# Windows configuration management, one binary

> For kiosks, signage, and exhibit PCs: no runtime dependencies.

windows-firstsingle binarywinrm or ssh

[Install](/how-to/install-preflight/)[Quickstart](/tutorials/quickstart/)

No control plane. WinRM or SSH is the whole transport.

For kiosks, signage, and exhibit PCs: no runtime dependencies.

4phases: fetch, plan, stage, apply

1static binary, no runtime deps

6posix-over-ssh modules

0modules that skip Check() before Apply()

Check() before Apply()

Every built-in and plugin module answers `Check()` before `Apply()` ever runs. Dry-run and real execution share one code path, not two.

Offline-capable staging

`stage` writes a per-target bundle: plan, manifest, plugins, secrets. `apply --bundle` converges a target with no network at all.

Explicit phases

Fetch pins actions. Plan builds a DAG without touching targets. Stage writes the bundle. Apply is the only phase that mutates anything.

## Preflight’s *Key Features*

What Preflight handles out of the box.

Run the same path everywhere.

Local, remote, or staged-and-offline: `apply` converges the same playbook the same way.

Select targets by host, group, or tag.

Inventory variables cascade from inventory to group to host, and CLI commands fan out across a selector instead of one target at a time.

Facts and templating built in.

`{{ facts.os.arch }}`, `{{ target.name }}`, and friends resolve at plan time, so one playbook reads the same across every target.

Repo-backed, \`age\`-encrypted secrets.

Secret values travel with the project’s config and decrypt only at apply time. No plaintext, no central vault.

Identity-aware execution.

`become` runs a task under a different user account when the outcome depends on whose registry keys or files get touched.

A stdlib that ships with the binary.

Embedded actions like `windows-machine` and `autologin` are versioned with the release and resolved before any project-local action.

[tutorialRun your first playbook](tutorials/quickstart/)

[Validate, plan, dry-run, and apply a minimal project in one sitting.](tutorials/quickstart/)

[tutorialManage your first Windows target](tutorials/first-windows-target/)

[Add a Windows host, encrypt its password, test the connection, and apply a playbook.](tutorials/first-windows-target/)

[referenceCLI reference](reference/cli/)

[Every command and flag, and which phase each one touches.](reference/cli/)

[explanationWhy use Preflight (and when not to)](explanation/why-preflight/)

[Where it fits, and where Ansible, DSC, or Intune fit better.](explanation/why-preflight/)

## More tools from Bluecadet

Other open source tools built for exhibit and installation work.

## [Launchpad](https://launchpad.bluecadet.com)

[Content & App Orchestration](https://launchpad.bluecadet.com)

[Toolkit for exhibit and installation work: content syncing from your CMS, app launching and restart-on-crash, and logs forwarded somewhere you'll actually see them.](https://launchpad.bluecadet.com)

## [Unity Packages](https://unity.bluecadet.com)

[Installation Utilities](https://unity.bluecadet.com)

[Open source Unity packages for interactive installations: GPU-compressed HAP video, physics-based UI animation, multi-touch input, a client for Launchpad's staged content sync, and more.](https://unity.bluecadet.com)

## Start with the tutorials.

[read the docs →](/tutorials/quickstart/)[github ↗](https://github.com/bluecadet/preflight)