Skip to content

Harden Windows Safely, Securely using Official Supported Microsoft methods with proper explanation | Always up-to-date and works with the latest build of Windows

License

Notifications You must be signed in to change notification settings

c3rberus/Harden-Windows-Security

 
 

Repository files navigation

Big Yummy Donut
Harden Windows Security

Harden Windows Safely, Securely, only with Official Microsoft methods

PowerShell Gallery PowerShell Gallery Downloads count

Twitter Share button

Hardening Categories • How To Use • Features • Related • Trust • Support • Security Recommendations • Resources • License • Wiki • Full change log in Excel online

horizontal super thin rainbow RGB line

Green icon denoting validation Security for Personal users

Use the PowerShell script below to automatically apply the security measures described in this page.

Green icon denoting validation Security for Organizations, Enterprises and Highly secure personal users

Refer to Windows Defender Application Control resources on this GitHub repository.

Yellow bell denoting something important and attentionUse the WDACConfig Module for Advanced Automated WDAC configurations and Application/File whitelisting in Windows.

horizontal super thin rainbow RGB line


Note Windows by default is secure and safe, this repository does not imply nor claim otherwise. just like anything, you have to use it wisely and don't compromise yourself with reckless behavior and bad user configuration; Nothing is foolproof. This repository only uses the tools and features that have already been implemented by Microsoft in Windows OS to fine-tune it towards the highest security and locked-down state, using well-documented, supported, recommended and official methods. continue reading for comprehensive info.


How To UseHowToUseIcon

Using GitHub source (Always up to date)

irm 'https://raw.githubusercontent.com/HotCakeX/Harden-Windows-Security/main/Harden-Windows-Security.ps1' | iex

Note About Invoke-Expression or iex.

Using PowerShell gallery (You need to manually update the script whenever a new version is released)

Install-Script -Name Harden-Windows-Security

Animated APNG demonstrating how the Harden Windows Security PowerShell script works


horizontal super thin rainbow RGB line


A quick video demonstrating how the Harden-Windows-Security script works

YouTube Video showcase


horizontal super thin rainbow RGB line


Requirements RequirementsIcon

Requirements item Any device that meets the Windows 11 hardware and Virtualization Based Security requirements. Most of the hardware manufactured in the past few years are supported.

Requirements item TPM 2.0, Virtualization technology and Secure Boot enabled in your UEFI settings. Official guide - How to enable Secure Boot on: HP - Lenovo - Dell.

Requirements item Windows editions higher than Home edition.

Requirements item Latest available version of Windows installed.

Note Restart your device after applying the script, don't use any commands to force Group Policy update.


Harden-Windows-Security is a PowerShell script


Features FeaturesIcon

Features Item Always stays up-to-date with the newest security measures.

Features Item Everything is in plain text, nothing hidden, no 3rd party executable or pre-compiled binary is involved.

Warning For your own security, do not use any other 3rd party tools, programs or scripts that claim to harden Windows or modify it in any way, unless you can 100% verify it. Never trust 3rd party people on the Internet, always verify their resources and do that after each release. Keep on reading the features to see why this Harden-Windows-Security script is different and read the Trust section to see how you can 100% Trust it.

Features Item Doesn't remove or disable Windows functionalities against Microsoft's recommendations.

Features Item All of the links and sources are from official Microsoft websites, straight from the source. No bias, No misinformation and definitely No old obsolete methods. That's why there are no links to 3rd party news websites, forums, made up blogs/articles and such.

With the following exceptions
Link Count Link Reason
1 Intel website i7 13700k product page
2 Wikipedia providing further information for the reader
1 non-official Github Wiki providing further information for the reader about TLS
1 Security.Stackexchange Q&A providing logic and reasoning for certain actions
1 state.gov List of State Sponsors of Terrorism
1 orpa.princeton.edu OFAC Sanctioned Countries

Features Item The script primarily uses Group policies, the Microsoft recommended way of configuring Windows. It also uses PowerShell cmdlets where Group Policies aren't available, and finally uses a few registry keys to configure security measures that can neither be configured using Group Policies nor PowerShell cmdlets. This is why the script doesn't break anything or cause unwanted behavior.

Warning Any other 3rd party tool/program/script that claims to modify Windows or harden it, if they don't strictly adhere to the official rules above, they can damage your system, cause unknown problems and bugs. How are Group Policies for this script created and maintained?

Features Item This Readme page lists all of the security measures applied by this script.

Features Item When a hardening measure is no longer necessary because it's applied by default by Microsoft on new builds of Windows, it will also be removed from this script in order to prevent any problems and because it won't be necessary anymore.

Features Item The script can be run infinite number of times, it's made in a way that it won't make any duplicate changes.

Features Item The script prompts for confirmation before running each hardening category and some sub-categories, so you can selectively run (or don't run) each of them.

Features Item Applying this script makes your PC compliant with Microsoft Security Baselines and Secured-core PC specifications (provided that you use modern hardware that supports the latest Windows security features) - See what makes a Secured-core PC - Check Device Guard category for more details.

Secured-core – recommended for the most sensitive systems and industries like financial, healthcare, and government agencies. Builds on the previous layers and leverages advanced processor capabilities to provide protection from firmware attacks.

Features Item There are 4 items tagged with #TopSecurity TopSecurity that can cause some inconvenience but increase security even further. When you run this script, you will have an option to enable them if you want to. Press Control + F and search for #TopSecurity on this page to find those security measures.

Features Item Since I originally created this repository for myself and people I care about, I always maintain it to the highest possible standard.


