Harden‐Windows‐Security‐Module
It is a PowerShell module that can apply all of the hardening measures described in the readme. It also offers rigorous compliance verification and security assessment. It enables you to evaluate the conformity of your system based on the security standards and recommendations of this repository. The module employs various techniques such as Security Policy, PowerShell cmdlet, Registry keys, CIM and Windows APIs to conduct the checks.
It is also useful for security researchers and penetration testers who want to assess their system security posture. The module works with any system locale and language.
It is fully capable of performing compliance checks for policies applied through Intune using modern workplace management MDM.
The module checks for updates every time you run it and updates itself if there is a new version available, so you don't have to manually do anything.
Install the Harden Windows Security Module from PowerShell Gallery
Install-Module -Name 'Harden-Windows-Security-Module' -Force
Use the GUI (Graphical User Interface)Protect-WindowsSecurity -GUI
Apply the Hardening measures described in the Readme
Protect-WindowsSecurity
Perform Compliance CheckConfirm-SystemCompliance
Remove the Hardening Measures Described in The Readme
Unprotect-WindowsSecurity
Uninstall the Harden Windows Security ModuleUninstall-Module -Name 'Harden-Windows-Security-Module' -Force -AllVersions
Confirm-SystemCompliance.mp4
Protect-WindowsSecurity
[-GUI]
[-Categories <String[]>]
[-Log]
[-Offline]
[<CommonParameters>]The Protect-WindowsSecurity cmdlet's hybrid design allows it to operate with and without administrator privileges. You can use this cmdlet in both interactive and non-interactive modes.
In Interactive mode, the cmdlet will ask you to confirm the changes before applying them. In non-interactive mode, you can pre-configure the hardening categories you want to apply and the cmdlet will apply them without asking for confirmation.
It possesses the ability to operate entirely in isolation, useful for systems or servers that are disconnected from the Internet.
Shows a graphical user interface (GUI) that allows you to select the hardening categories you want to apply.
Tip
In the GUI experience:
- Toast Notification is displayed when all of the selected categories are applied.
- When using the logging feature, the log file will be created in the path you selected once the GUI is closed.
| Type: | SwitchParameter |
|---|---|
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Specify the hardening categories that you want to apply. This will tell the module to operate in non-interactive or headless/silent mode which won't ask for confirmation before running each selected categories.
You can specify multiple categories by separating them with a comma. If you don't specify any category, the cmdlet will run in interactive mode. Use this parameter for deployments at a large scale.
If a selected category requires Administrator privileges and the module is running with Standard privileges, that category is skipped.
This parameter has automatic tab completion. You can press the Tab key to see the available categories.
| Type: | String[] |
|---|---|
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Shows verbose messages on the console about what the cmdlet is doing.
| Type: | SwitchParameter |
|---|---|
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Activates comprehensive logging by recording all the information shown on the screen and some additional data to a text file. It is strongly advised to use the -Verbose parameter when you want to enable logging.
| Type: | SwitchParameter |
|---|---|
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
The path to save the log file to. If not specified, the log file will be saved in the current working directory.
Note
Only available if the -Log switch is used.
| Type: | SwitchParameter |
|---|---|
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Indicates that the module is being run in offline mode. Will not download any files from the internet. Will not check for updates. Using this parameter will make the following 3 parameters available and mandatory: PathToLGPO, PathToMSFTSecurityBaselines and PathToMSFT365AppsSecurityBaselines.
| Type: | SwitchParameter |
|---|---|
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
The path to the 'LGPO.zip'. Make sure it's in the zip format just like it's downloaded from the Microsoft servers. File name can be anything. The parameter has argument completer so you can press tab and use the file picker GUI to select the zip file.
Note
Only available if the -Offline switch is used.
| Type: | SwitchParameter |
|---|---|
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
The path to the 'Windows Security Baseline.zip'. Make sure it's in the zip format just like it's downloaded from the Microsoft servers. File name can be anything. The parameter has argument completer so you can press tab and use the file picker GUI to select the zip file.
Note
Only available if the -Offline switch is used.
| Type: | SwitchParameter |
|---|---|
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
The path to the 'Microsoft 365 Apps for Enterprise zip'. Make sure it's in the zip format just like it's downloaded from the Microsoft servers. File name can be anything. The parameter has argument completer so you can press tab and use the file picker GUI to select the zip file.
Note
Only available if the -Offline switch is used.
| Type: | SwitchParameter |
|---|---|
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Note
You can control the sub-categories of each category by using the following switch parameters on the Command-line.
Pay attention to the naming convention of them. They are named after the category they belong to.
