From 8da5d1d3fa040ee4b7ae007ea7cfc2fa30c950ea Mon Sep 17 00:00:00 2001
From: Ludwig Lehnert <ludwig@lehnert.dev>
Date: Mon, 29 Jun 2026 11:37:12 +0000
Subject: [PATCH] add README.md, fix policy definitions

---
 PolicyDefinitions/Softwarekatalog.admx       | 28 +++++++-
 PolicyDefinitions/de-DE/Softwarekatalog.adml | 10 ++-
 PolicyDefinitions/en-US/Softwarekatalog.adml | 10 ++-
 README.md                                    | 67 ++++++++++++++++++++
 4 files changed, 111 insertions(+), 4 deletions(-)
 create mode 100644 README.md

diff --git a/PolicyDefinitions/Softwarekatalog.admx b/PolicyDefinitions/Softwarekatalog.admx
index 13f27d8..9f03546 100644
--- a/PolicyDefinitions/Softwarekatalog.admx
+++ b/PolicyDefinitions/Softwarekatalog.admx
@@ -43,8 +43,32 @@
             <decimal value="0" />
           </falseValue>
         </boolean>
-        <list id="Catalog" key="Software\Policies\STL\Softwarekatalog\Catalog" valuePrefix="Catalog" additive="false" explicitValue="true" />
-        <list id="Required" key="Software\Policies\STL\Softwarekatalog\Required" valuePrefix="Required" additive="false" explicitValue="true" />
+      </elements>
+    </policy>
+    <policy name="Softwarekatalog_Catalog" class="Machine" displayName="$(string.Softwarekatalog_Catalog)" explainText="$(string.Softwarekatalog_Catalog_Help)" key="Software\Policies\STL\Softwarekatalog" valueName="CatalogPolicy" presentation="$(presentation.Softwarekatalog_Catalog)">
+      <parentCategory ref="Softwarekatalog" />
+      <supportedOn ref="windows:SUPPORTED_Windows7" />
+      <enabledValue>
+        <decimal value="1" />
+      </enabledValue>
+      <disabledValue>
+        <decimal value="0" />
+      </disabledValue>
+      <elements>
+        <list id="Catalog" key="Software\Policies\STL\Softwarekatalog\Catalog" valuePrefix="Catalog" additive="false" explicitValue="true" required="false" />
+      </elements>
+    </policy>
+    <policy name="Softwarekatalog_Required" class="Machine" displayName="$(string.Softwarekatalog_Required)" explainText="$(string.Softwarekatalog_Required_Help)" key="Software\Policies\STL\Softwarekatalog" valueName="RequiredPolicy" presentation="$(presentation.Softwarekatalog_Required)">
+      <parentCategory ref="Softwarekatalog" />
+      <supportedOn ref="windows:SUPPORTED_Windows7" />
+      <enabledValue>
+        <decimal value="1" />
+      </enabledValue>
+      <disabledValue>
+        <decimal value="0" />
+      </disabledValue>
+      <elements>
+        <list id="Required" key="Software\Policies\STL\Softwarekatalog\Required" valuePrefix="Required" additive="false" explicitValue="true" required="false" />
       </elements>
     </policy>
   </policies>
diff --git a/PolicyDefinitions/de-DE/Softwarekatalog.adml b/PolicyDefinitions/de-DE/Softwarekatalog.adml
index 18d9ddf..1a81b8e 100644
--- a/PolicyDefinitions/de-DE/Softwarekatalog.adml
+++ b/PolicyDefinitions/de-DE/Softwarekatalog.adml
@@ -6,14 +6,22 @@
     <stringTable>
       <string id="Softwarekatalog">Softwarekatalog</string>
       <string id="Softwarekatalog_Settings">Softwarekatalog konfigurieren</string>
-      <string id="Softwarekatalog_Settings_Help">Aktiviert und konfiguriert den Softwarekatalog. Katalog-Eintraege werden unter HKLM\Software\Policies\STL\Softwarekatalog\Catalog gespeichert. Der Wertname ist der Alias, der Wert hat das Format PackageId|DisplayName|Description. Pflichtsoftware wird unter HKLM\Software\Policies\STL\Softwarekatalog\Required gespeichert. Der Wertname ist der Alias, der Wert ist 1. Der Client liest maximal 500 Eintraege pro Liste.</string>
+      <string id="Softwarekatalog_Settings_Help">Aktiviert den Softwarekatalog und steuert, ob Benutzer Software installieren oder deinstallieren duerfen und ob Pflichtsoftware automatisch installiert wird.</string>
+      <string id="Softwarekatalog_Catalog">Freigegebene Software konfigurieren</string>
+      <string id="Softwarekatalog_Catalog_Help">Konfiguriert freigegebene Software unter HKLM\Software\Policies\STL\Softwarekatalog\Catalog. Der Wertname ist der Alias, der Wert hat das Format PackageId|DisplayName|Description. Der Client liest maximal 500 Eintraege.</string>
+      <string id="Softwarekatalog_Required">Pflichtsoftware konfigurieren</string>
+      <string id="Softwarekatalog_Required_Help">Konfiguriert Pflichtsoftware unter HKLM\Software\Policies\STL\Softwarekatalog\Required. Der Wertname ist ein Alias aus dem Katalog, der Wert ist 1. Der Client liest maximal 500 Eintraege.</string>
     </stringTable>
     <presentationTable>
       <presentation id="Softwarekatalog_Settings">
         <checkBox refId="AllowUserInstalls">Benutzer duerfen Software installieren</checkBox>
         <checkBox refId="AllowUserUninstall">Benutzer duerfen Software deinstallieren</checkBox>
         <checkBox refId="EnforceRequired">Pflichtsoftware automatisch installieren</checkBox>
