spydisec · spydisec · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026
diff --git a/.coderabbit.yaml b/.coderabbit.yaml
@@ -44,7 +44,7 @@ reviews:
           or parameters. Flag anything 7-only.
         - $PSScriptRoot is unreliable in param-default expressions under
           powershell.exe -File; defaults must be resolved in the script body.
-        - Every logging setting lives in LoggingBaseline.Settings.ps1 with a
+        - Every logging setting lives in WinLogKit.Settings.ps1 with a
           plain-language Purpose (and Risk where volume/stability matters).
           Flag settings hardcoded in the other scripts.
         - Shared helpers live in WinLogKit.Common.ps1 (host probes, registry

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
@@ -8,7 +8,7 @@
 ## Checklist
 
 - [ ] `tests\Invoke-KitChecks.ps1` passes locally
-- [ ] Settings changes made in `LoggingBaseline.Settings.ps1` only, with a
+- [ ] Settings changes made in `WinLogKit.Settings.ps1` only, with a
       plain-language purpose (and risk note where it matters)
 - [ ] Generated files (presets, docs Reference page, packs) regenerated via
       their `tools\` generators, not edited by hand

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -31,7 +31,7 @@ jobs:
           Copy-Item *.ps1, PSScriptAnalyzerSettings.psd1, README.md, CHANGELOG.md, LICENSE $stage
           # Data-dependent scripts (coverage mapping, presets) must work from
           # the zip, not only from a git clone.
-          Copy-Item data, presets, tools, tests, addons $stage -Recurse
+          Copy-Item fleet, report, data, presets, tools, tests, addons $stage -Recurse
           Compress-Archive -Path $stage -DestinationPath "WinLogKit-$tag.zip"
           (Get-FileHash "WinLogKit-$tag.zip" -Algorithm SHA256).Hash.ToLower() + "  WinLogKit-$tag.zip" |
             Set-Content "SHA256SUMS.txt" -Encoding ascii

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,9 +3,24 @@
 All notable changes to WinLogKit. Versions follow [SemVer](https://semver.org/);
 releases are tagged `vX.Y.Z` and published with a zip + SHA256 checksum.
 
-## Unreleased
+## v1.0.0 - 2026-09-04
+
+The v1.0 restructure ([ADR-001](https://github.com/spydisec/WinLogKit/pull/30)):
+docs cut, one copy of the shared helpers, and a layout that shows a new
+reader the three scripts they need. Version 1.0.0 because paths move; no
+setting changed.
 
 ### Changed
+- **Layout (breaking: paths).** The fleet generators
+  (`New-IntuneRemediationPack.ps1`, `New-GpoPack.ps1`,
+  `New-WefSubscription.ps1`, `Test-WefFilter.ps1`) now live in `fleet\`,
+  and the coverage report and WELA check (`Export-AttackCoverage.ps1`,
+  `Invoke-WELACheck.ps1`) in `report\`. The three host scripts stay at the
+  root with the settings table and the shared helpers. Output folders
+  (`Intune\`, `GPO\`, `WEF\`, `Results\`, `Evidence\`) stay at the kit
+  root wherever the script runs from.
+- **`LoggingBaseline.Settings.ps1` is now `WinLogKit.Settings.ps1`.** Same
+  contents. If you carry a modified copy, rename it.
 - **`WinLogKit.Common.ps1`.** The helpers that Enable, Test, the WELA
   check, the coverage report and the fleet generators each carried their
   own copy of (admin check, host role and OS type, registry reads, the

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -20,7 +20,7 @@ is what tunes the presets. Open an issue with the *Field report* template.
 
 ## Ground rules for changes
 
-- **Every setting lives in `LoggingBaseline.Settings.ps1`** with a
+- **Every setting lives in `WinLogKit.Settings.ps1`** with a
   plain-language purpose and, where it matters, a risk note. Scripts,
   presets, packs and docs derive from it; never hard-code a setting
   anywhere else.

diff --git a/Enable-LoggingBaseline.ps1 b/Enable-LoggingBaseline.ps1
@@ -99,7 +99,7 @@ $ErrorActionPreference = 'Stop'
 if ([string]::IsNullOrEmpty($BaselineDir)) { $BaselineDir = Join-Path $PSScriptRoot 'Baseline' }
 if ([string]::IsNullOrEmpty($LogDir))      { $LogDir      = Join-Path $PSScriptRoot 'Logs' }
 
