Skip to content

Harden Windows Security Module

It is a PowerShell module that can apply all of the hardening measures described in the readme. It also offers rigorous compliance verification and security assessment. It enables you to evaluate the conformity of your system based on the security standards and recommendations of this repository. The module employs various techniques such as Security Policy, PowerShell cmdlet and Registry keys to conduct the checks.

It is also useful for security researchers and penetration testers who want to assess their system security posture. The module works with any system locale and language.

Automatic Updates

The module checks for updates every time you run it and updates itself if there is a new version available, so you don't have to manually do anything.


horizontal super thin rainbow RGB line


How to Install and Use

Install-Module -Name 'Harden-Windows-Security-Module' -Force

rainbow Use the GUI (Graphical User Interface)

Protect-WindowsSecurity -GUI

sailor moon heart Apply the Hardening measures described in the Readme

Protect-WindowsSecurity

Strawberry milk Perform Compliance Check

Confirm-SystemCompliance

stileto Remove the Hardening Measures Described in The Readme

Unprotect-WindowsSecurity

glowing sticks Uninstall the Harden Windows Security Module

Uninstall-Module -Name 'Harden-Windows-Security-Module' -Force -AllVersions


horizontal super thin rainbow RGB line


Quick Demo



horizontal super thin rainbow RGB line


Protect-WindowsSecurity

Syntax

Protect-WindowsSecurity
    [-GUI]
    [-Categories <String[]>]
    [-Log]
    [-Offline]
    [<CommonParameters>]

Description

The Protect-WindowsSecurity cmdlet's hybrid design allows it to operate as a standalone script and as a module component. It allows it to operate with and without administrator privileges. You can use this cmdlet in both interactive and non-interactive modes.

In Interactive mode, the cmdlet will ask you to confirm the changes before applying them. In non-interactive mode, you can pre-configure the hardening categories you want to apply and the cmdlet will apply them without asking for confirmation.

It possesses the ability to operate entirely in isolation, useful for systems or servers that are disconnected from the Internet.

Parameters

-GUI

Shows a graphical user interface (GUI) that allows you to select the hardening categories you want to apply.

Tip

In the GUI experience:

  • Toast Notification is displayed when all of the selected categories are applied.
  • When using the logging feature, the log file will be created in the path you selected once the GUI is closed.


Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-Categories

Specify the hardening categories that you want to apply. This will tell the module to operate in non-interactive or headless/silent mode which won't ask for confirmation before running each selected categories.

You can specify multiple categories by separating them with a comma. If you don't specify any category, the cmdlet will run in interactive mode. Use this parameter for deployments at a large scale.

If a selected category requires Administrator privileges and the module is running with Standard privileges, that category is skipped.

This parameter has automatic tab completion. You can press the Tab key to see the available categories.

Type: String[]
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-Verbose

Shows verbose messages on the console about what the cmdlet is doing.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-Log

Activates comprehensive logging by recording all the information shown on the screen and some additional data to a text file. It is strongly advised to use the -Verbose parameter when you want to enable logging.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-LogPath

The path to save the log file to. If not specified, the log file will be saved in the current working directory.

Note

Only available if the -Log switch is used.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-Offline

Indicates that the module is being run in offline mode. Will not download any files from the internet. Will not check for updates. Using this parameter will make the following 3 parameters available and mandatory: PathToLGPO, PathToMSFTSecurityBaselines and PathToMSFT365AppsSecurityBaselines.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-PathToLGPO

The path to the 'LGPO.zip'. Make sure it's in the zip format just like it's downloaded from the Microsoft servers. File name can be anything. The parameter has argument completer so you can press tab and use the file picker GUI to select the zip file.

Note

Only available if the -Offline switch is used.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-PathToMSFTSecurityBaselines

The path to the 'Windows Security Baseline.zip'. Make sure it's in the zip format just like it's downloaded from the Microsoft servers. File name can be anything. The parameter has argument completer so you can press tab and use the file picker GUI to select the zip file.

Note

Only available if the -Offline switch is used.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-PathToMSFT365AppsSecurityBaselines

The path to the 'Microsoft 365 Apps for Enterprise zip'. Make sure it's in the zip format just like it's downloaded from the Microsoft servers. File name can be anything. The parameter has argument completer so you can press tab and use the file picker GUI to select the zip file.

