# Microsoft SCCM Distribution (Windows)

Deploy Capsule Security hooks for AI coding assistants across your Windows fleet using Microsoft System Center Configuration Manager (SCCM). This guide covers deployment for Cursor, GitHub Copilot, Claude Code, Devin (Windsurf), and Codex.

## Prerequisites

- Microsoft SCCM infrastructure with administrative access to the SCCM console
- A network share accessible by SCCM distribution points
- A **Capsule Security** account with admin access
- Target devices running Windows


## Cursor

Deploy the Cursor hooks configuration as an SCCM Application.

### Step 1: Download and Stage the Configuration

1. Log in to the **Capsule Security** portal
2. Navigate to **Settings > Integrations**
3. Locate the **Cursor** integration and download the `hooks.json` file
4. Place the file on a network share:

```
\\sccm-server\sources\Software\CapsuleCursorHooks\hooks.json
```


### Step 2: Create the SCCM Application

1. Open the **SCCM Console** and navigate to **Software Library > Application Management > Applications**
2. Click **Create Application** and select **Manually specify the application information**:
  - **Name**: Capsule Security Cursor Hooks
  - **Publisher**: Capsule Security
3. Add a **Deployment Type** with **Script Installer**:
  - **Content location**: `\\sccm-server\sources\Software\CapsuleCursorHooks\`
  - **Install command**:

```cmd
cmd.exe /c mkdir "C:\ProgramData\Cursor" & copy /Y "hooks.json" "C:\ProgramData\Cursor\hooks.json"
```
  - **Uninstall command**:

```cmd
cmd.exe /c del "C:\ProgramData\Cursor\hooks.json"
```
4. Configure the **Detection Method**:
| Setting | Value |
|  --- | --- |
| Type | File |
| Path | `C:\ProgramData\Cursor` |
| File name | `hooks.json` |
| Property | File or folder exists |
5. Configure **User Experience** settings:
| Setting | Value |
|  --- | --- |
| Installation behavior | Install for system |
| Logon requirement | Whether or not a user is logged on |
| Installation program visibility | Hidden |
| Maximum allowed run time | 5 minutes |


### Step 3: Deploy

1. Right-click the application and select **Distribute Content** to your distribution point groups
2. Right-click the application and select **Deploy**
3. Choose the target **Device Collection** and configure:
| Setting | Value |
|  --- | --- |
| Action | Install |
| Purpose | Required |
| Schedule | As soon as possible (or a maintenance window) |


### Verification

After deployment, restart Cursor on target devices, then:

1. Open Cursor Settings
2. Navigate to the **Hooks** tab
3. Confirm the hooks are listed and enabled


## GitHub Copilot

Deploy the GitHub Copilot hooks configuration as an SCCM Application.

### Step 1: Download and Stage the Configuration

1. Log in to the **Capsule Security** portal
2. Navigate to **Settings > Integrations**
3. Locate the **GitHub Copilot** integration and download the `capsule-hooks.json` file
4. Place the file on a network share:

```
\\sccm-server\sources\Software\CapsuleCopilotHooks\capsule-hooks.json
```


### Step 2: Create the SCCM Application

1. Open the **SCCM Console** and navigate to **Software Library > Application Management > Applications**
2. Click **Create Application** and select **Manually specify the application information**:
  - **Name**: Capsule Security GitHub Copilot Hooks
  - **Publisher**: Capsule Security
3. Add a **Deployment Type** with **Script Installer**:
  - **Content location**: `\\sccm-server\sources\Software\CapsuleCopilotHooks\`
  - **Install command**:

```cmd
cmd.exe /c mkdir "%APPDATA%\Code\User\hooks" & copy /Y "capsule-hooks.json" "%APPDATA%\Code\User\hooks\capsule-hooks.json"
```
  - **Uninstall command**:

```cmd
cmd.exe /c del "%APPDATA%\Code\User\hooks\capsule-hooks.json"
```
4. Configure the **Detection Method**:
| Setting | Value |
|  --- | --- |
| Type | File |
| Path | `%APPDATA%\Code\User\hooks` |
| File name | `capsule-hooks.json` |
| Property | File or folder exists |
5. Configure **User Experience** settings:
| Setting | Value |
|  --- | --- |
| Installation behavior | Install for user |
| Logon requirement | Only when a user is logged on |
| Installation program visibility | Hidden |
| Maximum allowed run time | 5 minutes |


### Step 3: Deploy

1. Right-click the application and select **Distribute Content** to your distribution point groups
2. Right-click the application and select **Deploy**
3. Choose the target **User Collection** and configure:
| Setting | Value |
|  --- | --- |
| Action | Install |
| Purpose | Required |
| Schedule | As soon as possible (or a maintenance window) |


### Verification

After deployment, restart VS Code on target devices, then:

1. Right-click in the **Chat** view and select **Diagnostics**
2. Confirm the hooks are loaded and enabled


## Claude Code

Deploy the Claude Code managed settings configuration as an SCCM Application.

