Enforce Mandatory Desktop Classification Markings

No. NetMark runs under standard user context (asInvoker). The Windows AppBar registration API permits standard processes to reserve screen space on their own session. No UAC prompt will ever appear. This is critical for environments where end users do not have local admin rights, and for RDS session host users on shared hosts.

Yes. NetMark is fully supported on Windows Server 2016, 2019, 2022, and 2025, including RDS (Remote Desktop Services) session hosts. Each RDS session gets its own banner instance via per-session mutex isolation—the console session and each concurrent RDP user see their own classification level independently. The global mutex prevents duplicate instances within a single session, while allowing correct per-session operation on multi-user hosts.

Yes. Place a pre-configured NetMark.ini in the same folder as the EXE before launch. NetMark detects the existing INI and skips the configurator auto-open. The HTML configurator is still extracted to disk but is not launched. This is the recommended deployment pattern for production environments.

The UI utilizes the WS_EX_TRANSPARENT extended window style and returns HTTRANSPARENT from WM_NCHITTEST. This instructs the OS compositor to pass all mouse and hit-test events directly to the window beneath. The banner will never accidentally steal focus or intercept clicks meant for applications—critical for admin consoles, Hyper-V managers, and RDP management windows.

NetMark monitors both sides of an RDP session. On the client side (running mstsc), it detects full-screen RDP windows and hides the local banner so the remote host's own classification markings are visible without overlap. On the RDS session host side, it detects remote vs. console sessions via GetSystemMetrics(SM_REMOTESESSION) and WTS session change notifications, showing the banner per-session so each remote user sees the correct classification level.

The banner and reserved screen space disappear immediately, returning the desktop to its normal state. The AppBar registration is cleaned up automatically via ABM_REMOVE on process shutdown. For high-security environments requiring guaranteed uptime, deploy NetMark via a Scheduled Task with a 1-minute restart trigger—if the process is killed, it relaunches within 60 seconds automatically.

Yes. Since each machine has its own NetMark.ini, you can deploy different INI files to different machine groups. For example, deploy a SECRET INI to SCIF hosts, an UNCLASSIFIED INI to general office desktops, and a CUI INI to healthcare application servers. Use SCCM collections, Intune groups, or GPO item-level targeting to control which INI file reaches which endpoint.

Yes. NetMark uses PerMonitorV2 DPI awareness, which means each monitor renders at its native DPI scale. The banner height, font size, and border thickness are all rendered correctly on both 100% and 200% (4K) monitors simultaneously. No blurry text, no mismatched banner heights. Works on multi-monitor desktop setups and RDS session hosts with multi-monitor remote desktop configurations.