One script. 150+ checks. Harden Windows 10/11 in minutes.
An interactive PowerShell tool that audits and hardens your Windows system across 11 categories — from telemetry and bloatware to Defender ASR rules and credential protection. No dependencies, no third-party tools, just a single .ps1 file.
Audit → Review → Harden → Verify
- Interactive TUI with animated audit, color-coded results, and category picker
- 150+ hardening checks based on CIS Benchmarks, Microsoft Security Baselines, and ACSC guidance
- Audit mode — scan your system and get a hardening score without changing anything
- Quick Harden — apply all recommended settings with one keypress
- Custom Harden — pick exactly which categories to apply
- Automatic registry backup before any changes, with one-click restore
- Silent/CLI mode for automation, scripting, and deployment pipelines
- Zero dependencies — runs on any Windows 10/11 machine with PowerShell 5.1
# Download and run (as Administrator)
irm https://raw.githubusercontent.com/obsidiancorps/windows-hardening/main/Harden-Windows.ps1 -OutFile Harden-Windows.ps1
powershell -ExecutionPolicy Bypass -File .\Harden-Windows.ps1Or clone the repo:
git clone https://github.com/obsidiancorps/windows-hardening.git
cd windows-hardening
powershell -ExecutionPolicy Bypass -File .\Harden-Windows.ps1| # | Category | Settings | What it does |
|---|---|---|---|
| 1 | Telemetry | 12 | Diagnostic data, feedback, error reports, advertising ID |
| 2 | Privacy | 14 | Activity history, location, speech, camera/mic defaults |
| 3 | Services | 13 | DiagTrack, geolocation, Xbox, Maps, error reporting |
| 4 | Scheduled Tasks | 12 | CEIP, compatibility appraiser, feedback, disk diagnostics |
| 5 | Network | 15 | SMBv1, LLMNR, WPAD, NetBIOS, RDP NLA/TLS, DNS-over-HTTPS, telemetry firewall |
| 6 | Security | 19 | UAC, NTLM, LSA Protection, Credential Guard, SMB signing, PS logging |
| 7 | Defender/ASR | 19 | 14 Attack Surface Reduction rules + PUA/network protection |
| 8 | Bloatware | 21+ | Remove pre-installed apps, disable suggested content and spotlight |
| 9 | AI/Copilot | 8 | Disable Copilot, Recall, Bing AI, web search in Start |
| 10 | Windows Update | 5 | Defer feature updates, disable P2P delivery, no auto-restart |
| 11 | Miscellaneous | 7 | File extensions, GameDVR, widgets, lock screen hardening |
The Defender category enables 14 ASR rules in Block mode, covering the most common attack vectors:
- Office apps creating executables, child processes, or injecting code
- JavaScript/VBScript launching downloaded content
- Obfuscated scripts and untrusted USB processes
- Credential stealing from LSASS
- Email-delivered executables
- WMI persistence and PSExec/WMI process creation
- Abuse of vulnerable signed drivers
Some items are checked but not automatically applied because they require specific hardware or may break certain apps:
- Credential Guard — needs UEFI + TPM + VBS capable hardware
- Controlled Folder Access — can block legitimate apps from writing to Documents/Desktop
The script includes manual enable instructions for these in the source comments.
.\Harden-Windows.ps1Navigate the TUI menu:
- Audit System — animated scan with per-category progress bars and overall score
- Quick Harden — apply all settings (creates backup first)
- Custom Harden — toggle individual categories on/off
- Create/Restore Backup — manual backup management
# Apply everything (for automation / deployment)
.\Harden-Windows.ps1 -Silent -All
# Apply specific categories only
.\Harden-Windows.ps1 -Silent -Categories Telemetry,Privacy,Services,Defender,AI
# Valid categories:
# Telemetry, Privacy, Services, Tasks, Network, Security,
# Defender, Bloatware, AI, Updates, Misc- Does not disable Windows Update — that would be a security risk
- Does not disable Windows Defender — you need your AV
- Does not modify UEFI/boot settings — no risk of bricking
- Does not touch your files or personal data
The tool automatically creates a registry backup in %USERPROFILE%\WindowsHardeningBackups\ before applying any changes. Each backup is timestamped. You can restore any backup from the TUI menu or by importing the .reg file directly.
The audit engine handles three classes of checks to avoid false reporting:
| Check type | How it works |
|---|---|
| Standard registry | Reads key, compares to desired value |
| NullOk (secure defaults) | Missing key = already secure (e.g., DEP, WDigest, SEHOP are on by default) |
| Custom check | Scriptblock for complex state (e.g., SMBv1 uses Get-WindowsOptionalFeature, Credential Guard uses WMI) |
- Windows 10 (1903+) or Windows 11 (including 24H2)
- PowerShell 5.1+
- Administrator privileges
Will this break anything?
The settings are conservative and widely tested. Xbox services are disabled (irrelevant if you don't game on PC). Camera/microphone defaults are set to Deny but apps can still request access. If something breaks, use the Restore Backup option.
Do I need to restart?
Yes — LSA Protection, service changes, and some network settings require a restart to take full effect.
Can I run this on a domain-joined machine?
Yes, but domain Group Policy may override some settings. The audit will accurately show what's actually applied regardless of GPO.
How do I undo everything?
Use [5] Restore Backup in the TUI. For services, re-enable manually via services.msc. For bloatware, reinstall from the Microsoft Store.
Can I use this in my organization?
Yes. The -Silent -All mode is designed for deployment pipelines. The MIT license allows commercial use. Test on a staging machine first.
This tool's checks are informed by:
- CIS Microsoft Windows 11 Enterprise Benchmark v4.0.0
- Microsoft Attack Surface Reduction Rules
- ACSC Hardening Microsoft Windows 11
- Microsoft Security Baselines
PRs welcome! Please:
- Test on a clean Windows 10/11 VM before submitting
- Add comments explaining what the setting does and why it matters
- Use
NullOkorCheckscriptblocks where the default state is already secure
Made by ObsidianCorps