Harden Windows Safely, Securely, Only With Official Microsoft Methods
Windows Defender Application Control Resources
The WDACConfig Module for Windows Defender Application Control
Read the Rationale Behind This GitHub Repository
How To Use
Apply the Latest Hardening Measures directly From The GitHub Repository
irm 'https://raw.githubusercontent.com/HotCakeX/Harden-Windows-Security/main/Harden-Windows-Security.ps1' | iexUse the GUI (Graphical User Interface) to apply the latest Hardening Measures
irm 'https://raw.githubusercontent.com/HotCakeX/Harden-Windows-Security/main/Harden-Windows-Security-GUI.ps1' | iexInstall the Harden Windows Security Module from PowerShell Gallery
Check the documentation and How to use
Install-Module -Name 'Harden-Windows-Security-Module' -ForceProtect-WindowsSecurityConfirm-SystemComplianceUnprotect-WindowsSecurityRequirements
PowerShell (latest version), Install it from 🛍️ Microsoft Store or using Winget: Winget install Microsoft.PowerShell
Any device that meets the Windows 11 hardware and Virtualization Based Security requirements.
TPM 2.0, Virtualization technology and Secure Boot enabled in your UEFI settings. Official guide — How to enable Secure Boot on: HP — Lenovo — Dell.
Windows editions higher than Home edition.
No 3rd party AV installed.
Latest available version of Windows installed.
Features
Everything always stays up-to-date with the newest proactive security measures that are industry standards and scalable.
Everything is in plain text, nothing hidden, no 3rd party executable or pre-compiled binary is involved.
No Windows functionality is removed/disabled against Microsoft’s recommendations.
All of the links and sources are from official Microsoft websites, straight from the source. No bias, No FUD, No misinformation and definitely No old obsolete methods. That’s why there are no links to 3rd party news websites, forums, made up blogs/articles, and such.
The module primarily uses Group policies, the Microsoft recommended way of configuring Windows. It also uses PowerShell cmdlets where Group Policies aren’t available, and finally uses a few registry keys to configure security measures that can neither be configured using Group Policies nor PowerShell cmdlets. This is why the module doesn’t break anything or cause unwanted behavior.
The GitHub Readme page lists all of the security measures applied by the module.
When a hardening measure is no longer necessary because it’s applied by default by Microsoft on new builds of Windows, it will also be removed from the module in order to prevent any problems and because it won’t be necessary anymore.
The module can be run infinite number of times, it’s made in a way that it won’t make any duplicate changes.
Applying these hardening measures makes your PC compliant with Microsoft Security Baselines and Secured-core PC specifications (provided that you use modern hardware that supports the latest Windows security features) — See what makes a Secured-core PC — Check Device Guard article for more info
Since I originally created this repository for myself and people I care about, I always maintain it to the highest possible standard.
If you have multiple accounts on your device, you only need to apply the hardening measures 1 time with Admin privileges, that will make system-wide changes. Then you can optionally run the module, without Admin privileges, for each standard user to apply the Non-Admin category.
For your own security, exercise caution when considering any other 3rd-party tools, programs, or scripts claiming to harden or modify Windows OS in any way. Verify their legitimacy thoroughly before use and after each release. Avoid blind trust in 3rd party Internet sources. Additionally, if they don’t adhere to the rules mentioned above, they can cause system damage, unknown issues, and bugs.
- Read the Trust section to see how you can 100% Trust this repository.
- How are Group Policies for this module created and maintained?
Hardening Categories
- May 9 2023 Windows Boot Manager CVE-2023–24932
- Microsoft Security Baselines
- Microsoft 365 Apps Security Baselines
- Microsoft Defender
- Attack surface reduction rules
- Bitlocker Settings
- TLS Security
- Lock Screen
- UAC (User Account Control)
- Windows Firewall
- Optional Windows Features
- Windows Networking
- Miscellaneous Configurations
- Windows Update configurations
- Edge Browser configurations
- Certificate Checking Commands
- Country IP Blocking
- Downloads Defense Measures
- Non-Admin Commands
