Harden-Windows-Security
2023.1.29
💠 Features of this Hardening script:
✅ Always up-to-date and works with latest build of Windows (Currently Windows 11 - compatible and rigorously tested on stable and Insider Dev builds)
✅ Doesn't break anything
✅ Doesn't remove or disable Win
💠 Features of this Hardening script:
✅ Always up-to-date and works with latest build of Windows (Currently Windows 11 - compatible and rigorously tested on stable and Insider Dev builds)
✅ Doesn't break anything
✅ Doesn't remove or disable Windows functionalities against Microsoft's recommendation
✅ The Readme page on GitHub is used as the reference for all of the security measures applied by this script and Group Policies. the order in which they appear there is the same as the one in the script file.
✅ When a hardening command is no longer necessary because it's applied by default by Microsoft on new builds of Windows, it will also be removed from this script in order to prevent any problems and because it won't be necessary anymore.
✅ The script can be run infinite number of times, it's made in a way that it won't make any duplicate changes at all.
✅ The script asks for confirmation, in the PowerShell console, before running each hardening category, so you can selectively run (or don't run) each of them.
✅ Running this script makes your PC compliant with Secured-core PC specifications (providing that you use a modern hardware that supports the latest Windows security features).
✅ Running this script makes your system compliant with the official Microsoft Security Baselines
🛑 Warning: Windows by default is secure and safe, this script does not imply nor claim otherwise. just like anything, you have to use it wisely and don't compromise yourself with reckless behavior and bad user configuration; Nothing is foolproof. this script only uses the tools and features that have already been implemented by Microsoft in Windows OS to fine-tune it towards the highest security and locked-down state, using well-documented, supported, often recommended and official methods. continue reading for comprehensive info.
💠 Hardening Categories from top to bottom: (🔺Detailed info about each of them at my Github🔻)
⏹ Commands that require Administrator Privileges
✅Microsoft Security Baselines
✅Security Baselines X
✅ Windows Security aka Defender
✅ Attack surface reduction rules
✅ Bitlocker Settings
✅ TLS Security
✅ Lock Screen
✅ UAC (User Account Control)
✅ Device Guard
✅ Windows Firewall
✅ Optional Windows Features
✅ Windows Networking
✅ Miscellaneous Configurations
✅ Certificate Checking Commands
✅ Country IP Blocking
⏹ Commands that don't require Administrator Privileges
✅ Non-Admin Commands that only affect the current user and do not make machine-wide changes.
💎 Note: if there are multiple Windows user accounts in your computer, it's recommended to run this script in each of them, without administrator privileges, because Non-admin commands only apply to the current user and are not machine wide.
💎 Note: The script asks for confirmation, in the PowerShell console, before running each hardening category, so you can selectively run (or don't run) each of them.
💎 Note: There are 4 items tagged with #TopSecurity that can break functionalities or cause difficulties so this script does NOT enable them by default. press Control + F and search for #TopSecurity in the GitHub Readme page to find those security measures and how to enable them if you want.
🏴 if you have any questions, requests, suggestions etc. about this script, please open a new discussion in Github:
🟡 https://github.com/HotCakeX/Harden-Windows-Security/discussions
Installation Options
Owners
Copyright
2023
Package Details
Author(s)
- HotCakeX
Tags
Windows Hardening Security Bitlocker Defender Firewall Edge Protection
Functions
Select-Option ModifyRegistry processit Test-IsAdmin Invoke-WithoutProgress Compare-SecureString BlockCountryIP
Dependencies
This script has no dependencies.
Release Notes
##
Version 2022.12.8: Improved the script
##
Version 2022.12.9: Configured LSASS process to run as a protected process with UEFI Lock
##
Version 2022.12.9.1: Added new icon for the script
##
Version 2022.12.10: Enabled ECH (Encrypted Client Hello of TLS) feature for Edge browser
##
Version 2022.12.25: Entirely changed and organized the script's style to be easier to read and find commands
##
Version 2022.12.26: Further improved the script with explanatory comments and improved the Optional Windows Features section
##
Version 2022.12.26.1: Significantly improved Bitlocker script block, logic and style
##
Version 2022.12.26.2: Optimized the script by performing registry modifications using a function and saved 600 lines of code
##
Version 2023.1: The script now allows you to run each hardening category separately and added 2 more categories, 1) certificates and 2) Country IP Blocking
##
Version 2023.1.1: added a checking process to the country IP blocking category so that if the list is empty, no rule will be created.
##
Version 2023.1.1.1: Changed description of the PowerShell Gallery's page
##
Version 2023.1.10: Removed old unnecessary outdated commands, removed most of the links and all descriptions from the script file, USE GITHUB PAGE FOR THE REFERENCE AND PROPER EXPLANATION.
##
Version 2023.1.12: changed Firewall LOLBin blocking section to be faster with Parallel operations and added Secured-core PC compliancy
##
Version 2023.1.12.1: Fixed description text in PowerShell Gallery
##
Version 2023.1.13: Fixed the Country IP blocking list and made it fully compliant with https://www.state.gov/state-sponsors-of-terrorism/
##
Version 2023.1.13.1: Removed the ECH related commands, they weren't official methods, removed Russia in country IP blocking since it wasn't mentioned in https://www.state.gov/state-sponsors-of-terrorism/ . changed Windows time sync interval from every 7 days to every 4 days (previous script value was 2).
##
Version 2023.1.13.2: made Firewall processing section faster by defining a ThrottleLimit based on CPU's logical cores
##
Version 2023.1.16: Bitlocker category now encrypts all drives instead of just OS drive. Certificate checking category now handles situations when WebDav can't be used.
##
Version 2023.1.17: fixed text spacing and colors to improve readability, removed LOLBins blocking as it's no longer necessary to do so. the security features in place make LOLBins blocking unnecessary and redundant and blocking those programs in Firewall can have unknown/unwated behavior.
##
Version 2023.1.22: Added a notice at the beginning of the script to remind the user to read GitHub readme page. added Smart App Control to the Windows Security (Defender) section. script asks for confirmation before turning on Smart App Control.
##
Version 2023.1.23: Changed the registry modification function with a more advanced one. changed code style to reduce function call and use hash tables. Improved the overall design and style of the script. Changed 'ConsentPromptBehaviorAdmin' from UAC category to a #TopSecurity tagged command. see this GitHub issue for more info. https://github.com/HotCakeX/Harden-Windows-Security/issues/2#issuecomment-1400115303 . removed PowerShell Core requirement.
##
Version 2023.1.24: enforce encryption type on removable and fixed drive types to full disk encryption instead of only used disk encryption
##
Version 2023.1.25: The script now applies the official Microsoft Security Baselines and on top of that applies as many of the script settings as possible using Group Policy, the rest of the settings that aren't possible to be applied using Group Policy continue to be applied using registry and PowerShell Cmdlets.
##
Version 2023.1.26: completely optimized the script, changed it to be multilingual-friendly and people with non-English language packs installed or with non-English keyboards, will have an easy time using the script. Thanks to the community feedback on GitHub!
##
Version 2023.1.28: Bitlocker DMA protection enables only when Kernel DMA protection is unavailable, as suggested by Microsoft, and this happens using Group Policies instead of registry. Improved verbosity when importing and installing policies.
##
Version 2023.1.29: Improved Security Baselines categories. added error handling when no Internet connection is available to download them.
FileList
- Harden-Windows-Security.nuspec
- Harden-Windows-Security.ps1
Version History
| Version | Downloads | Last updated |
|---|