Add README for WinSCP Administrative Template

This README provides comprehensive documentation for the WinSCP Administrative Template, including included policies, registry locations, language resources, and instructions for Intune import and Active Directory integration.

ADMX/README.md

@@ -0,0 +1,82 @@
+# WinSCP Administrative Template (ADMX/ADML)
+
+This package provides a custom Windows Administrative Template for the machine-level WinSCP administration settings as documented at:
+
+https://winscp.net/eng/docs/administration
+
+## Included policies
+
+Under **Computer Configuration > Administrative Templates > WinSCP**:
+
+### Security restrictions
+- Prevent users from storing passwords (`DisablePasswordStoring`)
+- Prevent opening or editing files from WinSCP (`DisableOpenEdit`)
+- Require SSH host keys to be accepted in advance (`DisableAcceptingHostKeys`)
+- Force authentication banners to be shown (`ForceBanners`)
+
+### Application defaults
+- Configure default automatic update-check period for new users (`DefaultUpdatesPeriod`)
+- Default anonymous usage-statistics collection for new users (`DefaultCollectUsage`)
+
+## Registry location
+
+The template follows the current WinSCP administration documentation and writes the values beneath:
+
+`HKLM\SOFTWARE\Wow6432Node\Martin Prikryl\WinSCP 2`
+
+The current WinSCP administration documentation explicitly uses the 32-bit registry view (`Wow6432Node`) on 64-bit Windows, so this template targets that documented path.
+
+## Important behaviour of the two Default* settings
+
+`DefaultUpdatesPeriod` and `DefaultCollectUsage` are defaults, not hard-enforcement controls. They affect users who do not already have corresponding per-user settings. Existing user configuration can override these defaults.
+
+The four security restriction settings are the vendor-documented machine-level restrictions/enforcements.
+
+## Language resources
+
+This package includes both:
+
+- `en-US\WinSCP.adml` - required for Microsoft Intune custom ADMX import
+- `en-GB\WinSCP.adml` - for UK-English Local Group Policy and Active Directory Central Store environments
+
+The `en-GB` resource uses the same policy/resource IDs as the `en-US` file, so both languages work with the same `WinSCP.admx`.
+
+## Intune import
+
+1. In the Intune admin center, go to **Devices > Configuration > Import ADMX**.
+2. Import `WinSCP.admx` and pair it with `en-US\WinSCP.adml`.
+3. Create a **Windows 10 and later** policy using **Imported Administrative templates**.
+4. Browse to **WinSCP** and configure the required settings.
+
+At the time this package was produced, Microsoft Intune custom ADMX import supports only `en-US` ADML resources, so **do not use the `en-GB` ADML for the Intune import**. The `en-GB` resource is intended for Windows Local Group Policy and Active Directory.
+
+The template is standalone and declares no external ADMX namespace dependencies.
+
+## Active Directory / Group Policy Central Store
+
+Copy:
+
+- `WinSCP.admx` to `\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\`
+- `WinSCP.adml` to the language folder used by your administrators, for example:
+  - UK English: `\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\en-GB\`
+  - US English: `\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\en-US\`
+
+For a UK-English Windows 11 test machine, copy `WinSCP.admx` to `C:\Windows\PolicyDefinitions\` and the UK resource file to `C:\Windows\PolicyDefinitions\en-GB\WinSCP.adml`. Then run `gpedit.msc`.
+
+For Active Directory, edit a GPO and browse to **Computer Configuration > Policies > Administrative Templates > WinSCP**.
+
+## Unmodifiable saved sites
+
+The administration page also documents the per-session `Special=1` setting for making a saved site harder to accidentally modify or delete. It is **not included as a generic ADMX policy** because each WinSCP site is stored in a dynamically named `Sessions\<SiteName>` subkey, which a normal ADMX setting cannot parameterise as a registry key path. WinSCP also notes that the end user can change the `Special` value, so it is not a security enforcement boundary. If you have a fixed set of centrally provisioned WinSCP site names, a site-specific extension to this template can be generated.
+
+## Suggested security baseline
+
+A security-conscious enterprise baseline could enable:
+
+- Prevent users from storing passwords
+- Require SSH host keys to be accepted in advance (only after trusted host keys are provisioned)
+- Force authentication banners to be shown
+
+Whether to disable file opening/editing depends on your operational use case because it removes a normal WinSCP workflow.
+
+For update checking and anonymous statistics, decide whether WinSCP itself or your software-management platform owns update/telemetry behaviour. Remember that the `Default*` values do not override an existing user's saved preference.