source of truth. Patch increments by 1 automatically before every commit; Major/Minor are bumped by hand only when warranted. See CHANGELOG.md for what changed in each version. Standalone Windows builds are published as GitHub Releases.

Notes

• There are no automated tests (src/test/ is unused).
• The project uses NetBeans .form files for its Swing screens: UI changes should go through the NetBeans GUI builder to keep .form and .java in sync.
• A detailed change history is kept in storico.md.

License

Settlyr is distributed under the MIT License — see LICENSE.

The program includes/vendors a few third-party components (FlatLaf, reload4j, the PolicyFileEditor and SecurityPolicy PowerShell modules) under their own permissive licenses (Apache-2.0/MIT), all compatible with the MIT License — see THIRD-PARTY-NOTICES.md for details and full license texts.