Windows Security Audit Project

Module-Based Multi-Framework Windows Security Assessment, Auditing, and Remediation Tool

Overview • Key Features • Quick Start • Documentation • Remediation Capabilities • Contributing

🖥️ Supported Operating Systems

OS	Versions	Status	PowerShell	Notes
Windows 11	21H2, 22H2, 23H2, 24H2	✅ Tested	5.1, 7.x	Primary client target
Windows 10	21H2, 22H2, IoT LTSC 2021	✅ Tested	5.1, 7.x	Legacy client support
Windows Server 2025	24H2	✅ Tested	5.1, 7.x	Latest server release
Windows Server 2022	21H2	✅ Tested	5.1, 7.x	Primary server target
Windows Server 2019	1809	✅ Tested	5.1, 7.x	Long-term server support
Windows Server 2016	1607	✅ Tested	5.1, 7.x	Minimum server target
Server Core variants	All above	✅ Compatible	5.1, 7.x	All checks work headless
Windows < 21H2 / Server < 2016	--	❌ Not supported	--	See deferred work

Requirements: Administrator privileges · 100 MB free disk space · No internet access required

📋 Overview

The Windows Security Audit Project is an advanced PowerShell-based security compliance auditing tool that evaluates Windows systems against multiple industry-standard security frameworks. The current release defines 4,065 security checks across 16 compliance modules (the number executed on a given host is host-dependent -- many checks are conditional on installed roles, features, and privilege), generating reports in HTML, JSON, CSV, and XML with actionable remediation guidance.

Every check includes a severity rating (Critical/High/Medium/Low/Informational) and cross-references to equivalent controls across other frameworks, enabling multi-framework compliance scoring from a single audit run. The tool is fully self-contained -- zero external dependencies, pure PowerShell stdlib -- and supports parallel execution, baseline drift comparison, rollback script generation, Group Policy export, and predefined remediation bundles.

Whether you're conducting compliance audits, hardening systems, maintaining security baselines, or feeding SIEM/SOAR pipelines, this tool provides the depth and automation you need.

🎯 Key Features

🔍 Security Assessment

✅ 4,065 Security Checks across 16 compliance frameworks (host-dependent at runtime)
✅ Multi-Framework Coverage -- ACSC Essential Eight, CIS Controls v8, CISA Best Practices/KEV, CMMC 2.0, Core Windows Baseline, ENISA/NIS2, GDPR, HIPAA, ISO 27001:2022, Microsoft Security Baseline, Microsoft Defender for Endpoint, NIST SP 800-53 R5/CSF 2.0/800-171/800-207, NSA Cybersecurity, PCI DSS v4.0.1, SOC 2 Type II, DISA STIG
✅ Modular Architecture -- run all frameworks or select specific modules
✅ Severity Classification -- every check rated Critical/High/Medium/Low/Informational
✅ Cross-Framework Correlation -- every check carries CrossReferences mapping to equivalent controls in other frameworks
✅ Standalone Module Execution -- any module can run independently without the orchestrator
✅ Result Validation -- automated 9-field result-object normalization
✅ No External Dependencies -- pure PowerShell stdlib; zero pip/npm/nuget/external network calls

📊 Advanced Reporting

✅ Interactive HTML Reports with:
- 🌓 Dark/Light theme toggle
- 🔍 Advanced filtering and sorting per column
- 📤 Export All / Export Selected modal (CSV, Excel, JSON, XML Workbook, SIEM XML, TXT)
- ☑️ Checkbox-based selective export
- 📑 Per-module and global export options
- 📊 Executive dashboard with statistics
✅ SIEM-Compatible XML output for security monitoring platforms
✅ Multiple Output Formats - HTML, JSON, CSV, XML, Console, plus 6 browser-based exports
✅ 9-Field Result Objects -- Module, Category, Status, Severity, Message, Details, Remediation, CrossReferences, Timestamp
✅ Structured Data -- API and automation-friendly formats

🔧 Intelligent Remediation

✅ Interactive Remediation - Review and apply fixes individually
✅ Automated Remediation - Batch fix with safety confirmations
✅ Selective Remediation - Target specific status types (Fail, Warning, Info)
✅ Targeted Remediation - Fix only selected issues from JSON export
✅ Remediation Logging - audit trail of all changes
✅ Safety Mechanisms - Double-confirmation and countdown timers
✅ Rollback Support - Detailed logs for reverting changes

📈 Quality Assurance

✅ Result Validation - Ensures data integrity across all modules
✅ Status Normalization - Consistent categorization (Pass/Fail/Warning/Info/Error)
✅ Module Statistics - Real-time tracking and reporting
✅ Execution Metadata - Complete audit trail preservation
✅ Error Handling - Graceful degradation on check failures

🆕 What's New in 6.1.x

✅ Risk Priority Scoring -- 1-100 score combining severity, exploitability, exposure, asset criticality (-ShowRiskPriority)
✅ Cross-Framework Correlations -- group findings that test the same underlying control across modules (-ShowCorrelations)
✅ Compensating Control Detection -- flag failed checks where a passing related control mitigates risk (-ShowCompensatingControls)
✅ Baseline Drift Comparison -- diff against previous audit JSON for new failures, resolved findings, regressions (-Baseline)
✅ Rollback Script Generation -- auto-generate inverse-script from applied remediations (-RollbackPath)
✅ Group Policy Export -- generate .pol file from registry-modifying remediations (-ExportGPO)
✅ Remediation Bundles -- DisableLegacyProtocols, HardenAuthentication, EnableAuditLogging, LockDownRDP, EssentialEightLevel1 (-RemediationBundle)
✅ Help -- in-script help via -Help, -H, -help, -h, -ShowHelp or -? (prefixed forms only)
✅ Auto-Logging -- log file auto-generated at <ScriptRoot>\logs\audit-yyyyMMdd-HHmmss.log when -LogFile omitted; color-coded console output by default
✅ +795 New Checks -- every module expanded; total now 4,065 across 16 modules

See docs/project/CHANGELOG.md for the complete release history. Changes to the CI pipeline and automated test suites are tracked separately in docs/project/CI-CD-Testing-Changelog.md.

