Go packages for managing Windows 11 devices with the protocols Windows ships: Mobile Device Enrollment Protocol Version 2 (MS-MDE2, with MS-XCEP and MS-WSTEP), OMA Device Management 1.2.1 over SyncML (MS-MDM), the configuration service provider tree described by Microsoft's DDF v2 files, Windows Notification Services push, and Windows declared configuration. The repository also contains a reference server and an operator CLI. It does not provide an inventory UI or a fleet management product.
The root module contains protocol libraries, generated schema types, storage contracts and
in-memory implementations. The server module adds SQL stores, the service layer, HTTP adapters
and application wiring. Both modules require Go 1.27. The compliance target is Windows 11
version 26H2 on the shared 24H2 servicing branch (build 26100.x and later).
Pre-alpha. Phases 0 to 6 of the implementation plan are done:
the workspace, the pinned references, the foundation packages, the SyncML codec, the CSP
schema generated from Microsoft's DDF v2 bundle, MS-MDE2 enrollment with the on-premises
authentication policy, the MS-MDM management session engine (OMA DM packages 1 to 4,
certificate and MD5 authentication, a monotonic command queue with per-command results,
device- and user-scope gating, large-object chunking, unenrollment, and a software client that
runs whole sessions against the engine), and a reference server (dmserver) with an operator
CLI (dmctl) over persistent SQL storage. The API is pre-1.0 and will change.
dmserver is configured entirely from DM_* environment variables. The smallest run uses an
in-memory store, an ephemeral self-signed CA, and accepts any enrollment credentials:
DM_STORE=memory DM_ENROLL_ALLOW_ANY=1 DM_BASE_URL=https://localhost:8443 \
go -C server run ./cmd/dmserverDM_STORE selects sqlite, postgres, mysql or memory; a real store also needs DM_DSN.
Set DM_TLS_CERT and DM_TLS_KEY to terminate TLS, or front the server with a trusted proxy.
The pure-Go build carries every SQL driver, so the container needs no system libraries:
docker build -t dmserver .dmctl inspects and drives a store directly (same DM_STORE/DM_DSN): list enrollments,
queue commands from a file, and read back results and events. Run go -C server run ./cmd/dmctl
for its subcommands.
| Tier | Directories | Responsibility |
|---|---|---|
| foundation | clock, paging, secrets, telemetry, state, ratelimit, testpki |
No domain knowledge |
| schema | schema/csp, schema/csp/<name>, schema/policy/<area>, schema/registry, schema/support, schema/validation; generated by cmd/ddfgen |
CSP node tables and URI constants, registry lookup, build applicability, command validation |
| protocol | mdmprotocol/{syncml,soap,wapprov,enroll,mdm,windc,event,dmhook} |
Wire formats and protocol state machines, no I/O |
| pki | pki/{ca,wstep,xcep,scep,attestation,revocation} |
Identity issuance and verification |
| platform services | msplatformservices/{wns,entra,graph} |
Outbound clients to Microsoft services |
| storage | storage, storage/inmem, storage/storagetest |
Domain contracts, in-memory backend, contract suite |
| client | simulator |
A Windows MDM client in software |
| server | server/... (own module) |
Persistence, orchestration, transport |
| app | server/cmd/{dmserver,dmctl}, server/internal/app, server/e2e, cmd/ddfgen |
Composition, CLI, generator, scenarios |
A package imports its own tier or lower; the library never imports the server module. The rule
is enforced by internal/layout.
make tools # gotestsum, gofumpt, govulncheck, golangci-lint built with this module's Go
make verify # the DDF bundle matches its manifest and schema/ matches regeneration
make generate # regenerate schema/csp, schema/policy and schema/registry
make test # both modules, race detector and coverage
make lint # golangci-lint in both modules
make fuzz-smoke # every fuzz target, briefly
make coverage # 95% overall and per non-exempt package
make ci # all of the above
make specs # download and verify the pinned specifications (network)
make refs # clone the read-only reference implementations (network)The specifications, Microsoft Learn pages, reference implementations and community findings this project is built from are catalogued in docs/research.md; the revisions in force are pinned in decision record 0002.
MIT. See LICENSE. The Microsoft Open Specifications and OMA documents this project implements carry their publishers' own terms; see decision record 0001 for what they permit.