💡 (back to top)

Harden-Windows-Security is a PowerShell script

Hardening CategoriesHardeningCategoriesIcon

From Top to bottom in order:




Blue Check mark denoting Group Policy Indicates the security measure is applied using Group Policies

Rotating pink gem denoting registry or cmdlet Indicates the security measure is applied using PowerShell cmdlets or Registry

💡 (back to top)


horizontal super thin rainbow RGB line


Microsoft Security BaselinesMicrosoftSecurityBaseline

A woman looking at her Windows laptop, indoor

Blue Check mark denoting Group Policy A security baseline is a group of Microsoft-recommended configuration settings that explains their security implications. These settings are based on feedback from Microsoft security engineering teams, product groups, partners, and customers.

Continue reading in the official documentation

Optional Overrides for Microsoft Security Baselines

Blue Check mark denoting Group Policy Highly recommended to apply these overrides, the script will ask you whether you want to apply them or not.

💡 (back to categories)


horizontal super thin rainbow RGB line


Microsoft 365 Apps Security BaselinesMicrosoft365AppsSecurityBaselines

Some kind of futuristic Microsoft Protect

Blue Check mark denoting Group Policy The security baseline for Microsoft 365 Apps for enterprise is published twice a year, usually in June and December.

More info in Microsoft Learn

Microsoft Security Baselines Version Matrix

💡 (back to categories)


horizontal super thin rainbow RGB line


Microsoft DefenderWindowsDefenderIcon

Microsoft Defender Cloud Protection features and abilities

  • Blue Check mark denoting Group Policy Enables additional security features of Microsoft Defender, You can refer to this official document for full details.

  • Blue Check mark denoting Group Policy This script makes sure Cloud Security Scan and Block At First Sight are enabled to the highest possible security states available, Zero Tolerance Cloud Block level. You need to be aware that this means actions like downloading and opening an unknown file will make Microsoft Defender send samples of it to the Cloud for more advanced analysis and it can take a maximum of 60 seconds (this script sets it to max) from the time you try to open that unknown file to the time when it will be opened (if deemed safe), so you will have to wait. All of these security measures are in place by default in Windows to some extent and happen automatically without the need to run this script, but this script maxes them out and sets them to the highest possible levels at the cost of convenience and usability. It's always a trade-off.

    • Here is an example of the notification you will see in Windows 11 if that happens.

    Windows Security Cloud Scan Notification

  • Blue Check mark denoting Group Policy Enables file hash computation; designed to allow admins to force the anti-malware solution to "compute file hashes for every executable file that is scanned if it wasn't previously computed" to "improve blocking for custom indicators in Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).

  • Blue Check mark denoting Group Policy Clears Quarantined items after 5 days instead of the default behavior of keeping them indefinitely.

  • Blue Check mark denoting Group Policy Lets Microsoft Defender use up to 60% of the CPU instead of the default 50%, during scans.

  • Blue Check mark denoting Group Policy Allows Microsoft Defender to download security updates even on a metered connection.

  • Blue Check mark denoting Group Policy Enables Microsoft Defender to scan network drives, restore points, Emails and removable drives during a full scan, so it will take a while to finish a full scan if you have lots of those Items.

  • Blue Check mark denoting Group Policy Sets the Signature Update Interval to every 3 hours instead of automatically.

  • Blue Check mark denoting Group Policy Forces Microsoft Defender to check for new virus and spyware definitions before it runs a scan.

  • Blue Check mark denoting Group Policy Makes Microsoft Defender run catch-up scans for scheduled quick scans. A computer can miss a scheduled scan, usually because the computer is off at the scheduled time, but now after the computer misses two scheduled quick scans, Microsoft Defender runs a catch-up scan the next time someone logs onto the computer.

  • Blue Check mark denoting Group Policy Enables Network Protection of Microsoft Defender (Requires Windows Pro or Enterprise editions)

  • Rotating pink gem denoting registry or cmdlet Makes sure Async Inspection for Network protection of Microsoft Defender is turned on - Network protection now has a performance optimization that allows Block mode to start asynchronously inspecting long connections after they're validated and allowed by SmartScreen, which might provide a potential reduction in the cost that inspection has on bandwidth and can also help with app compatibility problems.

  • Rotating pink gem denoting registry or cmdlet (Requires additional confirmation to run): Enables Smart App Control (if it's in Evaluation mode): adds significant protection from new and emerging threats by blocking apps that are malicious or untrusted. Smart App Control also helps to block potentially unwanted apps, which are apps that may cause your device to run slowly, display unexpected ads, offer extra software you didn't want, or do other things you don't expect.

    • Smart App Control is User-Mode (and enforces Kernel-Mode) Windows Defender Application Control policy (WDAC), more info in the Wiki. You can see its status in System Information and enable it manually from Microsoft Defender app's GUI. It is very important for Windows and Windows Defender intelligence updates to be always up-to-date in order for Smart App Control to work properly as it relies on live intelligence and definition data from the cloud and other sources to make a Smart decision about programs and files it encounters.

    • Smart App Control uses ISG (Intelligent Security Graph). The ISG isn't a "list" of apps. Rather, it uses the same vast security intelligence and machine learning analytics that power Microsoft Defender SmartScreen and Microsoft Defender Antivirus to help classify applications as having "known good", "known bad", or "unknown" reputation. This cloud-based AI is based on trillions of signals collected from Windows endpoints and other data sources and processed every 24 hours. As a result, the decision from the cloud can change.

    • Smart App Control can block a program entirely from running or only some parts of it in which case your app or program will continue working just fine most of the time. It's improved a lot since it was introduced, and it continues doing so. Consider turning it on after clean installing a new OS and fully updating it.

    • Smart App Control enforces the Microsoft Recommended Driver Block rules and the Microsoft Recommended Block Rules

    • Once you turn Smart App Control off, it can't be turned on without resetting or reinstalling Windows.