🏢 Supported Frameworks

Module	Framework	Checks	Focus Areas
acsc	Australian Cyber Security Centre Essential Eight + Maturity Levels	170	Application control, patching, macros, hardening, admin privs, MFA, backups + ISM, PSPF, ACSI 33, APP
cis	CIS Controls v8 + IG2/IG3 + Cloud/Mobile/ICS-OT Companion Guides	260	Industry best practices, asset inventory, workload-specific (IIS/Exchange/SQL) detection
cisa	CISA Best Practices, KEV catalog, Zero Trust Maturity Model	289	KEV (CVE-2017-0144, CVE-2021-34527, CVE-2023-24932, CVE-2020-1472), BOD 23-02, Secure by Design, ZTMM 5 pillars, CPGs v1.0.1, Bad Practices, PRNI
cmmc	CMMC 2.0 L1/L2/L3 + NIST SP 800-172 + DFARS 252.204-7012	145	Access control, audit, config mgmt, IA, media, comms, integrity, SPRS scoring, CDI/CUI
core	Foundational Windows Security Baseline + Win11 modern features	243	TPM 2.0, VBS+HVCI, Kernel DMA, USB policy, Print Spooler, Sandbox, Pluton, System Guard, kCET, MOTW
enisa	ENISA Cybersecurity + NIS2 Directive + Cyber Resilience Act + DORA	248	NIS2 Art. 21, CRA, Threat Landscape, RICT, IoC, EUCC, AI Threat Landscape
gdpr	GDPR Articles 5/15-21/28/32/35 + ePrivacy + Schrems II	183	Privacy by design, encryption, CIA + resilience, DPIA, pseudonymisation
hipaa	HIPAA Security Rule + NIST SP 800-66 R2 + HITECH + 405(d) HICP	237	Sec.164.312 access/audit/integrity/transmission, HHS Recognized Security Practices, Breach Notification, Cures Act, ONC
iso27001	ISO 27001:2022 + 27002:2022 + 27017/27018 (Cloud) + 27701 (Privacy)	286	Annex A controls, automated SoA, ISO 27005 risk + 27031 ICT continuity
ms	Microsoft Security Baseline (Win11 24H2/Server 2025) + Edge + M365 Apps	367	SCT/LGPO, Defender, AppLocker, ASR, Edge baseline, M365 Office macros, Smart App Control, update channels
ms-defenderatp	Microsoft Defender for Endpoint (ATP/EDR)	155	Component currency, Network Protection, CFA, EPP, WDAC, MDI, per-rule ASR (15 GUIDs), Live Response, Cloud Apps, IOCs
nist	NIST SP 800-53 R5 + CSF 2.0 + 800-171 R3 + 800-207 ZTA + 800-161 SCRM + FedRAMP R5	520	Federal compliance, 8 control families (AC/AU/CM/IA/IR/MP/SC/SI) + 12 framework extensions
nsa	NSA Cybersecurity (CSI + AD hardening + Top 10 Mitigations)	225	Credential isolation, AppWhitelisting, HVCI, AD DC/member hardening, BlackLotus mitigation, CSfC, IPv6
pcidss	PCI DSS v4.0/v4.0.1 + PIN Security + 3DS Core + SSF	279	Customized Approach, SAQ detection, CHD discovery, network segmentation, SAD prohibition, Req 9 physical
soc2	SOC 2 Trust Service Criteria + AICPA TSP Section 100 PoF	162	Common Criteria + Processing Integrity + Privacy criteria, Type II evidence collection
stig	DISA STIGs + SRG cross-mapping + Microsoft Defender STIG	225	V-finding format, STIG Viewer compatibility, BlackLotus mitigation, CAT I/II/III distribution + POA&M flagging

Total Coverage: 4,065 security checks with severity classification and cross-framework correlation. Coverage spans access control, authentication, auditing/logging, network security, data protection at-rest and in-transit, malware defense, system hardening, EDR, Zero Trust architecture, privacy compliance, payment card security, healthcare data protection, supply chain risk management, and cloud-extension controls.

🚀 Quick Start

Prerequisites

Operating System: Windows 10/11 or Windows Server 2016/2019/2022/2025
PowerShell: Version 5.1 or later (included in modern Windows)
Privileges: Administrator rights required for complete results
Privileges for Remediation: Administrator rights mandatory for applying fixes

Installation

Clone the repository:

   git clone https://github.com/Sandler73/Windows-Security-Audit-Project.git
   cd Windows-Security-Audit-Project

Set execution policy (if needed):

   Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

Verify prerequisites:

   # Check PowerShell version
   $PSVersionTable.PSVersion

   # Check if running as Administrator
   ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

Basic Usage

Run full audit with default HTML report:

.\Windows-Security-Audit.ps1

Run specific frameworks:

.\Windows-Security-Audit.ps1 -Modules Core,NIST,CISA

Run with Defender ATP assessment:

.\Windows-Security-Audit.ps1 -Modules Core,MS,MS-DefenderATP

Generate CSV output:

.\Windows-Security-Audit.ps1 -OutputFormat CSV

SIEM integration with XML:

.\Windows-Security-Audit.ps1 -OutputFormat XML -OutputPath "\\SIEM\imports\audit.xml"

Run a single module standalone (no orchestrator needed):

.\modules\module-cis.ps1

🔧 Remediation Capabilities

Version 5.3 introduces remediation features with multiple workflows to suit different needs and risk tolerances.

