add mdm helper (windows) (can be deleted later)

client/ui/scripts/mdm-fields.md

@@ -1,9 +1,11 @@
-# MDM dev cheatsheet (macOS)
+# MDM dev cheatsheet
 
-Edits `/Library/Managed Preferences/io.netbird.client.plist`. Daemon picks up
-changes within ≤60s; no restart needed.
+Two platform helpers, same field set. The daemon's MDM ticker picks up changes
+within ≤60s and restarts the engine in-process — no service restart needed.
 
-Run the interactive TUI:
+## macOS — `mdm-toggle.sh`
+
+Edits `/Library/Managed Preferences/io.netbird.client.plist`.
 
 ```bash
 ./mdm-toggle.sh tui
@@ -12,6 +14,25 @@ Run the interactive TUI:
 Keys: number to edit a field, **k** to kick the daemon, **c** to clear the
 plist, **l** to view recent MDM log lines, **r** to refresh, **q** to quit.
 
+## Windows — `mdm-toggle.ps1`
+
+**▶ [Launch the TUI](mdm-tui.bat)** (double-click `mdm-tui.bat` — it self-elevates).
+
+Edits `HKLM\Software\Policies\NetBird` (the key Group Policy / Intune ADMX /
+a Registry CSP profile would populate — see `client/mdm/policy_windows.go`).
+Self-elevates (HKLM writes need admin). Or run it directly:
+
+```powershell
+.\mdm-toggle.ps1
+```
+
+Same keys as the macOS TUI: number to edit a field, **k** to kick the daemon,
+**c** to clear the policy key, **r** to refresh, **q** to quit. Registry type
+mapping (mirrors `readRegistryValue`): `string → REG_SZ`, `integer → REG_DWORD`,
+`bool → REG_DWORD` (1=true / 0=false), `array → REG_MULTI_SZ`. Value names are
+case-insensitive (the loader canonicalises against the known key set);
+service: `Netbird`.
+
 ## Known keys
 
 - Strings/ints: `managementURL`, `preSharedKey`, `wireguardPort`, `splitTunnelMode` (`allow`/`disallow`)