  • Blue Check mark denoting Group Policy Enables Controlled Folder Access. It helps protect your valuable data from malicious apps and threats, such as ransomware. Controlled folder access protects your data by checking apps against a list of known, trusted apps. Due to the recent wave of global ransomware attacks, it is important to use this feature to protect your valuables files, specially OneDrive folders.

    • If it blocks a program from accessing one of your folders it protects, and you absolutely trust that program, then you can add it to exclusion list using Microsoft Defender GUI or PowerShell. you can also query the list of allowed apps using PowerShell (commands below). with these commands, you can backup your personalized list of allowed apps, that are relevant to your system, and restore them in case you clean install your Windows.
    • Rotating pink gem denoting registry or cmdlet The script adds the root of OneDrive folders of all user accounts present when running the script, to the protected folders list of Controlled Folder Access, to provide Ransomware protection for the entire OneDrive folder.
# Add multiple programs to the exclusion list of Controlled Folder Access
Add-MpPreference -ControlledFolderAccessAllowedApplications 'C:\Program Files\App\app.exe','C:\Program Files\App2\app2.exe'
# Get the list of all allowed apps
(Get-MpPreference).ControlledFolderAccessAllowedApplications

💡 (back to categories)


horizontal super thin rainbow RGB line


Attack surface reduction rulesASRrulesIcon

Microsoft Protect Detect Respond Center

Blue Check mark denoting Group Policy Reducing your attack surface means protecting your devices and network, which leaves attackers with fewer ways to perform attacks. Configuring attack surface reduction rules in Windows can help!

Blue Check mark denoting Group Policy Attack surface reduction rules target certain software behaviors, such as:

  • Launching executable files and scripts that attempt to download or run files
  • Running obfuscated or otherwise suspicious scripts
  • Performing behaviors that apps don't usually initiate during normal day-to-day work

Such software behaviors are sometimes seen in legitimate applications. However, these behaviors are often considered risky because they are commonly abused by attackers through malware. Attack surface reduction rules can constrain software-based risky behaviors and help keep your organization safe.

Blue Check mark denoting Group Policy This script enables all 16 available Attack Surface Reduction rules shown in the official chart.

💡 (back to categories)


horizontal super thin rainbow RGB line


Bitlocker SettingsBitlockerIcon

A woman working in a server room with her laptop, standing


  • Rotating pink gem denoting registry or cmdletBlue Check mark denoting Group Policy This script sets up and configures Bitlocker using official documentation, with the most secure configuration and Military Grade encryption algorithm, XTS-AES-256, TPM 2.0 and start-up PIN, to protect the confidentiality and integrity of all information at rest and in use.

    • OS drive is automatically encrypted (if it isn't already) when you run this category and select a startup PIN. For every other non-OS drive, there will be prompts for confirmation before encrypting it. Removable flash drives are skipped. Non-OS drives will have Recovery Password and Auto-unlock methods for authentication once they are encrypted.

    • You will be asked to enter a Startup PIN when activating Bitlocker for the first time. Make sure it contains at least 10 characters (uppercase and lowercase letters, symbols, numbers, spaces) and it's not the same as your Windows Hello PIN.

    • Once you run this script for the first time, there will be a text file containing the 48-digit recovery password for each encrypted drive that will be saved in itself, with the names like Drive C recovery password.txt. It is very important to keep it in a safe and reachable place, e.g., in OneDrive's Personal Vault which requires authentication to access. See Here and Here for more info about OneDrive's Personal Vault

    • TPM has special anti-hammering logic which prevents malicious user from guessing the authorization data indefinitely. Microsoft defines that maximum number of failed attempts in Windows is 32 and every single failed attempt is forgotten after 2 hours. This means that every continuous two hours of powered on (and successfully booted) operation without an event which increases the counter will cause the counter to decrease by 1. You can view all the details using this PowerShell command: Get-TPM.

    • Check out Lock Screen category for more info about the recovery password and the 2nd anti-hammering mechanism.

    • To have even more security than what the script provides, you can utilize a Startup key in addition to the other 3 key protectors (TPM, Startup PIN and Recovery password). with this method, part of the encryption key is stored on a USB flash drive, and a PIN is required to authenticate the user to the TPM. This configuration provides multifactor authentication so that if the USB key is lost or stolen, it can't be used for access to the drive, because the correct PIN is also required.

    • BitLocker will bring you a real security against the theft of your device if you strictly abide by the following basic rules:

      • As soon as you have finished working, either Hibernate or shut Windows down and allow for every shadow of information to disappear from RAM within 2 minutes. This practice is recommended in High-Risk Environments.

      • Do not mix 3rd party encryption software and tools with Bitlocker. Bitlocker creates a secure end-to-end encrypted ecosystem for your device and its peripherals, this secure ecosystem is backed by things such as software, Virtualization Technology, TPM 2.0 and UEFI firmware, Bitlocker protects your data and entire device against real-life attacks and threats. You can encrypt your external SSDs and flash drives with Bitlocker too.

  • Blue Check mark denoting Group Policy Enables or disables DMA protection from Bitlocker Countermeasures based on the status of Kernel DMA protection. Kernel DMA Protection is not compatible with other BitLocker DMA attacks countermeasures. It is recommended to disable the BitLocker DMA attacks countermeasures if the system supports Kernel DMA Protection (this script does that exactly). Kernel DMA Protection provides higher security bar for the system over the BitLocker DMA attack countermeasures, while maintaining usability of external peripherals. you can check the status of Kernel DMA protection using this official guide.