Remediation Modes

1. Interactive Remediation (Safest)

Review and approve each fix individually:

.\Windows-Security-Audit.ps1 -RemediateIssues

Prompts for each remediation
Full visibility into changes
Skip option (Y/N/S)
Recommended for production systems

2. Status-Based Remediation

Target specific severity levels:

# Fix only critical failures
.\Windows-Security-Audit.ps1 -RemediateIssues_Fail

# Fix warnings interactively
.\Windows-Security-Audit.ps1 -RemediateIssues_Warning

# Address informational items
.\Windows-Security-Audit.ps1 -RemediateIssues_Info

# Fix everything (all status types)
.\Windows-Security-Audit.ps1 -RemediateIssues

3. Automated Remediation (Advanced)

Batch remediation with safety confirmations:

.\Windows-Security-Audit.ps1 -RemediateIssues_Fail -AutoRemediate

Safety Features:

Displays all changes before execution
Requires typing "YES" to confirm
Secondary confirmation with 10-second timeout
Requires typing "CONFIRM" to proceed
remediation logging

4. Targeted Remediation (Precision)

Fix only specific issues selected from HTML report:

Workflow:

# Step 1: Run audit and review findings
.\Windows-Security-Audit.ps1

# Step 2: In HTML report, select specific issues and click "Export Selected"
# This generates a JSON file (e.g., Selected-Report.json)

# Step 3: Run targeted auto-remediation
.\Windows-Security-Audit.ps1 -AutoRemediate -RemediationFile "Selected-Report.json"

Benefits:

Surgical precision - fix only what you select
Review in detail before committing
Perfect for change control processes
Ideal for compliance-driven remediation

Remediation Logging

All remediation actions are logged with full details:

Remediation-Log-YYYYMMDD-HHMMSS.json

Log includes:

Timestamp for each action
Module and category
Issue description
Remediation command executed
Success/failure status
Error messages (if failed)

Example Remediation Output

========================================================================================================
                                  REMEDIATION MODE
========================================================================================================

[*] Mode: Remediate FAIL issues only
[*] Found 42 issue(s) with remediation available

[*] Issue: SMBv1 protocol is ENABLED
    Module: STIG | Status: Fail | Category: STIG - V-220968 (CAT II)
    Remediation: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
    Apply remediation? (Y/N/S=Skip remaining): Y
    [+] Remediation applied successfully

[*] Issue: Guest account is ENABLED
    Module: Core | Status: Fail | Category: Core - Accounts
    Remediation: Disable-LocalUser -Name Guest
    Apply remediation? (Y/N/S=Skip remaining): Y
    [+] Remediation applied successfully

========================================================================================================
Remediation Summary:
  Total issues found: 42
  Successfully remediated: 38
  Failed remediations: 2
  Skipped: 2
  Success rate: 90.5%
========================================================================================================

[*] Remediation log saved to: Remediation-Log-20250101-120000.json
[*] Some settings may require a system restart to take effect.
Would you like to restart now? (Y/N):

📊 Output Formats & Reports

1. HTML Report (Interactive) - Default

Features:

🎨 Theme Toggle - Switch between light and dark modes
📊 Executive Dashboard - Summary statistics and compliance overview
🔍 Advanced Filtering - Filter by status, category, or keyword per column
↕️ Dynamic Sorting - Click column headers to sort
📤 Export Options:
- Export All - Complete report in multiple formats
- Export Selected - Choose specific issues via checkboxes
- Per-Module Export - Export individual framework results
- Format Options - CSV, Excel, JSON, XML, TXT
📑 Collapsible Modules - Expand/collapse each framework section
🔧 Remediation Guidance - Detailed fix instructions for each finding
📱 Responsive Design - Works on desktop and tablet displays

Export Workflow:

Review findings in HTML report
Use checkboxes to select specific issues
Click "Export Selected" → Choose format (JSON for remediation)
Use exported JSON with -RemediationFile parameter

2. XML Report (SIEM Integration)

Standardized format for security monitoring platforms:

<?xml version="1.0" encoding="UTF-8"?>
<security_audit>
  <metadata>
    <export_date>2025-01-01T12:00:00Z</export_date>
    <computer_name>HOSTNAME</computer_name>
    <total_checks>4065</total_checks>
    <pass_count>456</pass_count>
    <fail_count>42</fail_count>
  </metadata>
  <events>
    <event>
      <timestamp>2025-01-01T12:00:00Z</timestamp>
      <module>STIG</module>
      <status>Fail</status>
      <category>V-220968</category>
      <message>SMBv1 protocol is ENABLED</message>
      <remediation>Disable-WindowsOptionalFeature...</remediation>
    </event>
  </events>
</security_audit>

Use Cases:

Splunk, QRadar, ArcSight integration
Automated compliance monitoring
Trend analysis and alerting
Centralized security dashboards

3. JSON Report (Automation)

{
  "ExecutionInfo": {
    "ComputerName": "HOSTNAME",
    "OSVersion": "Windows 11 Pro",
    "ScanDate": "2025-01-01 12:00:00",
    "Duration": "00:02:34",
    "TotalChecks": 4065,
    "PassCount": 456,
    "FailCount": 42
  },
  "Results": [
    {
      "Module": "STIG",
      "Category": "STIG - TLS/SSL",
      "Status": "Fail",
      "Severity": "High",
      "Message": "V-220968: SMBv1 protocol is ENABLED",
      "Details": "CAT II: Disable SMBv1 immediately -- lateral movement vector",
      "Remediation": "Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart",
      "CrossReferences": { "STIG": "V-220968", "NIST": "SC-8", "CIS": "18.3.3" },
      "Timestamp": "2025-03-03 12:00:00"
    }
  ]
}

