Microsoft SCCM Distribution (Windows)

Deploy Capsule Security hooks for AI coding assistants across your Windows fleet using Microsoft System Center Configuration Manager (SCCM). This guide covers deployment for Cursor, GitHub Copilot, Claude Code, Devin (Windsurf), and Codex.

• Microsoft SCCM infrastructure with administrative access to the SCCM console
• A network share accessible by SCCM distribution points
• A Capsule Security account with admin access
• Target devices running Windows

Deploy the Cursor hooks configuration as an SCCM Application.

1. Log in to the Capsule Security portal
2. Navigate to Settings > Integrations
3. Locate the Cursor integration and download the hooks.json file
4. Place the file on a network share:
   \\sccm-server\sources\Software\CapsuleCursorHooks\hooks.json

1. Open the SCCM Console and navigate to Software Library > Application Management > Applications

2. Click Create Application and select Manually specify the application information:

   • Name: Capsule Security Cursor Hooks
   • Publisher: Capsule Security

3. Add a Deployment Type with Script Installer:

   • Content location: \\sccm-server\sources\Software\CapsuleCursorHooks\

   • Install command:

     cmd.exe /c mkdir "C:\ProgramData\Cursor" & copy /Y "hooks.json" "C:\ProgramData\Cursor\hooks.json"

   • Uninstall command:

     cmd.exe /c del "C:\ProgramData\Cursor\hooks.json"

4. Configure the Detection Method:

   Setting	Value
   Type	File
   Path	C:\ProgramData\Cursor
   File name	hooks.json
   Property	File or folder exists

5. Configure User Experience settings:

   Setting	Value
   Installation behavior	Install for system
   Logon requirement	Whether or not a user is logged on
   Installation program visibility	Hidden
   Maximum allowed run time	5 minutes

1. Right-click the application and select Distribute Content to your distribution point groups

2. Right-click the application and select Deploy

3. Choose the target Device Collection and configure:

   Setting	Value
   Action	Install
   Purpose	Required
   Schedule	As soon as possible (or a maintenance window)

After deployment, restart Cursor on target devices, then:

1. Open Cursor Settings
2. Navigate to the Hooks tab
3. Confirm the hooks are listed and enabled

Deploy the GitHub Copilot hooks configuration as an SCCM Application.

1. Log in to the Capsule Security portal
2. Navigate to Settings > Integrations
3. Locate the GitHub Copilot integration and download the hooks.json file
4. Place the file on a network share:
   \\sccm-server\sources\Software\CapsuleCopilotHooks\hooks.json

1. Open the SCCM Console and navigate to Software Library > Application Management > Applications

2. Click Create Application and select Manually specify the application information:

   • Name: Capsule Security GitHub Copilot Hooks
   • Publisher: Capsule Security

3. Add a Deployment Type with Script Installer:

   • Content location: \\sccm-server\sources\Software\CapsuleCopilotHooks\

   • Install command:

     cmd.exe /c mkdir "%APPDATA%\Code\User\hooks" & copy /Y "hooks.json" "%APPDATA%\Code\User\hooks\hooks.json"

   • Uninstall command:

     cmd.exe /c del "%APPDATA%\Code\User\hooks\hooks.json"

4. Configure the Detection Method:

   Setting	Value
   Type	File
   Path	%APPDATA%\Code\User\hooks
   File name	hooks.json
   Property	File or folder exists

5. Configure User Experience settings:

   Setting	Value
   Installation behavior	Install for user
   Logon requirement	Only when a user is logged on
   Installation program visibility	Hidden
   Maximum allowed run time	5 minutes

1. Right-click the application and select Distribute Content to your distribution point groups

2. Right-click the application and select Deploy

3. Choose the target User Collection and configure:

   Setting	Value
   Action	Install
   Purpose	Required
   Schedule	As soon as possible (or a maintenance window)

After deployment, restart VS Code on target devices, then:

1. Right-click in the Chat view and select Diagnostics
2. Confirm the hooks are loaded and enabled

Deploy the Claude Code managed settings configuration as an SCCM Application.