+      </presentation>
+      <presentation id="Softwarekatalog_Catalog">
         <listBox refId="Catalog">Freigegebene Software. Name = Alias, Wert = PackageId|DisplayName|Description.</listBox>
+      </presentation>
+      <presentation id="Softwarekatalog_Required">
         <listBox refId="Required">Pflichtsoftware. Name = Alias aus Katalog, Wert = 1.</listBox>
       </presentation>
     </presentationTable>
diff --git a/PolicyDefinitions/en-US/Softwarekatalog.adml b/PolicyDefinitions/en-US/Softwarekatalog.adml
index 0dbe3b4..849b56c 100644
--- a/PolicyDefinitions/en-US/Softwarekatalog.adml
+++ b/PolicyDefinitions/en-US/Softwarekatalog.adml
@@ -6,14 +6,22 @@
     <stringTable>
       <string id="Softwarekatalog">Software Catalog</string>
       <string id="Softwarekatalog_Settings">Configure Software Catalog</string>
-      <string id="Softwarekatalog_Settings_Help">Enables and configures Software Catalog. Catalog entries are stored below HKLM\Software\Policies\STL\Softwarekatalog\Catalog. Value name is alias, value format is PackageId|DisplayName|Description. Required software is stored below HKLM\Software\Policies\STL\Softwarekatalog\Required. Value name is alias, value is 1. Client reads up to 500 entries per list.</string>
+      <string id="Softwarekatalog_Settings_Help">Enables Software Catalog and controls whether users may install or uninstall software and whether required software is installed automatically.</string>
+      <string id="Softwarekatalog_Catalog">Configure allowed software</string>
+      <string id="Softwarekatalog_Catalog_Help">Configures allowed software below HKLM\Software\Policies\STL\Softwarekatalog\Catalog. Value name is alias, value format is PackageId|DisplayName|Description. Client reads up to 500 entries.</string>
+      <string id="Softwarekatalog_Required">Configure required software</string>
+      <string id="Softwarekatalog_Required_Help">Configures required software below HKLM\Software\Policies\STL\Softwarekatalog\Required. Value name is a catalog alias, value is 1. Client reads up to 500 entries.</string>
     </stringTable>
     <presentationTable>
       <presentation id="Softwarekatalog_Settings">
         <checkBox refId="AllowUserInstalls">Allow users to install software</checkBox>
         <checkBox refId="AllowUserUninstall">Allow users to uninstall software</checkBox>
         <checkBox refId="EnforceRequired">Automatically install required software</checkBox>
+      </presentation>
+      <presentation id="Softwarekatalog_Catalog">
         <listBox refId="Catalog">Allowed software. Name = alias, value = PackageId|DisplayName|Description.</listBox>
+      </presentation>
+      <presentation id="Softwarekatalog_Required">
         <listBox refId="Required">Required software. Name = catalog alias, value = 1.</listBox>
       </presentation>
     </presentationTable>
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..a447299
--- /dev/null
+++ b/README.md
@@ -0,0 +1,67 @@
+# Softwarekatalog
+
+Windows self-service software catalog backed by `winget`.
+
+Users install approved software through a small GUI or request helper. A SYSTEM scheduled task runs a named-pipe daemon, authenticates the connecting Windows user, validates requests against Group Policy, then runs `winget install --scope machine`.
+
+## What It Does
+
+- Reads allowed software from GPO registry policy.
+- Lets users install/uninstall only catalog entries allowed by policy.
+- Installs required software automatically.
+- Runs `winget upgrade --all` every 2 hours.
+- Tracks installed state from `winget export`, not from request history.
+
+## Policy
+
+ADMX templates live in `PolicyDefinitions/`.
+
+Copy them to your domain Central Store:
+
+```text
+\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\Softwarekatalog.admx
+\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\de-DE\Softwarekatalog.adml
+\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\en-US\Softwarekatalog.adml
+```
+
+Policy registry path:
+
+```text
+HKLM\Software\Policies\STL\Softwarekatalog
+```
+
+Catalog entries:
+
+```text
+HKLM\Software\Policies\STL\Softwarekatalog\Catalog
+alias = PackageId|DisplayName|Description
+```
+
+Required software:
+
+```text
+HKLM\Software\Policies\STL\Softwarekatalog\Required
+alias = 1
+```
+
+The client reads up to 500 catalog entries and 500 required entries.
+
+## Install
+
+Run as admin or as computer startup script:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\setup.ps1 -Mode Install
+```
+
+Generated files are written to:
+
+```text
+C:\ProgramData\__Softwarekatalog\
+```
+
+## Notes
+
+- Requires Windows, Desktop App Installer, and `winget`.
+- The daemon runs as `LocalSystem`; keep catalog policy restricted to trusted admins.
+- Package IDs and silent machine-scope support depend on upstream `winget` packages.