-. (Join-Path $PSScriptRoot 'LoggingBaseline.Settings.ps1')
+. (Join-Path $PSScriptRoot 'WinLogKit.Settings.ps1')
 . (Join-Path $PSScriptRoot 'WinLogKit.Common.ps1')
 
 # ---------------------------------------------------------------- helpers ---

diff --git a/New-LoggingBaseline.ps1 b/New-LoggingBaseline.ps1
@@ -91,7 +91,7 @@ Set-StrictMode -Version 2.0
 $ErrorActionPreference = 'Stop'
 if ([string]::IsNullOrEmpty($OutFile)) { $OutFile = Join-Path $PSScriptRoot 'MyBaseline.csv' }
 
-. (Join-Path $PSScriptRoot 'LoggingBaseline.Settings.ps1')
+. (Join-Path $PSScriptRoot 'WinLogKit.Settings.ps1')
 . (Join-Path $PSScriptRoot 'WinLogKit.Common.ps1')
 
 if ((Test-Path $OutFile) -and -not $Force -and -not $Show) {

diff --git a/PSScriptAnalyzerSettings.psd1 b/PSScriptAnalyzerSettings.psd1
@@ -7,7 +7,7 @@
         # The kit is an interactive console tool: Write-Host with colour IS the UI.
         'PSAvoidUsingWriteHost'
 
-        # LoggingBaseline.Settings.ps1 defines script-scope tables consumed by the
+        # WinLogKit.Settings.ps1 defines script-scope tables consumed by the
         # other scripts after dot-sourcing; per-file analysis cannot see that.
         'PSUseDeclaredVarsMoreThanAssignments'
 

diff --git a/README.md b/README.md
@@ -56,6 +56,9 @@ generator accept through `-BaselineFile`; `presets\` ships ready-made
 ones (ASD, Microsoft, and the kit's own `spydi_*` Minimal / Heavy pairs
 per role).
 
+The three host scripts are at the kit root; fleet generators (Intune, GPO,
+WEF) are in `fleet\` and the coverage report and WELA check in `report\`.
+
 If scripts are blocked, `Set-ExecutionPolicy -Scope Process RemoteSigned`
 unblocks the current window without persisting anything; downloaded zips
 also need `Unblock-File`, and a policy enforced by Group Policy cannot be

diff --git a/Test-LoggingBaseline.ps1 b/Test-LoggingBaseline.ps1
@@ -65,7 +65,7 @@ Set-StrictMode -Version 2.0
 $ErrorActionPreference = 'Stop'
 if ([string]::IsNullOrEmpty($OutputDir)) { $OutputDir = Join-Path $PSScriptRoot 'Results' }
 
-. (Join-Path $PSScriptRoot 'LoggingBaseline.Settings.ps1')
+. (Join-Path $PSScriptRoot 'WinLogKit.Settings.ps1')
 . (Join-Path $PSScriptRoot 'WinLogKit.Common.ps1')
 
 # ---------------------------------------------------------------- helpers ---

diff --git a/LoggingBaseline.Settings.ps1 → WinLogKit.Settings.ps1 b/LoggingBaseline.Settings.ps1 → WinLogKit.Settings.ps1
@@ -1,6 +1,6 @@
 # =============================================================================
-# LoggingBaseline.Settings.ps1
-# Shared settings table for Enable-LoggingBaseline.ps1 and Test-LoggingBaseline.ps1
+# WinLogKit.Settings.ps1
+# The settings table every kit script dot-sources.
 #
 # This is the single source of truth for the kit. Both the enable script and
 # the verification script dot-source this file, so they can never disagree

diff --git a/docs/baselines.md b/docs/baselines.md
@@ -7,7 +7,7 @@ ready-made lists we ship, how to build your own, and which one to pick.
 