1. Log in to the Capsule Security portal
2. Navigate to Settings > Integrations
3. Locate the Claude Code integration
4. Click Install and select Windows as the target platform
5. Download the managed-settings.json file
6. Place the file on a network share:
   \\sccm-server\sources\Software\CapsuleClaudeCodeHooks\managed-settings.json

1. Open the SCCM Console and navigate to Software Library > Application Management > Applications

2. Click Create Application and select Manually specify the application information:

   • Name: Capsule Security Claude Code Hooks
   • Publisher: Capsule Security

3. Add a Deployment Type with Script Installer:

   • Content location: \\sccm-server\sources\Software\CapsuleClaudeCodeHooks\

   • Install command:

     cmd.exe /c mkdir "C:\Program Files\ClaudeCode" & copy /Y "managed-settings.json" "C:\Program Files\ClaudeCode\managed-settings.json"

   • Uninstall command:

     cmd.exe /c del "C:\Program Files\ClaudeCode\managed-settings.json"

4. Configure the Detection Method:

   Setting	Value
   Type	File
   Path	C:\Program Files\ClaudeCode
   File name	managed-settings.json
   Property	File or folder exists

5. Configure User Experience settings:

   Setting	Value
   Installation behavior	Install for system
   Logon requirement	Whether or not a user is logged on
   Installation program visibility	Hidden
   Maximum allowed run time	5 minutes

1. Right-click the application and select Distribute Content to your distribution point groups

2. Right-click the application and select Deploy

3. Choose the target Device Collection and configure:

   Setting	Value
   Action	Install
   Purpose	Required
   Schedule	As soon as possible (or a maintenance window)

After deployment, restart Claude Code on target devices, then:

1. Run /hooks in Claude Code to confirm all hooks are listed
2. Start a session and verify events appear in the Capsule Security portal

Deploy the Devin (Windsurf) hooks configuration as an SCCM Application. The Capsule Devin (Windsurf) integration for Windows ships two files: a hooks.json deployed to the system-level path C:\ProgramData\Windsurf\, and the CapsuleWindsurfHook.ps1 companion script the hooks invoke from C:\ProgramData\Capsule\WindsurfHooks\. Cascade merges hook configurations from the system, user, and workspace levels, so the system-level deployment applies the Capsule hooks to every user on the device, and they cannot be disabled by end users.

1. Log in to the Capsule Security portal
2. Navigate to Settings > Integrations
3. Locate the Devin (Windsurf) integration
4. Choose MDM as the deployment method
5. Select Windows as the target platform, then download and extract the capsule-windsurf-managed.zip archive
6. Place both files on a network share:
   \\sccm-server\sources\Software\CapsuleWindsurfHooks\hooks.json
   \\sccm-server\sources\Software\CapsuleWindsurfHooks\CapsuleWindsurfHook.ps1

1. Open the SCCM Console and navigate to Software Library > Application Management > Applications

2. Click Create Application and select Manually specify the application information:

   • Name: Capsule Security Devin (Windsurf) Hooks
   • Publisher: Capsule Security

3. Add a Deployment Type with Script Installer:

   • Content location: \\sccm-server\sources\Software\CapsuleWindsurfHooks\

   • Install command:

     cmd.exe /c mkdir "C:\ProgramData\Windsurf" & mkdir "C:\ProgramData\Capsule\WindsurfHooks" & copy /Y "hooks.json" "C:\ProgramData\Windsurf\hooks.json" & copy /Y "CapsuleWindsurfHook.ps1" "C:\ProgramData\Capsule\WindsurfHooks\CapsuleWindsurfHook.ps1"

   • Uninstall command:

     cmd.exe /c del "C:\ProgramData\Windsurf\hooks.json" & del "C:\ProgramData\Capsule\WindsurfHooks\CapsuleWindsurfHook.ps1"

4. Configure the Detection Method:

   Setting	Value
   Type	File
   Path	C:\ProgramData\Windsurf
   File name	hooks.json
   Property	File or folder exists

5. Configure User Experience settings:

   Setting	Value
   Installation behavior	Install for system
   Logon requirement	Whether or not a user is logged on
   Installation program visibility	Hidden
   Maximum allowed run time	5 minutes

The hooks.json invokes the companion script from C:\ProgramData\Capsule\WindsurfHooks\, so both files must be deployed.

