windows-hardening

A PowerShell toolkit for hardening Windows on standalone devices. Scripts run in four modes of operation, from interactive setup to scripted automation. Curated definitions files catalog what can be configured, and curated profiles record what to apply and why. One complete, self-contained toolkit with data and logic kept separate by design.

All editions of Windows 11 are supported, with broad Windows 10 compatibility. The toolkit is intended for personal or business devices not joined to an Active Directory domain, where domain policy takes precedence over local policy. Coverage spans registry and Local Group Policy settings, Windows services, and preinstalled packages.

Requirements

• PowerShell 5.1 or later
• Administrator privileges
• LGPO.exe from the Microsoft Security Compliance Toolkit
  (required on Pro, Enterprise, Education, and LTSC editions)

Component Scripts

Each component script supports four modes of operation, consistent across the toolkit:

• Interactive: Configure settings through a menu, for initial setup and targeted adjustment.
• Profile: Apply a pre-built profile to the device without prompting, for scripted hardening and automation.
• Build: Construct a configuration profile on Windows or Linux, for later application to a Windows device.
• Snapshot: Capture the current system state as a profile, for backup or replication.

A snapshot of the current system state is saved automatically before any changes are applied in Interactive or Profile Mode. Get-Help is available on every script for full parameter and usage documentation.

Script	Component	Description	Status
Invoke-WinHardenPolicy	Policy	Registry and Local Group Policy settings	Complete
Invoke-WinHardenServices	Services	Windows service startup configuration	Planned
Invoke-WinHardenPackages	Packages	Preinstalled appx package removal	Planned
Invoke-WinHardenSuite	Orchestrator	Coordinates execution of all components	Planned

Definitions Files

Each definitions file describes the settings each component script can configure, curated from authoritative sources and independent research rather than exhaustive configuration checklists. Each definitions file is specific to one component, and each component may have multiple definitions files.

Policy-MicrosoftPrivacyConnections.psd1 (reference doc) covers 116 registry settings controlling connections and data sharing between Windows and Microsoft services, drawn from the Microsoft article "Manage connections from Windows 10 and Windows 11 operating system components to Microsoft services." The reference document maps every setting to its corresponding section in the source article, documenting where the article's registry guidance is incorrect, identifying inconsistencies, and flagging settings with significant side effects.

Policy-WindowsPrivacyDefaults.psd1 (reference doc) covers 46 registry settings targeting Windows 11 privacy and security defaults not addressed by Policy-MicrosoftPrivacyConnections, drawn from independent research and direct system analysis. Together the two files form a complete privacy and hardening baseline for Windows. The reference document records the research and editorial decisions behind each setting, covering notable side effects, applicability conditions, and settings requiring special handling.

Policy-Edge.psd1 (reference doc) covers 128 registry settings hardening Microsoft Edge for privacy and security on standalone Windows 11 devices, drawn from the Microsoft Edge ADMX policy templates and independent research. The reference document records the editorial decisions behind each setting, documenting three goals: minimizing the data Edge sends to Microsoft, applying browser security hardening, and producing a clean browser experience free of Microsoft-promoted features.

The full list of available definitions files is maintained in definitions/.

Curated Profiles

Each curated profile is a ready-to-apply configuration for a target such as Windows or Edge, assembled from the definitions files and recording what to apply and why. Each target has one base profile and a small number of optional additive layers, distinct from the profiles that Build and Snapshot Mode generate.

Policy-Windows-Base.psd1 (reference doc) is a privacy and security baseline for standalone devices, with 112 settings covering telemetry, app permissions, activity history, content delivery, and default-behavior security hardening. Policy-Windows-NoStoreApps.psd1 is an additive layer for devices that do not use the Microsoft Store or its apps, with 22 settings disabling the Microsoft account, OneDrive, Store, cross-device services, and core app permissions.

Policy-Edge-Base.psd1 (reference doc) is a privacy and security baseline for Microsoft Edge, with 117 settings covering telemetry and tracking, Copilot and AI, sign-in and data retention, browser hardening, and Microsoft-feature removals. Policy-Edge-NoWebConferencing.psd1 is an additive layer for devices that do not use web conferencing, with 3 settings blocking website access to the microphone, camera, and screen capture.

The full list of available profiles is maintained in profiles/.

Setup

Run PowerShell as Administrator, then enter the following commands in order.

Install Git, required to clone the repository:

winget install --id Git.Git --source winget

After installation completes, close and reopen PowerShell as Administrator to make Git available.

Navigate to the directory where the toolkit will be stored:

cd C:\Tools

Clone the repository from GitHub:

git clone https://github.com/briangeis/windows-hardening

Enable local script execution, which Windows restricts by default:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine

Download LGPO.exe, required on Pro, Enterprise, Education, and LTSC editions:

Extract LGPO.exe from the Microsoft Security Compliance Toolkit and place it in the policy directory.

Usage

Run PowerShell as Administrator, then enter the following commands as needed.

Navigate to the toolkit directory:

cd C:\Tools\windows-hardening

To apply the curated Windows baseline:

.\policy\Invoke-WinHardenPolicy.ps1 -ProfilePath .\profiles\Policy-Windows-Base.psd1

To review and apply settings individually:

.\policy\Invoke-WinHardenPolicy.ps1 -DefinitionsPath .\definitions\Policy-MicrosoftPrivacyConnections.psd1

See the Policy README for an example of each of the four modes of operation.

License

This toolkit is licensed under the GNU General Public License v3.0.