 ## The model
 
-The settings table (`LoggingBaseline.Settings.ps1`) is the single source of
+The settings table (`WinLogKit.Settings.ps1`) is the single source of
 truth: every channel, audit subcategory, registry value and SMB audit
 setting, each with a plain-language purpose, a tier, a scope, behaviour
 category tags and - where it matters - a volume/stability risk note.
@@ -114,7 +114,7 @@ Usage is identical to any baseline CSV:
 ```powershell
 .\New-LoggingBaseline.ps1 -Show -BaselineFile .\presets\role_Workstation.csv
 .\Enable-LoggingBaseline.ps1 -BaselineFile .\presets\role_MemberServer.csv -WhatIf
-.\New-IntuneRemediationPack.ps1 -BaselineFile .\presets\role_Workstation.csv -OutDir .\Intune\Workstation
+.\fleet\New-IntuneRemediationPack.ps1 -BaselineFile .\presets\role_Workstation.csv -OutDir .\Intune\Workstation
 ```
 
 To customise a role, copy the CSV, flip `Selected` values in Excel, and keep
@@ -208,7 +208,7 @@ Notes, stated plainly:
   kit's heaviest setting.
 - Selection CSVs carry item choices, not sizes: the Security log stays at
   the kit's 1 GB (ASD suggests 2 GB; raise it in
-  `LoggingBaseline.Settings.ps1` if you take that view).
+  `WinLogKit.Settings.ps1` if you take that view).
 - A **GPO pack** generated from a `spydi_Server_*` preset includes the
   DC-only subcategories. They are inert on member servers and collectors
   (those events only generate on DCs), but if your GPO hygiene prefers

diff --git a/docs/commands.md b/docs/commands.md
@@ -1,14 +1,30 @@
 # Commands
 
-Every script, what it does, and the flags you'll actually use. They all
-read the same settings table (`LoggingBaseline.Settings.ps1`) and share one
-helper file (`WinLogKit.Common.ps1`), so - given
+Every script, what it does, and the flags you'll actually use. All of them
+except `Test-WefFilter.ps1` (which needs only its sidecar CSV) read the
+same settings table (`WinLogKit.Settings.ps1`) and share one helper file
+(`WinLogKit.Common.ps1`), so - given
 the same selection, and regenerating artefacts after any settings change -
 what you apply, what you verify and what you deploy can't disagree.
 All of the kit's scripts run on PowerShell 7 and on stock Windows
 PowerShell 5.1 - use whichever your host has. (WELA is Yamato's tool
 with its own requirements; `Invoke-WELACheck.ps1` drives it either way.)
 
+## Where the scripts live
+
+| Folder | Scripts | Run from |
+|---|---|---|
+| kit root | `New-`, `Enable-`, `Test-LoggingBaseline.ps1`, the settings table `WinLogKit.Settings.ps1`, the shared helpers `WinLogKit.Common.ps1` | the host you are configuring |
+| `fleet\` | `New-IntuneRemediationPack.ps1`, `New-GpoPack.ps1`, `New-WefSubscription.ps1`, `Test-WefFilter.ps1` | an admin workstation (generators); the collector (`Test-WefFilter`) |
+| `report\` | `Export-AttackCoverage.ps1`, `Invoke-WELACheck.ps1` | anywhere (coverage); the host (WELA) |
+| `tools\` | regenerators for presets, the Reference page and the WEF event map | maintainers |
+
+The root, `fleet\` and `report\` scripts read the settings table and
+helpers from the kit root and write their output (`Intune\`, `GPO\`, `WEF\`,
+`Results\`, `Evidence\`) there too, wherever they live. Two things stand
+alone by design: `Test-WefFilter.ps1` needs only its sidecar CSV, and the
+generated Intune pack carries everything it needs to the endpoint.
+
 ## Enable-LoggingBaseline.ps1
 
 Applies the baseline. Idempotent - already-correct items are reported and
@@ -65,7 +81,7 @@ which techniques it makes observable - and why the rest are not
 [Coverage](mapping.md).
 
 ```powershell
-.\Export-AttackCoverage.ps1 [-IncludeHighVolume] [-IncludeOptional] [-BaselineFile <csv>]
+.\report\Export-AttackCoverage.ps1 [-IncludeHighVolume] [-IncludeOptional] [-BaselineFile <csv>]
 ```
 
 ## Invoke-WELACheck.ps1
@@ -76,7 +92,7 @@ timestamped evidence. Locates WELA in `.\WELA\` or an unzipped
 `WELA-<version>\` folder; `-Download` fetches it from GitHub on request.
 
 ```powershell
-.\Invoke-WELACheck.ps1 [-Download] [-WelaPath <path>] [-Baseline YamatoSecurity|ASD|Microsoft_Client|Microsoft_Server]
+.\report\Invoke-WELACheck.ps1 [-Download] [-WelaPath <path>] [-Baseline YamatoSecurity|ASD|Microsoft_Client|Microsoft_Server]
 ```
 