1. Right-click the application and select Distribute Content to your distribution point groups

2. Right-click the application and select Deploy

3. Choose the target Device Collection and configure:

   Setting	Value
   Action	Install
   Purpose	Required
   Schedule	As soon as possible (or a maintenance window)

Hooks are loaded at application start, so after deployment, close Devin Desktop completely on target devices and reopen it, then:

1. Start a Cascade session and run a simple task to generate activity
2. In the Capsule portal, navigate to Inventory > Agents and confirm the agent appears

Deploy the Codex managed configuration as an SCCM Application. The Capsule Codex integration for Windows ships two files: a requirements.toml deployed to %ProgramData%\OpenAI\Codex\, and the CapsuleCodexHook.ps1 companion script the managed configuration invokes from C:\ProgramData\Capsule\CodexHooks\. Because the configuration is managed, the Capsule hooks are trusted by policy, apply to every user on the device (including users created later), and cannot be overridden or removed by users. No per-user trust approval is required.

1. Log in to the Capsule Security portal
2. Navigate to Settings > Integrations
3. Locate the Codex integration
4. Choose MDM as the deployment method
5. Select Windows as the target platform, then download and extract the capsule-codex-managed.zip archive
6. Place both files on a network share:
   \\sccm-server\sources\Software\CapsuleCodexManaged\requirements.toml
   \\sccm-server\sources\Software\CapsuleCodexManaged\CapsuleCodexHook.ps1

1. Open the SCCM Console and navigate to Software Library > Application Management > Applications

2. Click Create Application and select Manually specify the application information:

   • Name: Capsule Security Codex Managed Configuration
   • Publisher: Capsule Security

3. Add a Deployment Type with Script Installer:

   • Content location: \\sccm-server\sources\Software\CapsuleCodexManaged\

   • Install command:

     cmd.exe /c mkdir "C:\ProgramData\OpenAI\Codex" & mkdir "C:\ProgramData\Capsule\CodexHooks" & copy /Y "requirements.toml" "C:\ProgramData\OpenAI\Codex\requirements.toml" & copy /Y "CapsuleCodexHook.ps1" "C:\ProgramData\Capsule\CodexHooks\CapsuleCodexHook.ps1"

   • Uninstall command:

     cmd.exe /c del "C:\ProgramData\OpenAI\Codex\requirements.toml" & del "C:\ProgramData\Capsule\CodexHooks\CapsuleCodexHook.ps1"

4. Configure the Detection Method:

   Setting	Value
   Type	File
   Path	C:\ProgramData\OpenAI\Codex
   File name	requirements.toml
   Property	File or folder exists

5. Configure User Experience settings:

   Setting	Value
   Installation behavior	Install for system
   Logon requirement	Whether or not a user is logged on
   Installation program visibility	Hidden
   Maximum allowed run time	5 minutes

The managed configuration invokes the companion script from C:\ProgramData\Capsule\CodexHooks\, so both files must be deployed.

1. Right-click the application and select Distribute Content to your distribution point groups

2. Right-click the application and select Deploy

3. Choose the target Device Collection and configure:

   Setting	Value
   Action	Install
   Purpose	Required
   Schedule	As soon as possible (or a maintenance window)

After deployment, close any running Codex CLI sessions on target devices, then:

1. Start a new Codex CLI session so the managed configuration is loaded
2. In the Capsule portal, navigate to Inventory > Agents and confirm the Codex agent appears

• Cursor, Claude Code, Devin (Windsurf), and Codex use system-level paths - target Device Collections
• GitHub Copilot uses a user-level path (%APPDATA%) - target User Collections
• Codex uses a managed configuration (%ProgramData%\OpenAI\Codex\requirements.toml) enforced by policy - it applies to all users on the device (including users created later) and cannot be overridden by user-level configuration
• Devin (Windsurf) merges system, user, and workspace hook configurations, so the system-level deployment coexists with any per-user hooks and cannot be disabled by end users
• To update configurations, replace the files on the network share and create a new deployment or use SCCM's content update and redeployment workflow
• Restart each application on target devices after deployment for hooks to take effect
• Consider using SCCM Maintenance Windows to control when deployments occur
• For GitHub Copilot CLI users, create an additional application targeting %USERPROFILE%\.github\hooks\hooks.json
• All five integrations can be deployed as separate SCCM applications and assigned independently

For help with deployment:

• Email: support@capsule.security
• Include: Your organization ID, SCCM environment details, and any error messages