4. CSV Report (Spreadsheet Analysis)

Excel-compatible format for:

Pivot tables and dashboards
Remediation tracking
Progress monitoring
Management reporting

5. Console Output (Real-Time)

======================================================================================================
                        Windows Security Audit Project v6.7.0
                        Multi-Framework Security Assessment
========================================================================================================

[*] Modules to execute: Core, CIS, MS, MS-DefenderATP, NIST, STIG, NSA, CISA

[Core] Starting core security baseline checks...
[+] Module Core completed: 176 checks (152 pass, 12 fail, 12 warning)

[STIG] Checking DISA STIG compliance...
[+] Module STIG completed: 184 checks (148 pass, 22 fail, 14 warning)

========================================================================
                            AUDIT SUMMARY
========================================================================
Total Checks:    4065
Passed:          1542 (83.1%)
Failed:          156 (8.4%)
Warnings:        118 (6.4%)
Info:            28 (1.5%)
Errors:          0 (0.0%)
Duration:        00:02:34
========================================================================

[+] HTML report saved to: Windows-Security-Audit-<HOSTNAME>-2026-07-24_172021.html
[*] Opening report in browser...
[+] Audit completed successfully!

📖 Documentation

documentation is available in the Project Wiki:

Getting Started

Quick Start Guide - Get up and running in 5 minutes
Usage Guide - Detailed command-line options and workflows

Reference Documentation

Framework Reference - Detailed framework mappings and control IDs
Module Documentation - Individual module specifications
Output Reference - Report format specifications

Advanced Topics

Development Guide - Contributing and extending modules
Troubleshooting Guide - Common issues and solutions
FAQ - Frequently asked questions

🛠️ Command-Line Parameters

.\Windows-Security-Audit.ps1

  # Scope selection
    [-Modules <String[]>]              # Frameworks to run (default: All)
    [-Profile <String>]                # Role profile: Workstation, MemberServer, DomainController,
                                       #   ServerCore, Minimal, Full (explicit -Modules wins)
    [-ListModules]                     # List available modules and exit
    [-ListProfiles]                    # List available audit profiles and exit
    [-AssetCriticality <1-10>]         # Business criticality of this host; feeds
                                       #   risk-priority scoring (default: role-derived)
    [-ComplianceThreshold <0-100>]     # Weighted compliance %% at/above which posture
                                       #   reports PASS (default: 70)

  # Output and reporting
    [-OutputFormat <String>]           # HTML, CSV, JSON, XML, Console, All
    [-OutputPath <String>]             # Custom output path
    [-SplitReports]                    # Also emit one tailored report per framework
                                       #   (reports\by-framework\)
    [-SplitOnly]                       # Per-framework reports only; skip the combined report
    [-AttackSurfaceReport]             # Also emit the attack-surface assessment report
    [-ShowRiskPriority]                # Include risk-priority scoring
    [-ShowCorrelations]                # Include cross-framework correlations
    [-ShowCompensatingControls]        # Include compensating-control analysis
    [-ShowProfile]                     # Show performance profiling

  # Remediation (see Remediation Capabilities)
    [-RemediateIssues]                 # Interactive remediation (all statuses)
    [-RemediateIssues_Fail]            # Remediate FAIL status only
    [-RemediateIssues_Warning]         # Remediate WARNING status only
    [-RemediateIssues_Info]            # Remediate INFO status only
    [-AutoRemediate]                   # Automated remediation with confirmations
    [-RemediationFile <String>]        # JSON file with selected issues to remediate
    [-RemediationBundle <String>]      # Apply a named bundle (see -ListBundles)
    [-ListBundles]                     # List remediation bundles with impact/tier and exit
    [-RollbackPath <String>]           # Write a rollback script capturing pre-change state
    [-ExportGPO <String>]              # Export findings as a Group Policy registry file

  # Execution and diagnostics
    [-Parallel]                        # Run modules in parallel runspaces
    [-Workers <Int>]                   # Parallel worker count (default 4, max 16)
    [-NoCache]                         # Disable the shared data cache
    [-Baseline <String>]               # Compare against a previous JSON baseline
    [-LogFile <String>]                # Log file path (auto-generated when omitted)
    [-LogLevel <String>]               # DEBUG, INFO, WARNING, ERROR
    [-JsonLog]                         # Emit structured JSON logs
    [-Quiet]                           # Suppress console logging
    [-ShowHelp]                        # Full help screen

Parameter Examples

Framework Selection:

# Run all frameworks (default)
.\Windows-Security-Audit.ps1

# Run specific frameworks
.\Windows-Security-Audit.ps1 -Modules Core,NIST,CISA

# Run single framework
.\Windows-Security-Audit.ps1 -Modules STIG

Output Control:

# Generate HTML report (default)
.\Windows-Security-Audit.ps1 -OutputFormat HTML

# Generate CSV for Excel analysis
.\Windows-Security-Audit.ps1 -OutputFormat CSV

# Generate XML for SIEM
.\Windows-Security-Audit.ps1 -OutputFormat XML

# Console output only
.\Windows-Security-Audit.ps1 -OutputFormat Console

# Custom output location
.\Windows-Security-Audit.ps1 -OutputPath "C:\SecurityAudits\Report.html"

Profiles, Split Reports, and Attack Surface:

# List the available role profiles, then run one
.\Windows-Security-Audit.ps1 -ListProfiles
.\Windows-Security-Audit.ps1 -Profile DomainController

# Emit per-framework reports alongside the combined report
.\Windows-Security-Audit.ps1 -SplitReports

# Per-framework reports only (skips the combined HTML report)
.\Windows-Security-Audit.ps1 -SplitOnly

# Add the attack-surface assessment report
.\Windows-Security-Audit.ps1 -AttackSurfaceReport

Remediation Workflows:

# Interactive remediation (review each)
.\Windows-Security-Audit.ps1 -RemediateIssues

# Auto-fix critical failures only
.\Windows-Security-Audit.ps1 -RemediateIssues_Fail -AutoRemediate

# Interactive fix warnings
.\Windows-Security-Audit.ps1 -RemediateIssues_Warning

# Targeted remediation from JSON
.\Windows-Security-Audit.ps1 -AutoRemediate -RemediationFile "Selected-Report.json"

🎯 Use Cases

1. Compliance Auditing

Scenario: Annual SOC 2, FISMA, or CMMC compliance audit

# Generate compliance report
.\Windows-Security-Audit.ps1 -Modules NIST,STIG,CIS -OutputFormat HTML

# Export findings to CSV for compliance tracking
# Use HTML report's "Export All" → CSV feature

2. System Hardening

Scenario: Harden new Windows servers before production deployment

# Step 1: Baseline audit
.\Windows-Security-Audit.ps1 -Modules Core,CIS,MS

# Step 2: Review and auto-fix critical issues
.\Windows-Security-Audit.ps1 -RemediateIssues_Fail -AutoRemediate

# Step 3: Verify remediation
.\Windows-Security-Audit.ps1 -Modules Core,CIS,MS

3. Configuration Drift Detection

Scenario: Monthly security posture checks

# Generate baseline
.\Windows-Security-Audit.ps1 -OutputPath "C:\Baselines\2025-01-baseline.html"

# Compare later
.\Windows-Security-Audit.ps1 -OutputPath "C:\Baselines\2025-02-check.html"

# Use CSV exports to track changes in Excel

4. Incident Response

Scenario: Validate system security after suspected compromise

# Quick security validation (core checks)
.\Windows-Security-Audit.ps1 -Modules Core -OutputFormat JSON

# validation (all frameworks)
.\Windows-Security-Audit.ps1 -OutputFormat HTML

5. SIEM Integration

Scenario: Automated compliance monitoring pipeline

# Scheduled task to generate XML for SIEM
.\Windows-Security-Audit.ps1 -OutputFormat XML -OutputPath "\\SIEM\drops\%COMPUTERNAME%-audit.xml"

6. Change Control Validation

Scenario: Pre/post-change security validation

# Pre-change baseline
.\Windows-Security-Audit.ps1 -OutputPath "Pre-Change-Audit.json"

# Post-change validation
.\Windows-Security-Audit.ps1 -OutputPath "Post-Change-Audit.json"

# Compare JSON files programmatically

🗂️ Project Structure

Windows-Security-Audit/
├── Windows-Security-Audit.ps1            # Main orchestrator (v6.7.0)
│   ├── Result validation & normalization
│   ├── Module execution engine
│   ├── Multi-format report generation
│   └── Intelligent remediation system
│
├── modules/                              # Compliance framework modules
│   ├── module-acsc.ps1                  # ACSC Essential Eight (169 checks)
│   ├── module-cis.ps1                   # CIS Benchmarks (271 checks)
│   ├── module-cisa.ps1                  # CISA Best Practices (291 checks)
│   ├── module-cmmc.ps1                  # CMMC Level 2 (150 checks)
│   ├── module-core.ps1                  # Core Security Baseline (242 checks)
│   ├── module-enisa.ps1                 # ENISA Guidelines (251 checks)
│   ├── module-gdpr.ps1                  # GDPR Technical Controls (182 checks)
│   ├── module-hipaa.ps1                 # HIPAA Security Rule (241 checks)
│   ├── module-iso27001.ps1              # ISO 27001:2022 (285 checks)
│   ├── module-ms.ps1                    # Microsoft Baselines (385 checks)
│   ├── module-ms-defenderatp.ps1        # Defender ATP (154 checks)
│   ├── module-nist.ps1                  # NIST SP 800-53/CSF (526 checks)
│   ├── module-nsa.ps1                   # NSA Guidance (224 checks)
│   ├── module-pcidss.ps1                # PCI DSS v4.0 (287 checks)
│   ├── module-soc2.ps1                  # SOC 2 Type II (161 checks)
│   └── module-stig.ps1                  # DISA STIGs (234 checks)
│
├── shared_components/                    # Shared libraries loaded by the orchestrator
│   ├── audit-common.ps1                 # Core helpers: logging, caching, registry, services, policies
│   ├── host-facts.ps1                   # HostFacts registry: 40 derived host facts, computed once
│   ├── shared-assessments.ps1           # One-shot host-wide collections shared across modules
│   ├── profiles.ps1                     # Role-based audit profiles (-Profile / -ListProfiles)
│   ├── report-templates.ps1             # Per-framework tailored split-report renderers
│   ├── canonical-remediations.ps1       # Canonical fix form per hardening topic + classifier
│   ├── remediation-library.ps1          # Per-topic apply / verify / impact / rollback specification
│   ├── remediation-bundles.ps1          # Named bundles + impact-tiered confirmation
│   ├── rollback-generator.ps1           # State capture + standalone rollback script generation
│   └── attack-surface.ps1               # Attack-surface exposure assessment and report
│
├── tests/                                # Pester test suites (13 files)
│
├── docs/                                 # Documentation
│   ├── project/                         # CHANGELOG, README, USAGE_GUIDE, SECURITY, decisions/
│   └── wiki/                            # User and developer wiki pages
│
├── tasks/                                # Working state: plan, lessons, component manifest
│
├── reports/                              # Generated reports (auto-created)
│   ├── Windows-Security-Audit-<HOSTNAME>-<date>.html|json|csv|xml
│   ├── by-framework/                    # Per-framework reports (-SplitReports)
│   └── attack-surface-*.html            # Attack-surface report (-AttackSurfaceReport)
│
├── logs/                                 # Audit and remediation logs (auto-created)
│
├── README.md                             # This file
├── CONTRIBUTING.md                       # Contribution guidelines
├── CHANGELOG.md                          # Version history
├── SECURITY.md                           # Security policy
├── LICENSE                               # MIT License
└── .gitignore                            # Git ignore rules