  • Blue Check mark denoting Group Policy Disallows standard (non-Administrator) users from changing the Bitlocker Startup PIN or password

  • Blue Check mark denoting Group Policy Allows Enhanced PINs for startup

  • Blue Check mark denoting Group Policy Requires you to choose a PIN that contains at least 10 characters

  • Blue Check mark denoting Group Policy Enables Hibernate, adds Hibernate to Start menu's power options and disables Sleep. This feature is only recommended for High-Risk Environments. This is to prevent an Attacker with skill and lengthy physical access to your computer which is the Worst-case Scenario

    • Attack Scenario: Targeted attack with plenty of time; this attacker will open the case, will solder, and will use sophisticated hardware or software. Of course, Bitlocker and configurations applied by this script will protect you against that.
    • Power states S1-S3 will be disabled in order to completely disable Sleep, doing so also removes the Sleep option from Start menu and even using commands to put the computer to sleep won't work. You will have to restart your device for the changes to take effect.
  • Rotating pink gem denoting registry or cmdlet sets Hibernate to full

  • Blue Check mark denoting Group Policy Disallows access to Bitlocker-protected removable data drives from earlier versions of Windows.

Refer to this official documentation about the countermeasures of Bitlocker

💡 (back to categories)


horizontal super thin rainbow RGB line


TLS SecurityTLSIcon

A young woman working at a headless server farm with her tablet, standing


Rotating pink gem denoting registry or cmdlet This script disables TLS 1 and TLS 1.1 security protocols that only exist for backward compatibility. All modern software should and do use TLS 1.2 and TLS 1.3.

Changes made by the script only affect things that use Schannel SSP: that includes IIS web server, built-in inbox Windows apps and some other programs supplied by Microsoft, but not 3rd party software that use portable stacks like Java, nodejs, python or php.

If you want to read more: Demystifying Schannel

  • Rotating pink gem denoting registry or cmdlet Enables TLS_CHACHA20_POLY1305_SHA256 cipher Suite which is available but not enabled by default in Windows 11, and sets its priority to highest.

  • Rotating pink gem denoting registry or cmdlet Enables the following secure Diffie-Hellman based key exchange algorithms which are available in Windows 11 but not enabled by default, according to this Microsoft Document: "TLS_DHE_RSA_WITH_AES_256_CBC_SHA","TLS_DHE_RSA_WITH_AES_128_CBC_SHA","TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"

  • Rotating pink gem denoting registry or cmdlet Disables NULL ciphers that are only available for backward compatibility:"TLS_RSA_WITH_NULL_SHA256","TLS_RSA_WITH_NULL_SHA","TLS_PSK_WITH_NULL_SHA384","TLS_PSK_WITH_NULL_SHA256"

  • Rotating pink gem denoting registry or cmdlet Disables MD5 Hashing Algorithm that is only available for backward compatibility

  • Rotating pink gem denoting registry or cmdlet Disables the following weak cipher suites that are only available for backward compatibility: "TLS_RSA_WITH_AES_256_GCM_SHA384","TLS_RSA_WITH_AES_128_GCM_SHA256","TLS_RSA_WITH_AES_256_CBC_SHA256","TLS_RSA_WITH_AES_128_CBC_SHA256","TLS_RSA_WITH_AES_256_CBC_SHA","TLS_RSA_WITH_AES_128_CBC_SHA","TLS_PSK_WITH_AES_256_GCM_SHA384","TLS_PSK_WITH_AES_128_GCM_SHA256","TLS_PSK_WITH_AES_256_CBC_SHA384","TLS_PSK_WITH_AES_128_CBC_SHA256"

  • Rotating pink gem denoting registry or cmdlet Disables the following weak ciphers that are only available for backward compatibility: "DES 56-bit","RC2 40-bit","RC2 56-bit","RC2 128-bit","RC4 40-bit","RC4 56-bit","RC4 64-bit","RC4 128-bit","3DES 168-bit (Triple DES 168)"

💡 (back to categories)


horizontal super thin rainbow RGB line


Lock ScreenLockScreenIcon

An AI generated picture of a girl working in a server farm


  • Blue Check mark denoting Group Policy Automatically locks device after X seconds of inactivity (just like mobile phones), which is set to 120 seconds (2 minutes) in this script, you can change that to any value you like.

  • Blue Check mark denoting Group Policy Requires CTRL+ALT+DEL on the lock screen, kernel protected set of key strokes. The reason and logic behind it is:

    • A malicious user might install malware that looks like the standard sign-in dialog box for the Windows operating system and capture a user's password. The attacker can then sign into the compromised account with whatever level of user rights that user has.
  • Blue Check mark denoting Group Policy Enables a security anti-hammering feature that sets a threshold of 6 for the number of failed sign-in attempts that causes the device to be locked by using BitLocker. Sign-in attempts include Windows password or Windows Hello authentication methods. This threshold means, if the specified maximum number of failed sign-in attempts is exceeded, the device will invalidate the Trusted Platform Module (TPM) protector and any other protector except the 48-digit recovery password, and then reboot. During Device Lockout mode, the computer or device only boots into the touch-enabled Windows Recovery Environment (WinRE) until an authorized user enters the recovery password to restore full access.

    • This script (in the Bitlocker category) automatically saves the 48-digit recovery password of each drive in itself, the location of it will also be visible on the PowerShell console when you run it. It is very important to keep it in a safe and reachable place, e.g. in OneDrive's Personal Vault which requires authentication to access. See Here and Here for more info about OneDrive's Personal Vault
  • Blue Check mark denoting Group Policy Hides email address of the Microsoft account on lock screen, if your device is in a trusted place like at home then this isn't necessary.