Note

Only available if the -Offline switch is used.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False


Note

You can further control the sub-categories of each category by using the following switch parameters. Pay attention to the naming convention of them. They are named after the category they belong to. For example, the switch parameter -MSFTDefender_SAC belongs to the MicrosoftDefender category. The switch parameters are dynamic and will only appear if you specify the corresponding category in the -Categories parameter. For example, if you don't specify the MicrosoftDefender category in the -Categories parameter, the switch parameters related to it won't appear. The following table shows the available switch parameters and their corresponding categories.


Parameter Name Description Required Category
-SecBaselines_NoOverrides Applies the Microsoft Security Baselines without the optional overrides MicrosoftSecurityBaselines
-MSFTDefender_SAC Enables Smart App Control MicrosoftDefender
-MSFTDefender_NoDiagData Will not enable optional diagnostics data required for Smart App Control (Does not have any effect if Smart App Control is already turned on) MicrosoftDefender
-MSFTDefender_NoScheduledTask Will not create scheduled task for fast MSFT driver block rules MicrosoftDefender
-MSFTDefender_BetaChannels Set Defender Engine and Intelligence update channels to beta MicrosoftDefender
-LockScreen_CtrlAltDel Require CTRL + ALT + Delete at lock screen LockScreen
-LockScreen_NoLastSignedIn Will not display the last signed in user at the lock screen LockScreen
-UAC_NoFastSwitching Hide entry points for fast user switching UserAccountControl
-UAC_OnlyElevateSigned Only elevate signed and validated executables UserAccountControl
-CountryIPBlocking_OFAC Include the IP ranges of OFAC Sanctioned Countries in the firewall block rules CountryIPBlocking


What if You Don’t Configure the Sub-Categories?

If you do not specify any sub-categories using the switch parameters above, the following sub-category configuration will be applied when the corresponding category exists in the -Categories parameter.


Indicator Sub-Category Status
planet rainbow heart indicating item that runs in Windows Hardening module Is Applied
spinning random dots indicating the sub-category won't run in headless mode in Windows Hardening module Is Not Applied


  • Microsoft Security Baselines
    • planet rainbow heart indicating item that runs in Windows Hardening module Yes, With the Optional Overrides (Recommended)
    • spinning random dots indicating the sub-category won't run in headless mode in Windows Hardening module Yes
  • Microsoft 365 Apps Security Baselines
  • Microsoft Defender
    • spinning random dots indicating the sub-category won't run in headless mode in Windows Hardening module Smart App Control enablement
    • planet rainbow heart indicating item that runs in Windows Hardening module Enable advanced diagnostic data if Smart App Control is on
    • planet rainbow heart indicating item that runs in Windows Hardening module Scheduled task creation for fast weekly MSFT driver block list update
    • spinning random dots indicating the sub-category won't run in headless mode in Windows Hardening module Set engine and intelligence update channels to beta
  • Attack Surface Reduction Rules
  • BitLocker Settings
    • spinning random dots indicating the sub-category won't run in headless mode in Windows Hardening module Normal: TPM + Startup PIN + Recovery Password
    • spinning random dots indicating the sub-category won't run in headless mode in Windows Hardening module Enhanced: TPM + Startup PIN + Startup Key + Recovery Password
    • planet rainbow heart indicating item that runs in Windows Hardening module Skip encryptions altogether
  • TLS Security
  • Lock Screen
    • spinning random dots indicating the sub-category won't run in headless mode in Windows Hardening module Don't display last signed-in
    • spinning random dots indicating the sub-category won't run in headless mode in Windows Hardening module Require CTRL + ALT + DEL on lock screen
  • User Account Control
    • spinning random dots indicating the sub-category won't run in headless mode in Windows Hardening module Only elevate signed and validated executables
    • spinning random dots indicating the sub-category won't run in headless mode in Windows Hardening module Hide the entry points for Fast User Switching
  • Windows Firewall
  • Optional Windows Features
  • Windows Networking
  • Miscellaneous Configurations
  • Windows Update Configurations
  • Edge Browser Configurations
  • Certificate Checking Commands
  • Country IP Blocking
    • planet rainbow heart indicating item that runs in Windows Hardening module Block State Sponsors of Terrorism IP blocks
    • spinning random dots indicating the sub-category won't run in headless mode in Windows Hardening module Block OFAC Sanctioned Countries IP blocks
  • Downloads Defense Measures
  • Non-Admin Commands


Important

It is highly recommended to always include the Microsoft Security Baselines category and place it first as it forms the foundation of all subsequent categories.


Examples

Example 1

If you run the module like this without specifying any categories, the module will run in interactive mode and the usual beautiful prompts will be displayed to the user.