🔍 What Gets Audited?

Security Domains

Domain	Checks	Examples
Access Control	200+	Account policies, user rights, privilege management, local admin enumeration
Authentication	160+	Password policies, MFA requirements, credential protection (WDigest, LSASS)
Audit & Accountability	140+	Event logging (18+ subcategories), audit policies, log retention, PowerShell logging
System Hardening	250+	UAC, Secure Boot, service configuration, AutoPlay/AutoRun, least privilege
Network Security	180+	Firewall (all profiles), SMB security, LLMNR, NetBIOS, protocol hardening
Data Protection	120+	BitLocker encryption, EFS usage, data at rest/in transit protection
Malware Defense	150+	Windows Defender (real-time, cloud, behavior), signature updates, ASR rules
Application Control	80+	AppLocker policies, WDAC, software restriction, execution policies
Update Management	60+	Windows Update status, pending updates, automatic update configuration
Incident Response	50+	System Restore, backup configuration, VSS, recovery capabilities

Example Checks (Subset)

✅ Critical Security Controls:

SMBv1 protocol disabled (WannaCry/NotPetya vector)
BitLocker encryption enabled on system drive
Windows Defender real-time protection active
PowerShell v2 disabled (no logging, downgrade attacks)
Guest account disabled
Built-in Administrator renamed/disabled
UAC enabled with secure desktop prompts
Account lockout policy configured (≤5 attempts)
Network Level Authentication required for RDP
LSASS running as Protected Process Light

✅ Compliance Requirements:

Minimum password length ≥14 characters (STIG)
Password history ≥24 passwords (STIG/CIS)
Audit policy configured for 18+ subcategories (NIST)
Security event log ≥1024 MB (STIG)
Firewall enabled on all profiles (CAT I)
LAN Manager authentication level ≥5 (STIG)
SMB signing required (NIST/CIS)
WDigest credential caching disabled (NSA)

✅ Hardening Measures:

Credential Guard enabled (if supported)
Device Guard/HVCI configured
Attack Surface Reduction rules active
Controlled Folder Access (ransomware protection)
Network Protection enabled
Exploit Protection configured
Secure Boot enabled
Unnecessary services disabled

See Module Documentation for complete check listings.

⚠️ Important Considerations

Administrative Privileges

Audit Mode:

Many checks require Administrator privileges
Non-admin execution shows warnings but continues
Some checks will return "Unable to verify" without elevation

Remediation Mode:

Administrator privileges MANDATORY
Script validates admin rights before remediation
Exits gracefully if running without elevation

Performance & Impact

Execution Time:

Full audit (all 16 modules): 3-7 minutes
Single module: 15-60 seconds
Factors: System speed, enabled features, module selection

System Impact:

Read-only operations during audit (no changes)
Minimal CPU/memory usage
No network traffic (except Windows Update checks)
Safe to run on production systems

Remediation Impact:

Makes persistent configuration changes
May affect system functionality
Some changes require restart
Test in non-production first

Security & Privacy

✅ What the script does:

Reads system configuration (registry, services, policies)
Queries Windows Security Center
Checks file/folder permissions
Generates local reports

❌ What the script does NOT do:

Transmit data externally
Install software
Create network connections (except localhost)
Access user data or files
Modify system during audit (only with remediation flags)

Report Security:

Reports may contain sensitive system information
Store reports securely with appropriate access controls
Sanitize reports before sharing externally
Consider encrypting reports for compliance

Testing & Validation

Before Production Use:

Test on non-production systems first
Review all remediation commands before auto-applying
Create system restore point before remediation
Have backups available
Plan maintenance window for changes requiring restart

Validation:

Run baseline audit, remediate, then re-audit
Compare before/after results
Verify system functionality after remediation
Check application compatibility

Limitations

Local assessment only - Does not audit remote systems or domains
Point-in-time - Results represent configuration at execution time
Platform-specific - Windows 10/11 and Server 2016+ only
Feature detection - Some checks may not apply to all Windows editions
No active scanning - Does not test for exploitable vulnerabilities

Disclaimer

This tool is provided for security assessment and compliance auditing purposes. Results should be reviewed by qualified security professionals and validated in the context of your environment. The tool identifies potential security issues but does not guarantee security coverage. Always test in non-production environments before applying remediations to production systems.

🤝 Contributing

We welcome contributions! Please see CONTRIBUTING.md for details.

