Comprehensive security hardening scripts for Windows endpoints implementing CISA/NSA compliance standards

Enterprise-grade security hardening solutions that automate the implementation of defense-in-depth security controls across Windows 10/11 systems. Built for government agencies, security professionals, and organizations requiring high-security baseline configurations.

• ✅ Three Security Levels: Quick (30 min), Standard (60 min), Maximum (60+ min)
• ✅ Pre-Flight Validation: Automatic compatibility checks before execution
• ✅ Real-Time Progress Tracking: Visual progress indicators with percentage completion
• ✅ Compliance Reporting: Automated JSON + HTML compliance reports with scoring
• ✅ Enterprise Deployment: Intune/SCCM/RMM ready with silent execution
• ✅ Idempotent Design: Safe to run multiple times without breaking system
• ✅ Comprehensive Backup: Automatic backup before all changes with rollback capability
• ✅ 150+ Security Controls: Complete CISA/NSA hardening baseline

# Download the script
git clone https://github.com/yourusername/endpoint-hardener.git
cd endpoint-hardener

# Run as Administrator - Standard hardening
.\Windows-Endpoint-Hardener-Complete.ps1 -SecurityLevel Standard

# Preview mode (see changes without applying)
.\Windows-Endpoint-Hardener-Complete.ps1 -Preview -SecurityLevel Quick

# Generate compliance report
.\Windows-Endpoint-Hardener-Complete.ps1 -SecurityLevel Maximum -ComplianceReport

Use Case: Immediate security improvement, time-sensitive deployments

Windows: ~30 operations covering firewall, basic Defender, ASR core, TLS basics, basic audit, basic UAC

Use Case: Recommended for most production environments

Windows: ~80 operations including all Quick controls plus LSA Protection, SMB/RDP/NTLM hardening, network protocols, PowerShell security, Print Spooler hardening

Use Case: High-security environments, government/military, compliance requirements

Windows: ~150 operations - complete CISA/NSA baseline including boot security, certificate security, HVCI, Credential Guard, DMA protection, AppLocker, advanced network hardening

• ✅ Windows 10 or Windows 11 (build 14393+)
• ✅ PowerShell 5.1 or later
• ✅ Administrator privileges
• ✅ 1GB+ free disk space
• ⚠️ Windows Professional, Enterprise, or Education edition recommended (some features unavailable on Home)

# Silent execution for RMM tools
.\Windows-Endpoint-Hardener-Complete.ps1 -SecurityLevel Standard -EnterpriseMode -Silent

# Domain-joined systems with compliance report
.\Windows-Endpoint-Hardener-Complete.ps1 -SecurityLevel Maximum -EnterpriseMode -ComplianceReport

# Standalone workstation
.\Windows-Endpoint-Hardener-Complete.ps1 -SecurityLevel Standard -StandaloneMode

# Restore from most recent backup
.\Windows-Endpoint-Hardener-Complete.ps1 -RollbackMode

# Use custom ASR rules
.\Windows-Endpoint-Hardener-Complete.ps1 -ASRRules "guid1,guid2,guid3"

# Disable IPv6
.\Windows-Endpoint-Hardener-Complete.ps1 -SecurityLevel Maximum -DisableIPv6

# Custom exploit protection XML
.\Windows-Endpoint-Hardener-Complete.ps1 -ExploitProtectionXml "C:\config\exploit-protection.xml"

• Logs: C:\HardeningLogs\
• Transcripts: C:\HardeningLogs\Transcript-YYYYMMDD-HHmmss.log
• Compliance Reports: C:\HardeningLogs\ComplianceReport-YYYYMMDD-HHmmss.json|.html
• Backups: C:\HardeningBackup\YYYYMMDD-HHmmss\

⚠️ ALWAYS test in a non-production environment first!

These scripts make significant system changes that can affect:

• Network connectivity
• Application compatibility
• Remote access capabilities
• System performance

• Scripts automatically create backups before changes
• Manual VM snapshots recommended for critical systems
• Test rollback procedures before production deployment

Windows:

• Maximum level may disable legacy protocols (SMBv1, TLS 1.0/1.1)
• Some applications may require exceptions in AppLocker/Controlled Folder Access
• Remote management tools may need reconfiguration

• ✅ CISA/NSA Security Guidelines
• ✅ CIS Benchmarks (Level 1 & 2)
• ✅ NIST Cybersecurity Framework
• ✅ DISA STIGs (Security Technical Implementation Guides)
• ✅ PCI DSS (Payment Card Industry Data Security Standard)
• ✅ HIPAA (Health Insurance Portability and Accountability Act)
• ✅ ISO 27001/27002 (Information Security Management)

The Windows script generates comprehensive compliance reports including:

• Security posture assessment (13 checks across 6 categories)
• Compliance scoring (0-100% with ratings)
• Detailed findings by security control
• Actionable recommendations
• Dual format: JSON (automation) + HTML (executive review)

• ✨ Pre-flight system compatibility checks
• ✨ Real-time progress tracking with percentage
• ✨ Enhanced compliance reporting (JSON + HTML)
• ✨ Improved error handling (PSScriptAnalyzer compliant)
• ✨ Better initialization with visual separators
• 🐛 Fixed null comparison warnings
• 🐛 Enhanced reboot detection (added CBS check)

• Unified script (all CISA/NSA modules integrated)
• Three security levels (Quick/Standard/Maximum)
• Enterprise and Standalone modes

Contributions are welcome! Please read CONTRIBUTING.md for details on:

• Code of conduct
• Development process
• How to submit pull requests
• Coding standards

This project is licensed under the MIT License - see the LICENSE file for details.

USE AT YOUR OWN RISK

This software is provided "as is" without warranty of any kind. The authors are not responsible for any damage or data loss that may result from using these scripts. Always:

1. Test thoroughly in non-production environments
2. Create complete system backups before execution
3. Review all changes in preview mode first
4. Understand the security controls being implemented
5. Have a rollback plan ready

These scripts are designed for security professionals and system administrators who understand the implications of system hardening.

• Issues: GitHub Issues
• Security Vulnerabilities: See SECURITY.md for responsible disclosure
• Documentation: See CLAUDE.md for developer guidance

• CISA/NSA for comprehensive security guidelines
• Microsoft Security Team for Windows hardening best practices
• CIS Benchmarks authors
• DISA STIG contributors

• CISA Security Guidelines
• NSA Cybersecurity Advisories
• CIS Benchmarks
• Microsoft Security Baselines

Made with ❤️ for security professionals worldwide