Protect-WindowsSecurity

Example 2

If you run the module like this, the 2 categories will be executed automatically without requiring any user input. The results will be displayed on the console.

Protect-WindowsSecurity -Categories MicrosoftDefender, AttackSurfaceReductionRules

Example 3

This example will apply the Microsoft Defender category with the Smart App Control sub-category, without the need for user interaction, and will show verbose messages.

Protect-WindowsSecurity -Categories MicrosoftDefender -MSFTDefender_SAC -Verbose

Example 4

This example will apply the Microsoft Security Baselines, BitLocker, User Account Control, Lock Screen and Downloads Defense Measures categories. It will also apply the "Only Elevate Signed and Validated Executables" sub-category of the User Account Control category, and the "Require CTRL + ALT + DEL on Lock Screen" sub-category of the Lock Screen category.

Protect-WindowsSecurity -Categories MicrosoftSecurityBaselines,BitLockerSettings,UserAccountControl,LockScreen,DownloadsDefenseMeasures -UAC_OnlyElevateSigned -LockScreen_CtrlAltDel

Example 5

This example instructs the cmdlet to run in offline mode and will not download any files from the internet. It also runs it in headless/silent mode by specifying which categories to automatically run. -MSFTDefender_SAC switch is used so the Smart App Control sub-category is also applied in the headless/silent mode. -Log switch is mentioned which will save the output of the cmdlet to a text file in the current working directory.

Protect-WindowsSecurity -Verbose -Offline -PathToLGPO 'C:\Users\Admin\Desktop\LGPO.zip' -PathToMSFTSecurityBaselines 'C:\Users\Admin\Desktop\Baselines.zip' -PathToMSFT365AppsSecurityBaselines 'C:\Users\Admin\Desktop\M365Baselines.zip' -Log -Categories MicrosoftSecurityBaselines,MicrosoftDefender -MSFTDefender_SAC

Example 6

This will display a GUI (Graphical UI) allowing you to easily select various options and categories to apply.

Protect-WindowsSecurity -GUI


horizontal super thin rainbow RGB line


Confirm-SystemCompliance

Syntax

Confirm-SystemCompliance
    [-Categories]
    [-ExportToCSV]
    [-ShowAsObjectsOnly]
    [-DetailedDisplay]

Description

This cmdlet verifies and validates all of the applied security measures. It checks registry keys if the module uses Group Policy or registry, PowerShell cmdlets if the module invokes them and Security Group Policy if the module applies them.

Compliance checking strictly follows the guidelines and security measures of this GitHub repository. Any minor deviation from them will result in a false value for the corresponding check.

Note

Based on the score that you get you will see a different ASCII art!

Parameters

-Categories

Specify the categories to check compliance for. If not specified, all categories will be checked.

Type: String[]
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-ExportToCSV

In addition to displaying the results on the screen, also exports them in a nicely formatted CSV for easier viewing. The CSV is fully compatible with GitHub too so you can upload it to GitHub and view it.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-ShowAsObjectsOnly

Instead of displaying strings on the console, outputs actionable objects and properties. You can use this parameter for when you need to store the output of the function in a variable and use it that way. This provides a very detailed nested object and suppresses the normal string output on the console.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-DetailedDisplay

Shows the output on the PowerShell console with more details and in the list format instead of table format

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False


horizontal super thin rainbow RGB line


Unprotect-WindowsSecurity Cmdlet

Syntax

Unprotect-WindowsSecurity
    [-OnlyProcessMitigations]
    [-OnlyDownloadsDefenseMeasures]
    [-OnlyCountryIPBlockingFirewallRules]
    [-Force]

Description

You can use this cmdlet to remove all of the applied hardening measures, with the following exceptions:

  • Bitlocker Encrypted drives are not decrypted when you invoke this cmdlet.

  • Security features related to Device Guard that are activated by UEFI Lock remain enabled even after you execute this cmdlet. Learn more here

  • Windows optional features that are enabled or disabled by Protect-WindowsSecurity cmdlet are not affected.

Parameters

-OnlyProcessMitigations

Indicates that the cmdlet will only remove Process Mitigations (Exploit Protection) settings and doesn't change anything else.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-OnlyDownloadsDefenseMeasures

Indicates that the cmdlet will only remove the Downloads Defense Measures WDAC policy from the system and doesn't change anything else.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False


-OnlyCountryIPBlockingFirewallRules

Indicates that the cmdlet will only remove the country IP blocking firewall rules and doesn't change anything else.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False


horizontal super thin rainbow RGB line



Any feedback or suggestions? Please use GitHub issues or discussions