Ways to Contribute

🐛 Report bugs - Found an issue? Open a GitHub issue
💡 Suggest features - Have an idea? Start a discussion
📝 Improve documentation - Enhance wiki pages and examples
🔧 Submit bug fixes - Fix issues and submit PRs
✨ Add checks - Contribute new security checks or modules
🧪 Test - Validate on different Windows versions
🌐 Translate - Help with internationalization

Development Workflow

Fork the repository
Create a feature branch (git checkout -b feature/NewSecurityCheck)
Follow coding standards (see Development Guide)
Test thoroughly on multiple Windows versions
Update documentation
Commit changes (git commit -m 'Add: New SMB3 encryption check')
Push to branch (git push origin feature/NewSecurityCheck)
Open a Pull Request with detailed description

Coding Standards

PowerShell style - Follow PowerShell best practices
Error handling - Use try/catch blocks appropriately
Comments - Document complex logic
Function naming - Use Verb-Noun format
Result format - Follow standardized output structure
Testing - Validate on Windows 10, 11, Server 2019, 2022

📜 License

This project is licensed under the MIT License - see LICENSE for details.

What This Means

✅ You can:

Use commercially
Modify and distribute
Use privately
Sublicense

❌ You cannot:

Hold authors liable
Use trademarks

📋 You must:

Include license and copyright notice
State changes made

🙏 Acknowledgments

This project builds upon the work and guidance of various security organizations:

Security Frameworks

DISA - Defense Information Systems Agency STIGs
NIST - National Institute of Standards and Technology
CIS - Center for Internet Security Benchmarks
NSA - National Security Agency Cybersecurity Guidance
CISA - Cybersecurity and Infrastructure Security Agency
Microsoft - Security Compliance Toolkit

Community

Contributors who've submitted PRs and reported issues
Security professionals who've provided feedback
Windows administrators who've tested in production environments

Tools & Libraries

PowerShell team for the excellent scripting platform
Windows security community for research and documentation

📞 Support & Resources

Get Help

📖 Documentation - Project Wiki
❓ Questions - GitHub Discussions
🐛 Bug Reports - GitHub Issues
💬 Community - [Security Community Forums]

Stay Updated

⭐ Star the repository - Get notifications for new releases
👀 Watch - Follow development activity
🔔 Subscribe to releases - Get notified of new versions

Security Issues

Review SECURITY.md for vulnerability reporting
Report security issues privately via GitHub Security Advisories
Expected response time: 48-72 hours

📊 Project Statistics

Metric	Value
Current Version	6.7.0
Total Security Checks	4,065
Frameworks Covered	16
Code Base	~38,000 lines of PowerShell (modules: ~36,000 + orchestrator: ~2,400 + shared lib: ~1,800)
Modules	16 specialized compliance modules
Output Formats	5 native (HTML, JSON, CSV, XML, Console) + 6 browser-based exports
Windows Versions Tested	10 (21H2+), 11 (21H2+), Server 2016, 2019, 2022, 2025
PowerShell Version	5.1+
Result Fields	9 (Module, Category, Status, Severity, Message, Details, Remediation, CrossReferences, Timestamp)
Foundation Library Functions	39
Active Development	✅ Yes

📄 Version History

Version 6.7.0 (Current) - July 2026 (Report Structure and Documentation Sync)

Unified output layout: reports\<hostname>\ holds the composite report, composite JSON, and attack-surface report, with per-framework reports in by-framework\ beneath it
Hostname and date in every report filename, so a report stays identifiable once copied
Attack-surface report rebuilt: host cards, table of contents, and a visual executive summary (radial gauge, rating scale, finding mix, per-domain bar chart)
Split reports refined: composite-style host cards, result cards beside the donut, an Overall Rating card with colour banding, right-sized Status and Severity columns, and fully resizable tables
Documentation synchronised against the codebase and verified by audit: version metadata, per-module check counts, component inventory, and test listings all regenerated from source

Version 6.5.0 - July 2026 (Pipeline and Scoring Controls)

Composed post-execution pipeline (shared_components/audit-pipeline.ps1): enrichment phases run as one pass with per-phase timing, run metadata, and a machine-readable summary; composes the existing functions rather than replacing them
-AssetCriticality (1-10): business criticality of the host now feeds risk-priority scoring; previously hardcoded
-ComplianceThreshold (0-100): the PASS/FAIL threshold is now operator-settable; previously fixed at 70 despite its verdict appearing in every report
HostFacts raw-object retention: module accessors consult the run-wide fact registry before querying, removing up to 48 redundant host queries on a full run

Version 6.4.0 - July 2026 (Linux Parity Wave 2)

Shared assessments (shared_components/shared-assessments.ps1): expensive host-wide collections (local users, local administrators, installed hotfixes, listening TCP ports) computed once per run and shared with every module, using capped uniform records and error-record discipline
Canonical remediations (shared_components/canonical-remediations.ps1): 28-topic table giving one authoritative fix form per hardening topic, sourced from the audited module tree; normalization never invents a fix for an unclassified finding
Remediation library and bundles (shared_components/remediation-library.ps1, remediation-bundles.ps1): per-topic apply command, read-only verification, impact profile, rollback-capture specification and prerequisites; 10 named bundles with impact-tiered confirmation
Rollback generator (shared_components/rollback-generator.ps1): read-only pre-change state capture across 12 capture types, and generation of a standalone reverse-order restore script with its own typed confirmation
Attack-surface assessment (shared_components/attack-surface.ps1): 10 Windows exposure domains synthesized from audit findings with deterministic domain resolution and five-tier ratings (-AttackSurfaceReport)
Remediation flow upgraded: real pre-change state capture before apply, post-apply read-back verification (previously success meant only that the command did not throw), and impact-tiered confirmation layered on the existing gate
-RemediationBundle is now topic-based; the five v6.1 bundle names continue to work as deprecated aliases

Version 6.3.0 - July 2026 (Linux Parity Wave 1)