The switch parameters are dynamic and will only appear if you specify the corresponding category in the -Categories parameter. The following table shows the available switch parameters and their corresponding required categories.
| Parameter Name | Description | Required Category |
|---|---|---|
| SecBaselines_NoOverrides | Applies the Microsoft Security Baselines without the optional overrides | MicrosoftSecurityBaselines |
| MSFTDefender_SAC | Enables Smart App Control | MicrosoftDefender |
| MSFTDefender_NoDiagData | Will not enable optional diagnostics data required for Smart App Control (Does not have any effect if Smart App Control is already turned on) | MicrosoftDefender |
| MSFTDefender_NoScheduledTask | Will not create scheduled task for fast MSFT driver block rules | MicrosoftDefender |
| MSFTDefender_BetaChannels | Set Defender Engine and Intelligence update channels to beta | MicrosoftDefender |
| LockScreen_CtrlAltDel | Require CTRL + ALT + Delete at lock screen | LockScreen |
| LockScreen_NoLastSignedIn | Will not display the last signed in user at the lock screen | LockScreen |
| UAC_NoFastSwitching | Hide entry points for fast user switching | UserAccountControl |
| UAC_OnlyElevateSigned | Only elevate signed and validated executables | UserAccountControl |
| CountryIPBlocking_OFAC | Include the IP ranges of OFAC Sanctioned Countries in the firewall block rules | CountryIPBlocking |
| DangerousScriptHostsBlocking | Deploys the Dangerous Script Hosts Blocking WDAC Policy | DownloadsDefenseMeasures |
| ClipboardSync | Enables Clipboard Sync with Microsoft Account | NonAdminCommands |
Important
It is highly recommended to always include the Microsoft Security Baselines category and place it first as it forms the foundation of all subsequent categories.
If you run the module like this without specifying any categories, the module will run in interactive mode and the usual beautiful prompts will be displayed to the user.
Protect-WindowsSecurityThis will display a GUI (Graphical UI) allowing you to easily select various options and categories to apply.
Protect-WindowsSecurity -GUIIf you run the module like this, the 2 categories will be executed automatically without requiring any user input. The results will be displayed on the console.
Protect-WindowsSecurity -Categories MicrosoftDefender, AttackSurfaceReductionRulesThis example will apply the Microsoft Defender category with the Smart App Control sub-category, without the need for user interaction, and will show verbose messages.
Protect-WindowsSecurity -Categories MicrosoftDefender -MSFTDefender_SAC -VerboseThis example will apply the Microsoft Security Baselines, BitLocker, User Account Control, Lock Screen and Downloads Defense Measures categories. It will also apply the "Only Elevate Signed and Validated Executables" sub-category of the User Account Control category, and the "Require CTRL + ALT + DEL on Lock Screen" sub-category of the Lock Screen category.
Protect-WindowsSecurity -Categories MicrosoftSecurityBaselines,BitLockerSettings,UserAccountControl,LockScreen,DownloadsDefenseMeasures -UAC_OnlyElevateSigned -LockScreen_CtrlAltDelThis example instructs the cmdlet to run in offline mode and will not download any files from the internet. It also runs it in headless/silent mode by specifying which categories to automatically run. -MSFTDefender_SAC switch is used so the Smart App Control sub-category is also applied in the headless/silent mode. -Log switch is mentioned which will save the output of the cmdlet to a text file in the current working directory.
Protect-WindowsSecurity -Verbose -Offline -PathToLGPO 'C:\Users\Admin\Desktop\LGPO.zip' -PathToMSFTSecurityBaselines 'C:\Users\Admin\Desktop\Baselines.zip' -PathToMSFT365AppsSecurityBaselines 'C:\Users\Admin\Desktop\M365Baselines.zip' -Log -Categories MicrosoftSecurityBaselines,MicrosoftDefender -MSFTDefender_SAC
Confirm-SystemCompliance
[-Categories]
[-ExportToCSV]
[-ShowAsObjectsOnly]
[-DetailedDisplay]
[-Offline]This cmdlet verifies and validates all of the applied security measures described on the Readme page. Compliance checking strictly follows the guidelines and security measures of this GitHub repository. Any minor deviation from them will result in a false value for the corresponding check.
The policies can be applied via a wide variety of ways and they will all be detected:
- Intune
- CIM
- Registry keys
- Group Policies
- PowerShell cmdlets
Note
Based on the score that you get you will see a different ASCII art!