  • Blue Check mark denoting Group Policy Don't display username at sign-in; If a user signs in as Other user, the full name of the user isn't displayed during sign-in. In the same context, if users type their email address and password at the sign-in screen and press Enter, the displayed text "Other user" remains unchanged, and is no longer replaced by the user's first and last name, as in previous versions of Windows 10. Additionally, if users enter their domain user name and password and click Submit, their full name isn't shown until the Start screen displays.

    • Useful If you have devices that store sensitive data, with monitors displayed in unsecured locations, or if you have devices with sensitive data that are remotely accessed, revealing logged on user's full names or domain account names
  • Blue Check mark denoting Group Policy #TopSecurity TopSecurity Don't display last signed-in; This security policy setting determines whether the name of the last user to sign in to the device is displayed on the Secure Desktop. If this policy is enabled, the full name of the last user to successfully sign in isn't displayed on the Secure Desktop, nor is the user's sign-in tile displayed. Additionally, if the Switch user feature is used, the full name and sign-in tile aren't displayed. The sign-in screen requests a qualified domain account name (or local user name) and password.

    • This feature can be useful to enable if you live in High-Risk Environments and you don't want anyone to get any information about your device when it's locked and you're not around.
  • Blue Check mark denoting Group Policy Don't Display Network Selection UI on Lock Screen (like WIFI Icon); This setting allows you to control whether anyone can interact with available networks UI on the logon screen. Once enabled, the device's network connectivity state cannot be changed without signing into Windows. Suitable for High-Risk Environments.

💡 (back to categories)


horizontal super thin rainbow RGB line


User Account ControlUACIcon

An AI generated picture of a cat girl working in a server farm


  • Blue Check mark denoting Group Policy Prompt for elevation of privilege on secure desktop for all binaries in Administrator accounts, which presents the sign-in UI and restricts functionality and access to the system until the sign-in requirements are satisfied. The secure desktop's primary difference from the user desktop is that only trusted processes running as SYSTEM are allowed to run here (that is, nothing is running at the user's privilege level). The path to get to the secure desktop from the user desktop must also be trusted through the entire chain.

    • This is the default behavior: prompt the administrator in Admin Approval Mode to select either "Permit" or "Deny" for an operation that requires elevation of privilege for any non-Windows binaries. If the Consent Admin selects Permit, the operation will continue with the highest available privilege. This operation will happen on the secure desktop
    • This is the behavior that this script sets: prompts the administrator in Admin Approval Mode to select either "Permit" or "Deny" an operation that requires elevation of privilege. If the Consent Admin selects Permit, the operation will continue with the highest available privilege. "Prompt for consent" removes the inconvenience of requiring that users enter their name and password to perform a privileged task. This operation occurs on the secure desktop.
  • Blue Check mark denoting Group Policy #TopSecurity TopSecurity Only elevate executables that are signed and validated by enforcing cryptographic signatures on any interactive application that requests elevation of privilege. One of the Potential impacts of it is that it can prevent certain poorly designed programs from prompting for UAC.

  • Blue Check mark denoting Group Policy Changes the behavior of the elevation prompt for standard users from "prompt for credentials" to "prompt for credentials on the secure desktop".

    • #TopSecurity TopSecurity behavior: Automatically deny all UAC prompts on Standard accounts. Highly recommended to be used on sensitive critical machines. Only use Standard account for regular everyday tasks, and if you want to perform administrative tasks such as intalling a program system-wide or changing system settings, completely log out of the Standard account and log into an Administrator account, perform the tasks, then completely log out and log back into the Standard account to continue your work. No fast user switching and absolutely no UAC on Standard accounts.
  • Blue Check mark denoting Group Policy #TopSecurity TopSecurity Hides the entry points for Fast User Switching.

  • Rotating pink gem denoting registry or cmdlet (Requires additional confirmation to run): Asks for a strong password for the built-in Administrator account and then enables it.

💡 (back to categories)


horizontal super thin rainbow RGB line


Device GuardDeviceGuardIcon

An AI generated picture of a cat girl working in a server farm


Most of the Device Guard and Virtualization-Based Security features are Automatically enabled by default on capable and modern hardware, this script only checks their status and if needed, enables UEFI lock for them and also proceeds with enabling full Secured-Core PC requirements:


  1. Standard hardware security not supported
    • This means that your device does not meet at least one of the requirements of Standard Hardware Security.
  2. Your device meets the requirements for Standard Hardware Security.
  3. Your device meets the requirements for Enhanced Hardware Security
  4. Your device has all Secured-core PC features enabled

💡 (back to categories)


horizontal super thin rainbow RGB line


Windows FirewallFirewallIcon

An AI generated picture of a cat girl working in a server farm


  • Blue Check mark denoting Group Policy Makes sure Windows Firewall is enabled for all profiles (which is the default)

  • Blue Check mark denoting Group Policy Sets inbound and outbound default actions for Domain Firewall Profile to Block; because this script is Not intended to be used on devices that are part of a domain or controlled by an Active Directory Domain Controller, since they will have their own policies and policy management systems in place.

  • Blue Check mark denoting Group Policy Enables Windows Firewall logging for Private and Public profiles, sets the log file size to max 16.383 MB, logs only dropped packets.

  • Rotating pink gem denoting registry or cmdlet Disables Multicast DNS (mDNS) UDP-in Firewall Rules for all 3 Firewall profiles, This might interfere with Miracast screen sharing, which relies on the Public profile, and homes where the Private profile is not selected, but it does add an extra measure of security in public places, like a coffee shop.

