# windows/policies

Group Policy / ADMX exports and the **offline-applicable baseline** (`.reg` / `.pol`)
that `build.ps1` applies into the WIM via offline hive editing (telemetry floor,
service disables). The online/runtime policy is applied by the `../hardening/`
modules at first boot.

Populated at **M2** by exporting the prototype unit's applied policy
(`LGPO.exe` / registry export) after the `hardening/` modules run on the device.
