EndpointComplianceScan

1.0.0

A read-only scanner that checks a Windows workstation or server against compliance frameworks chosen at run time (CMMC, NIST SP 800-171 and 800-53, DISA STIGs, CIS Controls, NIST CSF, PCI DSS, HIPAA) and reports a result with evidence for each requirement. Includes a roll-up across machines and a scheduled-scan installer.

Minimum PowerShell version

5.1

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name EndpointComplianceScan

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name EndpointComplianceScan

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

Copyright 2026 Riff Millar. Apache License 2.0.

Package Details

Author(s)

  • Riff Millar

Tags

Compliance Security Audit CMMC NIST STIG DISA CIS PCI-DSS HIPAA Windows

Functions

Invoke-EndpointComplianceScan New-ComplianceRollup Register-ComplianceScanTask

PSEditions

Desktop Core

Dependencies

This module has no dependencies.

Release Notes

1.0.0: First stable release; Compatibility says what 1.x keeps stable. Also on the PowerShell Gallery as the EndpointComplianceScan module (Install-Module EndpointComplianceScan), whose commands Invoke-EndpointComplianceScan, New-ComplianceRollup and Register-ComplianceScanTask run the same scripts with the same parameters; tools/Build-Module.ps1 builds it, and the tests build and import it on both editions. Reports now default to .\Reports in the current folder, as the README said, instead of a Reports folder beside the script. Without -ProfilePath or a ComplianceScan.local.psd1 beside the script, the scanner uses %ProgramData%\EndpointComplianceScan\ComplianceScan.local.psd1, and stops if that file or its folder is a link or another account owns it. The scan names the local profile it uses. New-ComplianceRollup.ps1 -MaxAge takes 1 to 3650 days. README: Getting started (download, unblock, run elevated), Compatibility, and the task script's exit codes; SECURITY.md covers scheduled scans and supported versions; help lists every STIG and the side effects. Changelog: https://github.com/riffmillar-itadmin/endpoint-compliance-scan#changelog

FileList

Version History

Version Downloads Last updated
1.0.0 (current version) 8 11/2/2026