💡 (back to categories)


horizontal super thin rainbow RGB line


Optional Windows FeaturesOptionalFeaturesIcon

An AI generated picture of a cat girl working in a server farm


💡 (back to categories)


horizontal super thin rainbow RGB line


Windows NetworkingNetworkingIcon

An AI generated picture of a cat girl working in a server farm


These are configurations that are typically recommended in High-Risk Environments but also can be applied for home users

💡 (back to categories)


horizontal super thin rainbow RGB line


Miscellaneous ConfigurationsMiscellaneousIcon

An AI generated picture of a cat girl working in a server farm


  • Blue Check mark denoting Group Policy Sets Early launch antimalware engine's status to 8 which is Good only. The default value is 3, which allows good, unknown and 'bad but critical'. that is the default value, because setting it to 8 can prevent your computer from booting if the driver it relies on is critical but at the same time unknown or bad.

    • By being launched first by the kernel, ELAM is ensured to be launched before any third-party software and is therefore able to detect malware in the boot process and prevent it from initializing. ELAM drivers must be specially signed by Microsoft to ensure they are started by the Windows kernel early in the boot process.
  • Blue Check mark denoting Group Policy Disables location service system wide. Websites and apps won't be able to use your precise location, however they will still be able to detect your location using your IP address.

  • Blue Check mark denoting Group Policy Enables svchost.exe mitigations. built-in system services hosted in svchost.exe processes will have stricter security policies enabled on them. These stricter security policies include a policy requiring all binaries loaded in these processes to be signed by Microsoft, and a policy disallowing dynamically generated code.

  • Rotating pink gem denoting registry or cmdlet Turns on Enhanced mode search for Windows indexer. the default is classic mode.

    • This causes some UI elements in the search settings in Windows settings to become unavailable for Standard user accounts to view, because it will be a managed feature by an Administrator.
  • Blue Check mark denoting Group Policy Enforce the Administrator role for adding printer drivers

  • Blue Check mark denoting Group Policy Enables SMB/LDAP Signing

  • Rotating pink gem denoting registry or cmdlet Enables SMB Encryption. Its status can be checked using the following PowerShell command: (get-SmbServerConfiguration).EncryptData. If the returned value is $True then SMB Encryption is turned on.

  • Rotating pink gem denoting registry or cmdlet Enables Edge browser (stable/beta/dev channels) to download and install updates on any network, metered or not; because the updates are important and should not be suppressed.

  • Rotating pink gem denoting registry or cmdlet Enables all Windows users to use Hyper-V and Windows Sandbox by adding all Windows users to the "Hyper-V Administrators" security group. By default, only Administrators can use Hyper-V or Windows Sandbox.

  • Rotating pink gem denoting registry or cmdlet Changes Windows time sync interval from the default every 7 days to every 4 days (= every 345600 seconds)

  • Rotating pink gem denoting registry or cmdlet Creates custom views for Windows Event Viewer to help keep tabs on important security events: Attack Surface Reduction Rules, Controlled Folder Access, Exploit Protection, Network Protection, MSI and Scripts for WDAC Auditing, Sudden Shut down events (due to power outage) and Code Integrity Operational.

  • Blue Check mark denoting Group Policy Enables "Send optional diagnostic data" because it is required for Smart App Control to operate and be enabled, and for communication between Intelligent Security Graph (ISG) and you.

💡 (back to categories)


horizontal super thin rainbow RGB line


Windows Update ConfigurationsWindowsUpdate

  • Blue Check mark denoting Group Policy Enables Windows Update to download and install updates on any network, metered or not; because the updates are important and should not be suppressed, that's what bad actors would want.
  • Blue Check mark denoting Group Policy Enables "Receive Updates for other Microsoft products" (such as PowerShell)
  • Rotating pink gem denoting registry or cmdlet Enables "Notify me when a restart is required to finish updating"
  • Blue Check mark denoting Group Policy Sets the deadline for automatic quality and feature updates and restarts to 2 days. Sets the grace periods to 2 days as well.
  • Blue Check mark denoting Group Policy Enables features introduced via servicing that are off by default so that users will be able to get new features after having Windows Update settings managed by Group Policy as the result of running this category.

💡 (back to categories)


horizontal super thin rainbow RGB line


Edge Browser configurationsEdgeBrowser


Some settings require the client to be joined to Windows Server Active Directory/Azure Active Directory, in order to be applied. This script does not use any of them. When those settings are applied using registry, they are ignored by the browser and edge://policy/ shows an error for them. This is a security measure.


  • You can view all of the policies being applied to your Edge browser by visiting this page: edge://policy/
  • You can find all of the available internal Edge pages in here: edge://about/

💡 (back to categories)


horizontal super thin rainbow RGB line


Certificate Checking CommandsCertificateIcon

Rotating pink gem denoting registry or cmdlet In this category, the script downloads and runs sigcheck64.exe from Sysinternals, then lists valid certificates not rooted to the Microsoft Certificate Trust List in the User and Machine certificate stores. Except for some possible Microsoft certificates, Windows insider builds certificates or certificates that have your own computer's name, which are perfectly safe and should not be deleted, All other certificates that will be listed should be treated as dangerous and removed from your system immediately.

💡 (back to categories)


horizontal super thin rainbow RGB line


Country IP BlockingCountryIPBlockingIcon

Rotating pink gem denoting registry or cmdlet The script uses the newest range of IPv4 and IPv6 addresses of State Sponsors of Terrorism and OFAC Sanctioned Countries, directly from official IANA sources repository, then creates 2 rules (inbound and outbound) for each list in Windows firewall, completely blocking connections to and from those countries.

Once you have those Firewall rules added, you can use this method to see if any of the blocked connections were from/to those countries.

Note Threat actors can use VPN, VPS etc. to mask their originating IP address and location. So don't take this category as the perfect solution for network protection.

