Windows Security Hardening

PowerShell-driven Windows 10/11 security baseline, with a 24-check validator, three-tier drift detection, and a 16-script hardening suite covering CIS Controls v8 and Microsoft Security Baselines.

A turnkey toolkit for tightening a single Windows box without buying enterprise tooling. The scripts are written for plain PowerShell 5.1 (default on Windows 10/11) and don't need any third-party modules to run.

What's in the box

Layer	What it does	Files
Validator	24-check, no-admin audit that grades the current state of a Windows box	scripts/validate_security_hardening.ps1
Hardening	16 PowerShell scripts that flip the right registry keys, services, firewall rules, and policies	scripts/*.ps1, scripts/run_hardening_as_admin.bat
Baseline	Snapshots the current system state into JSON for later comparison	scripts/collect_security_baseline.ps1
Drift detection	Three modes — quick hash (~2s), standard JSON diff (~10s), deep validation (~60s) — plus auto-remediation	scripts/drift_detection/*
Reports	Human-readable status reports (Markdown) and machine-readable (CSV, JSON)	scripts/generate_security_report.ps1, scripts/Export-SecurityReport.ps1
Monitoring	Optional Task Scheduler entry for weekly drift checks	scripts/drift_detection/Install-DriftDetectionTask.ps1, scripts/setup_security_monitoring_task.ps1

The full list of scripts, the 24-check matrix, the drift detection architecture, and the original audit results live in PROJECT_SUMMARY.md and ARCHITECTURE.md at the repo root.

Quick start

Run the validator first. It is non-destructive and does not need admin rights.

# Clone
git clone https://github.com/phillza/windows-security-hardening
cd windows-security-hardening

# 1. Audit your current state (no admin)
powershell -ExecutionPolicy Bypass -File scripts\validate_security_hardening.ps1

# 2. Generate a human-readable report
powershell -ExecutionPolicy Bypass -File scripts\generate_security_report.ps1

# 3. (Optional) Apply hardening — requires admin
#    The .bat wrapper auto-elevates and re-launches in a new console
.\scripts\run_hardening_as_admin.bat

# 4. (Optional) Collect a baseline for later drift detection
powershell -ExecutionPolicy Bypass -File scripts\collect_security_baseline.ps1

Drift detection

Once you have a baseline, the drift detector will tell you what changed:

# Fast hash check (~2s)
powershell -ExecutionPolicy Bypass -File scripts\drift_detection\Invoke-QuickDriftDetection.ps1

# JSON deep diff (~10s) — recommended for daily use
powershell -ExecutionPolicy Bypass -File scripts\drift_detection\Invoke-StandardDriftDetection.ps1

# Full re-validation (~60s) — for after Windows updates or major changes
powershell -ExecutionPolicy Bypass -File scripts\drift_detection\Invoke-DeepValidation.ps1

# See the remediation decision tree
powershell -ExecutionPolicy Bypass -File scripts\drift_detection\Show-DriftHistory.ps1

Drift is classified as Critical / High / Medium / Low:

• Critical — immediate alert, optional auto-remediate
• High — alert, auto-remediate if enabled
• Medium — log + daily digest
• Low — log + weekly report

See scripts/drift_detection/REMEDIATION_TREE.md for the full decision tree, and scripts/drift_detection/SAFETY_CONTROLS.md for the guardrails (the auto-remediator is off by default for a reason).

What gets hardened

Highlights from the suite:

• Account policies — lockout threshold, complexity, minimum length, history
• PowerShell logging — script block, module, transcription all on
• Network hardening — LLMNR, source routing, NetBIOS disabled
• Malware defenses — SmartScreen, PUA protection, AutoRun blocked
• Firewall — logging on, AnyDesk / qBittorrent pinned to Private profile
• App-specific rules — separate scripts for AnyDesk, qBittorrent, and the apps you actually use
• Monitoring — Task Scheduler entry for weekly validation

Project layout

windows-security-hardening/
  PROJECT_SUMMARY.md       # The 24-check matrix + script inventory
  ARCHITECTURE.md          # Drift detection architecture
  AGENTS.md                # AI-agent context (read this first if you're an agent)
  scripts/
    validate_security_hardening.ps1    # 24-check, no-admin
    generate_security_report.ps1       # Markdown report
    apply_phase1_hardening.ps1         # AnyDesk, Input Director, MSI Center
    enable_account_policies.ps1        # Lockout, complexity, length
    enable_firewall_logging.ps1
    enable_malware_defenses.ps1        # SmartScreen, PUA, AutoRun
    enable_network_hardening.ps1       # LLMNR, source routing
    enable_powershell_logging.ps1      # Script block, module, transcription
    harden_anydesk_firewall.ps1
    harden_qbittorrent_firewall.ps1
    collect_security_baseline.ps1      # Snapshot for drift detection
    setup_security_monitoring_task.ps1 # Weekly scheduled validation
    check_admin_security_items.ps1     # BitLocker, Secure Boot, TPM
    cleanup_monitoring_logs.ps1        # 30-day / 50-file retention
    Export-SecurityReport.ps1          # Machine-readable exports
    run_hardening_as_admin.bat         # Auto-elevation wrapper
    drift_detection/
      DriftDetectionCommon.ps1
      Invoke-QuickDriftDetection.ps1
      Invoke-StandardDriftDetection.ps1
      Invoke-DeepValidation.ps1
      Install-DriftDetectionTask.ps1
      New-SecurityBaseline.ps1
      Show-DriftHistory.ps1
      REMEDIATION_TREE.md
      SAFETY_CONTROLS.md
      ARCHITECTURE.md
      baseline_schema_example.json
  reports/                              # Sample historical reports
  AUTO_NUDGE_HISTORY.md                  # Audit-trail of project decisions

Warnings

• The hardening scripts modify system state and require admin. Run run_hardening_as_admin.bat rather than executing individual scripts so the elevation wrapper handles UAC cleanly.
• The drift detector's auto-remediation is off by default. Read scripts/drift_detection/SAFETY_CONTROLS.md before turning it on.
• Several scripts touch firewall rules. If you use AnyDesk or qBittorrent and rely on remote access, run the matching harden_*_firewall.ps1 script first to keep things working.
• Collect a baseline immediately after hardening so future drift checks have a clean reference.

Compatibility

• Windows 10 (21H2+) and Windows 11
• PowerShell 5.1 (built-in) and PowerShell 7+ both tested
• No third-party modules required

License

MIT — see LICENSE.