### Step 1: Download and Stage the Configuration

1. Log in to the **Capsule Security** portal
2. Navigate to **Settings > Integrations**
3. Locate the **Claude Code** integration
4. Click **Install** and select **Windows** as the target platform
5. Download the `managed-settings.json` file
6. Place the file on a network share:

```
\\sccm-server\sources\Software\CapsuleClaudeCodeHooks\managed-settings.json
```


### Step 2: Create the SCCM Application

1. Open the **SCCM Console** and navigate to **Software Library > Application Management > Applications**
2. Click **Create Application** and select **Manually specify the application information**:
  - **Name**: Capsule Security Claude Code Hooks
  - **Publisher**: Capsule Security
3. Add a **Deployment Type** with **Script Installer**:
  - **Content location**: `\\sccm-server\sources\Software\CapsuleClaudeCodeHooks\`
  - **Install command**:

```cmd
cmd.exe /c mkdir "C:\Program Files\ClaudeCode" & copy /Y "managed-settings.json" "C:\Program Files\ClaudeCode\managed-settings.json"
```
  - **Uninstall command**:

```cmd
cmd.exe /c del "C:\Program Files\ClaudeCode\managed-settings.json"
```
4. Configure the **Detection Method**:
| Setting | Value |
|  --- | --- |
| Type | File |
| Path | `C:\Program Files\ClaudeCode` |
| File name | `managed-settings.json` |
| Property | File or folder exists |
5. Configure **User Experience** settings:
| Setting | Value |
|  --- | --- |
| Installation behavior | Install for system |
| Logon requirement | Whether or not a user is logged on |
| Installation program visibility | Hidden |
| Maximum allowed run time | 5 minutes |


### Step 3: Deploy

1. Right-click the application and select **Distribute Content** to your distribution point groups
2. Right-click the application and select **Deploy**
3. Choose the target **Device Collection** and configure:
| Setting | Value |
|  --- | --- |
| Action | Install |
| Purpose | Required |
| Schedule | As soon as possible (or a maintenance window) |


### Verification

After deployment, restart Claude Code on target devices, then:

1. Run `/hooks` in Claude Code to confirm all hooks are listed
2. Start a session and verify events appear in the Capsule Security portal


## Devin (Windsurf)

Deploy the Devin (Windsurf) hooks configuration as an SCCM Application. The Capsule Devin (Windsurf) integration for Windows ships two files: a `hooks.json` deployed to the system-level path `C:\ProgramData\Windsurf\`, and the `CapsuleWindsurfHook.ps1` companion script the hooks invoke from `C:\ProgramData\Capsule\WindsurfHooks\`. Cascade merges hook configurations from the system, user, and workspace levels, so the system-level deployment applies the Capsule hooks to every user on the device, and they cannot be disabled by end users.

### Step 1: Download and Stage the Configuration

1. Log in to the **Capsule Security** portal
2. Navigate to **Settings > Integrations**
3. Locate the **Devin (Windsurf)** integration
4. Choose **MDM** as the deployment method
5. Select **Windows** as the target platform, then download and extract the `capsule-windsurf-managed.zip` archive
6. Place both files on a network share:

```
\\sccm-server\sources\Software\CapsuleWindsurfHooks\hooks.json
\\sccm-server\sources\Software\CapsuleWindsurfHooks\CapsuleWindsurfHook.ps1
```


### Step 2: Create the SCCM Application

1. Open the **SCCM Console** and navigate to **Software Library > Application Management > Applications**
2. Click **Create Application** and select **Manually specify the application information**:
  - **Name**: Capsule Security Devin (Windsurf) Hooks
  - **Publisher**: Capsule Security
3. Add a **Deployment Type** with **Script Installer**:
  - **Content location**: `\\sccm-server\sources\Software\CapsuleWindsurfHooks\`
  - **Install command**:

```cmd
cmd.exe /c mkdir "C:\ProgramData\Windsurf" & mkdir "C:\ProgramData\Capsule\WindsurfHooks" & copy /Y "hooks.json" "C:\ProgramData\Windsurf\hooks.json" & copy /Y "CapsuleWindsurfHook.ps1" "C:\ProgramData\Capsule\WindsurfHooks\CapsuleWindsurfHook.ps1"
```
  - **Uninstall command**:

```cmd
cmd.exe /c del "C:\ProgramData\Windsurf\hooks.json" & del "C:\ProgramData\Capsule\WindsurfHooks\CapsuleWindsurfHook.ps1"
```
4. Configure the **Detection Method**:
| Setting | Value |
|  --- | --- |
| Type | File |
| Path | `C:\ProgramData\Windsurf` |
| File name | `hooks.json` |
| Property | File or folder exists |
5. Configure **User Experience** settings:
| Setting | Value |
|  --- | --- |
| Installation behavior | Install for system |
| Logon requirement | Whether or not a user is logged on |
| Installation program visibility | Hidden |
| Maximum allowed run time | 5 minutes |


> The `hooks.json` invokes the companion script from `C:\ProgramData\Capsule\WindsurfHooks\`, so both files must be deployed.