💡 (back to categories)


horizontal super thin rainbow RGB line


Non-Admin CommandsNonAdminIcon

You don't need Admin privileges to run this category, because no system-wide changes is made. Changes in this category only apply to the current user account that is running the PowerShell session. For this reason, in addition to running this category as Admin, it's better to run it without elevation on any other available Standard accounts too.

  • Rotating pink gem denoting registry or cmdlet Shows known file extensions in File explorer
  • Rotating pink gem denoting registry or cmdlet Shows hidden files, folders and drives (toggles the control panel folder options item)
  • Rotating pink gem denoting registry or cmdlet Disables websites accessing local language list - good for privacy
  • Rotating pink gem denoting registry or cmdlet Turns off safe search in Windows search, will enable +18 content to appear in searches; essentially toggles the button in: Windows settings > privacy and security > search permissions > safe search
  • Rotating pink gem denoting registry or cmdlet prevents showing notifications in Lock screen - this is the same as toggling the button in Windows settings > system > notifications > show notifications in the lock screen
  • Rotating pink gem denoting registry or cmdlet Enables Clipboard History and sync with Microsoft Account
  • Rotating pink gem denoting registry or cmdlet Turns on text suggestions when typing on the physical keyboard
  • Rotating pink gem denoting registry or cmdlet Turns on "Multilingual text suggestions" for the current user, toggles the option in Windows settings
  • Rotating pink gem denoting registry or cmdlet Turns off sticky key shortcut of pressing shift key 5 times fast

💡 (back to categories)


horizontal super thin rainbow RGB line


RelatedRelatedIcon

PowerShell Gallery mirror

Azure DevOps Repository

Harden Windows Security website

Official global IANA IP block for each country

Windows Security Blog



horizontal super thin rainbow RGB line


TrustTrustIcon

How can you 100% trust this repository and know that nothing shady is going on?

This repository uses the simplest possible, yet effective, methods that make it very easy to verify:


Virus Total scan results of Security-Baselines-X.zip
Virus Total scan results of EventViewerCustomViews.zip

Links above are automatically updated. There is a GitHub workflow that automatically detects changes to the files and uploads them to Virus Total website for scanning.

💡 (back to top)


horizontal super thin rainbow RGB line


SupportSupportIcon

If you have any questions, requests, suggestions etc If you have any questions, requests, suggestions etc. about this GitHub repository and its content, please open a new discussion or Issue.

Reporting a vulnerability on this GitHub repository Reporting a vulnerability on this GitHub repository.

SpyNetGirl aka HotCakeX Outlook Email Address I can also be reached privately at: spynetgirl@outlook.com


💡 (back to top)


horizontal super thin rainbow RGB line


Security RecommendationsSecurityRecommendationIcon

  • Red Star denoting Security Recommendation Always download your operation system from official Microsoft websites. Right now, Windows 11 is the latest version of Windows, its ISO file can be downloaded from this official Microsoft server. One of the worst things you can do to your own security and privacy is downloading your OS, which is the root of all the active and passive security measures, from a 3rd party website claiming they have the official unmodified files. There are countless bad things that can happen as the result of it such as threat actors embedding malware or backdoors inside the customized OS, or pre-installing customized root CA certificates in your OS so that they can perform TLS termination and view all of your HTTPS and encrypted Internet data in plain clear text, even if you use VPN. Having a poisoned and compromised certificate store is the endgame for you, and that's just the tip of the iceberg.

  • Red Star denoting Security Recommendation Whenever you want to install a program or app, first use the Microsoft Store or Winget, if the program or app you are looking for isn't available in there, then download it from its official website. Somebody created a nice web interface for interacting with Winget CLI here. Using Winget or Microsoft store provides many benefits:

    • Microsoft store UWP apps are secure in nature, digitally signed, in MSIX format. That means, installing and uninstalling them is guaranteed and there won't be any leftovers after uninstalling.
    • Microsoft store has Win32 apps too, they are traditional .exe installers that we are all familiar with. The store has a library feature that makes it easy to find the apps you previously installed.
    • Both Microsoft and Winget check the hash of the files by default, if a program or file is tampered, they will warn you and block the installation, whereas when you manually download a program from a website, you will have to manually verify the file hash with the hash shown on the website, if any.
  • Red Star denoting Security Recommendation Use Secure DNS; Windows 11 natively supports DNS over HTTPS and DNS over TLS.

    • I've created a PowerShell module to use a DNS over HTTPS server that doesn't have a stable IP address, on Windows 11, feel free to check it out.
  • Red Star denoting Security Recommendation Only use Microsoft Edge for browser; It has the Highest-rated protection against phishing and malware, available by default on Windows OS, has tightly integrated valuable Security features such as Microsoft Defender Application Guard, Microsoft Defender SmartScreen, Hardware Enforced Stack Protection, Arbitrary Code Guard (ACG), Control Flow Guard (CFG), Tracking Prevention and Trusted built-in Secure Network feature from Cloudflare just to name a few.

  • Red Star denoting Security Recommendation Always enable Two-Factor/Multi-Factor Authentication on websites, apps and services that you use. Preferably, use Microsoft Authenticator app which has backup and restore feature, so you never lose access to your TOTPs (Time-Based One-Time Passwords) even if you lose your phone. Available for Android and IOS. You can also use Microsoft Authenticator on Windows 11 (PC, Laptop or Tablet) using Windows Subsystem for Android (WSA) and access your authenticator codes without the need to use your phone (secure automatic backup/restore feature). Use an open and trusted Android store such as Aurora Store to install and keep it up to date.

  • Red Star denoting Security Recommendation Make sure OneDrive backup for important folders (Desktop/Documents/Pictures) is enabled. It is fast, secure and works in any network condition and since it's x64 (64-bit), it can handle a Lot of small and large files simultaneously.