 WELA's own commands, for reference (v2.1.0, verified against source; all
@@ -123,7 +139,7 @@ local event engine first. See
 [Collect - filtering with XPath](wec.md#filtering-with-xpath-matching-the-subscription-to-the-baseline).
 
 ```powershell
-.\New-WefSubscription.ps1 [-BaselineFile <csv>] [-Filter Channel|Baseline] [-Validate] [-SubscriptionId <name>] [-OutDir <dir>]
+.\fleet\New-WefSubscription.ps1 [-BaselineFile <csv>] [-Filter Channel|Baseline] [-Validate] [-SubscriptionId <name>] [-OutDir <dir>]
 ```
 
 ## Test-WefFilter.ps1
@@ -136,7 +152,7 @@ checks the deployed subscription's query matches the generated XML
 on any unexpected ID or mismatch.
 
 ```powershell
-.\Test-WefFilter.ps1 -ExpectedFile .\WEF\<name>.expected-eventids.csv [-SubscriptionId <name>] [-Hours 24]
+.\fleet\Test-WefFilter.ps1 -ExpectedFile .\WEF\<name>.expected-eventids.csv [-SubscriptionId <name>] [-Hours 24]
 ```
 
 ## New-GpoPack.ps1

diff --git a/docs/deployment.md b/docs/deployment.md
@@ -11,7 +11,7 @@ Central collection (WEF / WEC) has its own page: [Collect](wec.md).
 ## Intune (workstations and cloud-managed servers)
 
 ```powershell
-.\New-IntuneRemediationPack.ps1 [-BaselineFile <csv>] [-IncludeHighVolume] [-IncludeOptional]
+.\fleet\New-IntuneRemediationPack.ps1 [-BaselineFile <csv>] [-IncludeHighVolume] [-IncludeOptional]
 ```
 
 Produces a self-contained pair for Intune remediations:
@@ -35,7 +35,7 @@ which does not belong in unattended remediation).
 ## GPO (domain-joined fleets)
 
 ```powershell
-.\New-GpoPack.ps1 [-BaselineFile <csv>] [-IncludeHighVolume] [-IncludeOptional]
+.\fleet\New-GpoPack.ps1 [-BaselineFile <csv>] [-IncludeHighVolume] [-IncludeOptional]
 ```
 
 Produces:

diff --git a/docs/getting-started.md b/docs/getting-started.md
@@ -111,13 +111,13 @@ From an **elevated** Windows PowerShell prompt in the kit folder:
 .\Test-LoggingBaseline.ps1
 
 # 3. Decide on the high volume tier with evidence, then apply it.
-.\Export-AttackCoverage.ps1                    # what Core makes observable
-.\Export-AttackCoverage.ps1 -IncludeHighVolume # what HighVolume adds
+.\report\Export-AttackCoverage.ps1                    # what Core makes observable
+.\report\Export-AttackCoverage.ps1 -IncludeHighVolume # what HighVolume adds
 .\Enable-LoggingBaseline.ps1 -IncludeHighVolume
 .\Test-LoggingBaseline.ps1   -IncludeHighVolume
 
 # 4. Independent second opinion (fetches WELA once, on request).
-.\Invoke-WELACheck.ps1 -Download
+.\report\Invoke-WELACheck.ps1 -Download
 
 # Escape hatch: restore everything captured at first run.
 .\Enable-LoggingBaseline.ps1 -Rollback
@@ -143,6 +143,15 @@ stability risk, and `t` shows the whole tree at any point:
 Or start from a published reference: see
 [Baselines & Presets](baselines.md).
 