### Step 3: Deploy

1. Right-click the application and select **Distribute Content** to your distribution point groups
2. Right-click the application and select **Deploy**
3. Choose the target **Device Collection** and configure:
| Setting | Value |
|  --- | --- |
| Action | Install |
| Purpose | Required |
| Schedule | As soon as possible (or a maintenance window) |


### Verification

Hooks are loaded at application start, so after deployment, close Devin Desktop completely on target devices and reopen it, then:

1. Start a **Cascade** session and run a simple task to generate activity
2. In the Capsule portal, navigate to **Inventory > Agents** and confirm the agent appears


## Codex

Deploy the Codex [managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration) as an SCCM Application. The Capsule Codex integration for Windows ships two files: a `requirements.toml` deployed to `%ProgramData%\OpenAI\Codex\`, and the `CapsuleCodexHook.ps1` companion script the managed configuration invokes from `C:\ProgramData\Capsule\CodexHooks\`. Because the configuration is managed, the Capsule hooks are trusted by policy, apply to every user on the device (including users created later), and cannot be overridden or removed by users. No per-user trust approval is required.

### Step 1: Download and Stage the Configuration

1. Log in to the **Capsule Security** portal
2. Navigate to **Settings > Integrations**
3. Locate the **Codex** integration
4. Choose **MDM** as the deployment method
5. Select **Windows** as the target platform, then download and extract the `capsule-codex-managed.zip` archive
6. Place both files on a network share:

```
\\sccm-server\sources\Software\CapsuleCodexManaged\requirements.toml
\\sccm-server\sources\Software\CapsuleCodexManaged\CapsuleCodexHook.ps1
```


### Step 2: Create the SCCM Application

1. Open the **SCCM Console** and navigate to **Software Library > Application Management > Applications**
2. Click **Create Application** and select **Manually specify the application information**:
  - **Name**: Capsule Security Codex Managed Configuration
  - **Publisher**: Capsule Security
3. Add a **Deployment Type** with **Script Installer**:
  - **Content location**: `\\sccm-server\sources\Software\CapsuleCodexManaged\`
  - **Install command**:

```cmd
cmd.exe /c mkdir "C:\ProgramData\OpenAI\Codex" & mkdir "C:\ProgramData\Capsule\CodexHooks" & copy /Y "requirements.toml" "C:\ProgramData\OpenAI\Codex\requirements.toml" & copy /Y "CapsuleCodexHook.ps1" "C:\ProgramData\Capsule\CodexHooks\CapsuleCodexHook.ps1"
```
  - **Uninstall command**:

```cmd
cmd.exe /c del "C:\ProgramData\OpenAI\Codex\requirements.toml" & del "C:\ProgramData\Capsule\CodexHooks\CapsuleCodexHook.ps1"
```
4. Configure the **Detection Method**:
| Setting | Value |
|  --- | --- |
| Type | File |
| Path | `C:\ProgramData\OpenAI\Codex` |
| File name | `requirements.toml` |
| Property | File or folder exists |
5. Configure **User Experience** settings:
| Setting | Value |
|  --- | --- |
| Installation behavior | Install for system |
| Logon requirement | Whether or not a user is logged on |
| Installation program visibility | Hidden |
| Maximum allowed run time | 5 minutes |


> The managed configuration invokes the companion script from `C:\ProgramData\Capsule\CodexHooks\`, so both files must be deployed.


### Step 3: Deploy

1. Right-click the application and select **Distribute Content** to your distribution point groups
2. Right-click the application and select **Deploy**
3. Choose the target **Device Collection** and configure:
| Setting | Value |
|  --- | --- |
| Action | Install |
| Purpose | Required |
| Schedule | As soon as possible (or a maintenance window) |


### Verification

After deployment, close any running Codex CLI sessions on target devices, then:

1. Start a new Codex CLI session so the managed configuration is loaded
2. In the Capsule portal, navigate to **Inventory > Agents** and confirm the Codex agent appears


## Key Considerations

- **Cursor**, **Claude Code**, **Devin (Windsurf)**, and **Codex** use system-level paths - target **Device Collections**
- **GitHub Copilot** uses a user-level path (`%APPDATA%`) - target **User Collections**
- **Codex** uses a managed configuration (`%ProgramData%\OpenAI\Codex\requirements.toml`) enforced by policy - it applies to all users on the device (including users created later) and cannot be overridden by user-level configuration
- **Devin (Windsurf)** merges system, user, and workspace hook configurations, so the system-level deployment coexists with any per-user hooks and cannot be disabled by end users
- To update configurations, replace the files on the network share and create a new deployment or use SCCM's content update and redeployment workflow
- Restart each application on target devices after deployment for hooks to take effect
- Consider using SCCM Maintenance Windows to control when deployments occur
- For GitHub Copilot CLI users, create an additional application targeting `%USERPROFILE%\.copilot\hooks\capsule-hooks.json`
- All five integrations can be deployed as separate SCCM applications and assigned independently


## Support

For help with deployment:

- **Email**: support@capsule.security
- **Include**: Your organization ID, SCCM environment details, and any error messages