Specify the categories to check compliance for. If not specified, all categories will be checked.
| Type: | String[] |
|---|---|
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
In addition to displaying the results on the screen, also exports them in a nicely formatted CSV for easier viewing. The CSV is fully compatible with GitHub too so you can upload it to GitHub and view it.
| Type: | SwitchParameter |
|---|---|
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Instead of displaying strings on the console, outputs actionable objects and properties. You can use this parameter for when you need to store the output of the function in a variable and use it that way. This provides a very detailed nested object and suppresses the normal string output on the console.
| Type: | SwitchParameter |
|---|---|
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Shows the output on the PowerShell console with more details and in the list format instead of table format
| Type: | SwitchParameter |
|---|---|
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Skips the online update check and allows you to run the cmdlet in completely offline mode.
| Type: | SwitchParameter |
|---|---|
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Unprotect-WindowsSecurity
[-OnlyProcessMitigations]
[-OnlyCountryIPBlockingFirewallRules]
[-WDACPoliciesToRemove <String[]>]
[-Force]You can use this cmdlet to remove all of the applied hardening measures, with the following exceptions:
-
Bitlocker Encrypted drives are not decrypted when you invoke this cmdlet.
-
Security features related to Device Guard that are activated by UEFI Lock remain enabled even after you execute this cmdlet. Learn more here
-
Windows optional features that are enabled or disabled by
Protect-WindowsSecuritycmdlet are not affected.
Indicates that the cmdlet will only remove Process Mitigations (Exploit Protection) settings and doesn't change anything else.
| Type: | SwitchParameter |
|---|---|
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Select the WDAC Policy names to remove.
| Type: | String[] |
|---|---|
| Position: | Named |
| Default value: | None |
| Accepted values: |
Dangerous-Script-Hosts-Blocking, Downloads-Defense-Measures
|
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Indicates that the cmdlet will only remove the country IP blocking firewall rules and doesn't change anything else.
| Type: | SwitchParameter |
|---|---|
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Any feedback or suggestions? Please use GitHub issues or discussions
- Create AppControl Policy
- Create Supplemental Policy
- System Information
- Configure Policy Rule Options
- Simulation
- Allow New Apps
- Build New Certificate
- Create Policy From Event Logs
- Create Policy From MDE Advanced Hunting
- Create Deny Policy
- Merge App Control Policies
- Deploy App Control Policy
- Get Code Integrity Hashes
- Get Secure Policy Settings
- Update
- Sidebar
- Validate Policies
- View File Certificates
- Introduction
- How To Generate Audit Logs via App Control Policies
- How To Create an App Control Supplemental Policy
- The Strength of Signed App Control Policies
- How To Upload App Control Policies To Intune Using AppControl Manager
- How To Create and Maintain Strict Kernel‐Mode App Control Policy
- How to Create an App Control Deny Policy
- App Control Notes
- How to use Windows Server to Create App Control Code Signing Certificate
- Fast and Automatic Microsoft Recommended Driver Block Rules updates
- App Control policy for BYOVD Kernel mode only protection
- EKUs in App Control for Business Policies
- App Control Rule Levels Comparison and Guide
- Script Enforcement and PowerShell Constrained Language Mode in App Control Policies
- How to Use Microsoft Defender for Endpoint Advanced Hunting With App Control
- App Control Frequently Asked Questions (FAQs)
- Create Bootable USB flash drive with no 3rd party tools
- Event Viewer
- Group Policy
- How to compact your OS and free up extra space
- Hyper V
- Overrides for Microsoft Security Baseline
- Git GitHub Desktop and Mandatory ASLR
- Signed and Verified commits with GitHub desktop
- About TLS, DNS, Encryption and OPSEC concepts
- Things to do when clean installing Windows
- Comparison of security benchmarks
- BitLocker, TPM and Pluton | What Are They and How Do They Work
- How to Detect Changes in User and Local Machine Certificate Stores in Real Time Using PowerShell
- Cloning Personal and Enterprise Repositories Using GitHub Desktop
- Only a Small Portion of The Windows OS Security Apparatus
- Rethinking Trust: Advanced Security Measures for High‐Stakes Systems
- Clean Source principle, Azure and Privileged Access Workstations
- How to Securely Connect to Azure VMs and Use RDP
- Basic PowerShell tricks and notes
- Basic PowerShell tricks and notes Part 2
- Basic PowerShell tricks and notes Part 3
- Basic PowerShell tricks and notes Part 4
- Basic PowerShell tricks and notes Part 5
- How To Access All Stream Outputs From Thread Jobs In PowerShell In Real Time
- PowerShell Best Practices To Follow When Coding
- How To Asynchronously Access All Stream Outputs From Background Jobs In PowerShell
- Powershell Dynamic Parameters and How to Add Them to the Get‐Help Syntax
- RunSpaces In PowerShell
- How To Use Reflection And Prevent Using Internal & Private C# Methods in PowerShell