+## Where the scripts live
+
+The three host scripts sit at the kit root. Fleet generators are in
+`fleet\`, the coverage report and WELA check in `report\`; see
+[Commands](commands.md#where-the-scripts-live). Wherever a script lives, it
+reads the settings table from the root and writes its output there; the
+one that needs neither is `Test-WefFilter.ps1`, which runs on the collector
+from its sidecar CSV alone.
+
 ## Where things land
 
 | Folder | Contents |

diff --git a/docs/mapping.md b/docs/mapping.md
@@ -93,7 +93,7 @@ Reading it top to bottom:
   generated from them.
 - **One table**: every script - the builder, Enable, Test, the coverage
   report and all three fleet generators - dot-sources
-  `LoggingBaseline.Settings.ps1` (and the shared helpers in
+  `WinLogKit.Settings.ps1` (and the shared helpers in
   `WinLogKit.Common.ps1`), so applied config, deployed artefacts and
   verification can never disagree.
 - **Events out**: hosts write to the Windows Event Log service;
@@ -158,9 +158,9 @@ Two data files in `data/attack/` (provenance and attribution in its README):
    logging), one sourced row per claim.
 
 ```powershell
-.\Export-AttackCoverage.ps1                                        # Core tier
-.\Export-AttackCoverage.ps1 -IncludeHighVolume
-.\Export-AttackCoverage.ps1 -BaselineFile .\presets\role_Workstation.csv
+.\report\Export-AttackCoverage.ps1                                        # Core tier
+.\report\Export-AttackCoverage.ps1 -IncludeHighVolume
+.\report\Export-AttackCoverage.ps1 -BaselineFile .\presets\role_Workstation.csv
 ```
 
 Every technique verdict carries a reason:

diff --git a/docs/reference.md b/docs/reference.md
@@ -21,7 +21,7 @@ Reading the columns:
   **S** = Microsoft Server, **Y** = Yamato (per the shipped reference
   presets; kit-added extras such as the Server 2025 SMB auditing and the
   NTLM audit values show no reference letter and are sourced in the
-  [settings table](https://github.com/spydisec/WinLogKit/blob/main/LoggingBaseline.Settings.ps1)).
+  [settings table](https://github.com/spydisec/WinLogKit/blob/main/WinLogKit.Settings.ps1)).
 - **Minimal / Heavy** - membership in `spydi_Server_Minimal` /
   `spydi_Server_Heavy` (the superset role presets; rows marked **(DC)** are
   deselected in the Workstation variants and inert off domain controllers).

diff --git a/docs/wec.md b/docs/wec.md
@@ -30,7 +30,7 @@ worked example for Microsoft Sentinel is kept as an
 ## Generate the subscription
 
 ```powershell
-.\New-WefSubscription.ps1 [-BaselineFile <csv>] [-Filter Channel|Baseline] [-Validate] [-SubscriptionId <name>]
+.\fleet\New-WefSubscription.ps1 [-BaselineFile <csv>] [-Filter Channel|Baseline] [-Validate] [-SubscriptionId <name>]
 ```
 
 Generates a source-initiated subscription XML with one query per selected

diff --git a/New-GpoPack.ps1 → fleet/New-GpoPack.ps1 b/New-GpoPack.ps1 → fleet/New-GpoPack.ps1
@@ -42,14 +42,14 @@
     switches decide (Core by default).
 
 .PARAMETER OutDir
-    Output folder. Default: .\GPO next to this script.
+    Output folder. Default: GPO\ at the kit root (the parent of fleet\).
 
 .EXAMPLE
-    .\New-GpoPack.ps1 -IncludeHighVolume
+    .\fleet\New-GpoPack.ps1 -IncludeHighVolume
     Core + HighVolume audit policy and registry artefacts.
 
 .EXAMPLE
-    .\New-GpoPack.ps1 -BaselineFile .\presets\Microsoft_Server.csv -OutDir .\GPO\MSServer
+    .\fleet\New-GpoPack.ps1 -BaselineFile .\presets\Microsoft_Server.csv -OutDir .\GPO\MSServer
 #>
 [CmdletBinding()]
 param(
@@ -63,10 +63,13 @@ param(
 
 Set-StrictMode -Version 2.0
 $ErrorActionPreference = 'Stop'
-if ([string]::IsNullOrEmpty($OutDir)) { $OutDir = Join-Path $PSScriptRoot 'GPO' }
+# This script lives in fleet\; the settings table, shared helpers, data
+# and output folders are at the kit root.
+$kitRoot = Split-Path $PSScriptRoot -Parent
+if ([string]::IsNullOrEmpty($OutDir)) { $OutDir = Join-Path $kitRoot 'GPO' }
 