  • Red Star denoting Security Recommendation If you live in a western country, NATO country, European country or Australia, do not use VPNs. your local ISP (Internet service provider) is a lot more trustworthy than the remote VPN server's ISP. Using VPN only takes the trust from your own local ISP and puts it in the hands of the remote ISP that the VPN server uses for its Internet, Nothing else. period. Do not fall for the fake advertisements of VPN companies, you never know who is behind the VPN provider, what their political views are, their background, where their allegiance lies. The permissive civilized western world could allow a state sponsor of terrorism or some other hostile country to create a VPN company in here and gather intelligence and collect bulk data for mining, tracking etc. this has happened before and one of the most recent revelations is about a VPN provider called Betternet, based in Canada, ran by IRGC terrorists and their families abroad. Stay vigilant and smart.

    • There are situations where using VPN can provide security and privacy. For example, when using a public WiFi hotspot or basically any network that you don't have control over. In such cases, use Cloudflare WARP which uses WireGuard protocol, or as mentioned, use Secure Network in Edge browser that utilizes the same secure Cloudflare network. It's free, it's from an American company that has global radar and lots of insight about countries in the world in real-time, at least 19.7% of all websites use it (2022). Safe to say it's one of the backbones of the Internet.
  • Red Star denoting Security Recommendation Go passwordless with your Microsoft account and use Windows Hello authentication. In your Microsoft account which has Outlook service, you can create up to 10 Email aliases in addition to the 1 Email address you get when you made your Microsoft account, that means without creating a new account, you can have 11 Email addresses all of which will use the same inbox and account. You can specify which one of those Email aliases can be used to sign into your account, in the sign in preferences of your Microsoft account settings. So for example, when going passwordless, if you need you can give one of your Email aliases to others for communication or add it to a public profile of yours, then block sign in using that Email alias so nobody can send you authenticator notifications by entering that Email alias in the sign in page, and use the other 10 aliases that are private to sign into your Microsoft account with peace of mind. You can create a rule in your Outlook so that all of the Emails sent to your public Email alias will be stored in a different folder, apart from your other inbox emails. All of this can be done using free Microsoft account and Outlook webapp.

  • Red Star denoting Security Recommendation Set a strong password for the UEFI firmware of your device so that it will ask for password before allowing any changes to be made to firmware. You can also configure the password to be required on startup.

  • Red Star denoting Security Recommendation Use NTFS (which is the default Filesystem in Windows) or ReFS (Resilient File System, newer). In addition to all their benefits, they support Mark Of The Web (MOTW) or zone.identifier. When a file is downloaded to a device running Windows, Mark of the Web is added to the file, identifying its source as being from the internet. You can read all the information about it in here. If your USB flash drive is formatted as FAT32, change it to NTFS, because FAT32 does not keep the MOTW of the files. If the file you are downloading is compressed in .zip format, make sure you open/extract it using Windows built-in support for .zip files because it keeps the MOTW of the files. If the compressed file you downloaded is in other formats such as .7zip or .rar, make sure you use an archive program that supports keeping the mark of the Web of files after extraction. One of those programs is NanaZip which is a fork of 7zip, available in Microsoft Store and GitHub, compared to 7zip, it has better and modern GUI, and the application is digitally signed. After installation, open it, navigate to Tools at the top then select Options, set Propagate zone.id stream to Yes. You can use this PowerShell command to find all the info about the Zone Identifier of the files you downloaded from the Internet.

Get-Content <Path-To-File> -stream zone.identifier
  • Red Star denoting Security Recommendation When using Xbox, make sure you configure sign-in preference and set it to either Ask for my PIN or Lock it down. The latter is the most secure one since it will require authentication using Microsoft Authenticator app. Ask for my PIN is recommended for the most people because it will only require a PIN to be entered using controller.

  • Red Star denoting Security Recommendation A few reminders about open source programs:

    • Unless you are a skilled programmer who can understand and verify every line of code in the source, and spends time to personally build the software from the source, and repeats all the aforementioned tasks for each subsequent version, then seeing the source code won't have any effect on you because you aren't able to understand nor verify it.

    • The majority of "open source" programs are unsigned, meaning they don't have a digital signature, their developers haven't bought and used a code signing certificate to sign their program. Among other problems, this poses a danger to the end-users, makes it harder to create trust for those programs in security solutions and makes it hard to authenticate them. Read Microsoft's Introduction to Code Signing or Digicert's 5 reasons why Code Signing is necessary.

    • When using "open source" program, there is not the kind of liability that you've got when you consume software from a commercial entity that is obligated and knows their reputation is at risk/stake, that they have potential legal liability if there are vulnerabilities in their software. In the open-source world, there is a volunteer, consume it as is, and if there is a problem with the software, that's your responsibility.

  • Red Star denoting Security Recommendation More Security Recommendations coming soon...

💡 (back to top)


horizontal super thin rainbow RGB line


ResourcesResourcesIcon

💡 (back to top)


LicenseLicenseFreeIcon

Not Applicable, No license, just free information, because the only mission of this GitHub repository is to give all Windows users accurate, up to date and correct facts and information about how to stay secure and safe in dangerous environments, and to stay not one, but Many steps, ahead of threat actors.

Harden-Windows-Security is a PowerShell script


Microsoft Tech Community Profile  ·  GitHub @HotCakeX  ·  Steam @HotCakeX  ·  Xbox @HottCakeX

Harden-Windows-Security is a PowerShell script

Flag of Australia Flag of United States Flag of EU Flag of NATO Flag of United Kingdom Flag of Israel

About

Harden Windows Safely, Securely using Official Supported Microsoft methods with proper explanation | Always up-to-date and works with the latest build of Windows

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • PowerShell 100.0%