-. (Join-Path $PSScriptRoot 'LoggingBaseline.Settings.ps1')
-. (Join-Path $PSScriptRoot 'WinLogKit.Common.ps1')
+. (Join-Path $kitRoot 'WinLogKit.Settings.ps1')
+. (Join-Path $kitRoot 'WinLogKit.Common.ps1')
 
 $sel = Resolve-BaselineSelection -BaselineFile $BaselineFile -IncludeHighVolume $IncludeHighVolume -IncludeOptional $IncludeOptional
 
@@ -140,12 +143,12 @@ if ($auditCount -lt $totalAudit) {
     Write-Host ("PARTIAL SELECTION: audit.csv covers {0} of {1} kit subcategories. Apply semantics for the others depend on the tool " -f $auditCount, $totalAudit) -ForegroundColor Yellow
     Write-Host 'and existing policy (LGPO /ac and GPO application may not preserve unlisted subcategories). After applying, ALWAYS verify' -ForegroundColor Yellow
     $verifyArgs = ''
-    if ($null -ne $sel.Map) { $verifyArgs = " -BaselineFile `"$BaselineFile`"" }
+    if ($null -ne $sel.Map) { $verifyArgs = " -BaselineFile `"$((Resolve-Path $BaselineFile).Path)`"" }
     else {
         if ($IncludeHighVolume) { $verifyArgs += ' -IncludeHighVolume' }
         if ($IncludeOptional)   { $verifyArgs += ' -IncludeOptional' }
     }
-    Write-Host "the effective result: .\Test-LoggingBaseline.ps1$verifyArgs (it reads the live audit policy, not the file you applied)." -ForegroundColor Yellow
+    Write-Host "the effective result: & `"$(Join-Path $kitRoot 'Test-LoggingBaseline.ps1')`"$verifyArgs (it reads the live audit policy, not the file you applied)." -ForegroundColor Yellow
 }
 Write-Host 'Note: LGPO /t is additive - deselected registry values are NOT removed by a smaller pack. Use Enable-LoggingBaseline -Rollback or remove them deliberately.' -ForegroundColor Yellow
 exit 0
diff --git a/New-IntuneRemediationPack.ps1 → fleet/New-IntuneRemediationPack.ps1 b/New-IntuneRemediationPack.ps1 → fleet/New-IntuneRemediationPack.ps1
@@ -34,7 +34,7 @@
     Requires: Windows PowerShell 5.1+. No admin needed to generate.
 
 .PARAMETER OutDir
-    Where to write the pair. Default: .\Intune next to this script.
+    Where to write the pair. Default: Intune\ at the kit root (the parent of fleet\).
 
 .PARAMETER BaselineFile
     Optional selection CSV from New-LoggingBaseline.ps1. Only Selected = Y
@@ -48,11 +48,11 @@
     Without -BaselineFile: also embed Optional tier items.
 
 .EXAMPLE
-    .\New-IntuneRemediationPack.ps1
+    .\fleet\New-IntuneRemediationPack.ps1
     Recommended (Core) pack into .\Intune\.
 
 .EXAMPLE
-    .\New-IntuneRemediationPack.ps1 -BaselineFile .\WorkstationBaseline.csv -OutDir .\Intune\Workstation
+    .\fleet\New-IntuneRemediationPack.ps1 -BaselineFile .\WorkstationBaseline.csv -OutDir .\Intune\Workstation
     Pack for a role-specific baseline built with New-LoggingBaseline.ps1.
 #>
 [CmdletBinding()]
@@ -67,10 +67,13 @@ param(
 
 Set-StrictMode -Version 2.0
 $ErrorActionPreference = 'Stop'
-if ([string]::IsNullOrEmpty($OutDir)) { $OutDir = Join-Path $PSScriptRoot 'Intune' }
+# This script lives in fleet\; the settings table, shared helpers, data
+# and output folders are at the kit root.
+$kitRoot = Split-Path $PSScriptRoot -Parent
+if ([string]::IsNullOrEmpty($OutDir)) { $OutDir = Join-Path $kitRoot 'Intune' }
 
-. (Join-Path $PSScriptRoot 'LoggingBaseline.Settings.ps1')
-. (Join-Path $PSScriptRoot 'WinLogKit.Common.ps1')
+. (Join-Path $kitRoot 'WinLogKit.Settings.ps1')
+. (Join-Path $kitRoot 'WinLogKit.Common.ps1')
 
 # ---------------------------------------------------------- item selection ---