HostFacts registry (shared_components/host-facts.ps1): 40 derived host facts computed once per run and shared with all modules
Framework currency PRs 1-16: every module re-verified against its authority's current release (CMMC 48 CFR binding rule, PCI DSS v4.0.1 formerly-future-dated requirements, NIST 800-53 Release 5.2.0, Windows 11 25H2 / Server 2025 v2602 baselines, Windows 11 STIG V2R8, CIS Controls v8.1, HIPAA NPRM labeled forward-looking indicators, CRA Art. 14 / DORA timelines, CISA BOD 22-01 accuracy correction)
Tailored per-framework split reports (shared_components/report-templates.ps1): spec-driven renderer with native grouping and scoring per framework, full interactive spine (status donut dashboard filter, include/exclude search, per-column filters, resizable/sortable/hideable columns, selection-based export modal in five formats, collapsible sections, light/dark toggle), Host and Scope cards, Result Distribution, Overall Compliance (weighted/simple/severity-adjusted), Top Priority Findings, and renderer build-provenance stamping; -SplitReports / -SplitOnly with format-aware CSV/JSON/XML companions
Composite report: Module Summary (At-a-Glance) rollup tiles, Result Distribution naming alignment
Role-based audit profiles (shared_components/profiles.ps1): Workstation, MemberServer, DomainController, ServerCore, Minimal, Full; -Profile / -ListProfiles with HostFacts-driven suggestion
HostFacts memoisation: memoized host-state accessors across all 16 modules (54 duplicated query sites consolidated; identical semantics preserved)

Version 6.2.0 - July 2026 (Audit Remediation + Foundation)

Full-codebase principal-level audit remediation: unified Add-Result contract, silent-check-loss elimination, List-based accumulation, parallel logging via named mutex, parallel fallback/timing fixes, structural doc relocation, regenerated component manifest. See CHANGELOG.

Version 6.1.2 - April 2026 (Patch)

🐛 FIXED: 24 Get-BitLockerStatus -Cache parameter-not-found errors across 13 modules
🐛 FIXED: 3 Get-OSInfo -Cache parameter-not-found errors
🐛 FIXED: 27 [int]"None" Int32 conversion errors in CIS/NIST/STIG (replaced with ConvertTo-SafeInt)
🐛 FIXED: No log file generated when -LogFile is omitted (shared library now auto-generates logs\audit-yyyyMMdd-HHmmss.log)
🐛 FIXED: Write-AuditLog was file-only (now emits color-coded console output, suppressible via -Quiet)
🐛 FIXED: Empty cache-stats display (corrected property names ServicesCached/RegistryCached/HotFixesCached/LocalUsersCached)
✨ ADDED: 15 DEBUG-level statements covering invocation context, prerequisites, module discovery, execution mode, per-module timing, export, completion summary
✨ ADDED: -Quiet and -ScriptRoot parameters on Initialize-AuditLogging

Version 6.1.1 - April 2026 (Patch)

🐛 FIXED: Get-CachedAuditPolicy automation regression -- function was Mandatory and required user input, breaking unattended runs (now optional + dual return mode: text or parsed objects)
✨ ADDED: Multiple help-invocation forms (-Help, -H, -?, -ShowHelp, help, -help, --help, --h, /?, /help, /h)
✨ ADDED: 10-section Show-DetailedHelp function (banner, synopsis, description, frameworks, parameters by group, examples, bundles, quick reference, requirements, more info)
📝 UPDATED: Comment-based help (Get-Help) now documents -ShowHelp parameter, all alias forms, and includes a help-invocation example

Version 6.1.0 - April 2026 (Major Feature Release)

✨ NEW: Risk priority scoring (1-100 scale combining severity, exploitability, exposure, criticality) via -ShowRiskPriority
✨ NEW: Cross-framework correlation grouping via -ShowCorrelations
✨ NEW: Compensating control detection via -ShowCompensatingControls
✨ NEW: Baseline drift comparison via -Baseline <path>
✨ NEW: Rollback script generation via -RollbackPath <path>
✨ NEW: Group Policy .pol file export via -ExportGPO <path>
✨ NEW: Remediation bundles (DisableLegacyProtocols, HardenAuthentication, EnableAuditLogging, LockDownRDP, EssentialEightLevel1) via -RemediationBundle
✨ NEW: Pre-confirmation impact analysis for auto-remediation (reboot/logoff/service/network/destructive summary)
🔧 EXPANDED: 4,065 total checks (up from 3,199; +795 across all 16 modules)
🔧 CONSOLIDATED: NIST module categories (230 → 20) with control-family groupings; precise control IDs preserved in CrossReferences
🔧 EXPANDED: Foundation library -- 10 new cross-cutting functions (ConvertTo-RegistryRollback, ConvertTo-ServiceRollback, Get-RemediationImpact, Get-RiskPriorityScore, Find-CompensatingControls, Find-CrossFrameworkCorrelations, Compare-ToBaseline, Export-RegistryPolicyFile, Test-InternetFacingHost, Test-DomainControllerHost)

Version 6.0.5 - March 2026

✨ NEW: 8 new compliance modules (ACSC, CMMC, ENISA, GDPR, HIPAA, ISO27001, PCI-DSS, SOC2)
🔧 EXPANDED: Total checks increased from 1,855 to 3,199 across 16 modules
🔧 IMPROVED: XSL-styled XML output, report overhaul, 6 browser-based export formats

Version 6.0.0 - March 2025

✨ NEW: Severity classification on every check (Critical/High/Medium/Low/Informational)
✨ NEW: Cross-framework correlation infrastructure
✨ NEW: Microsoft Defender for Endpoint module (86 checks)
✨ NEW: Standalone module execution support
✨ NEW: Cache-aware registry/service/policy helpers via shared library
✨ NEW: 9-field result objects (added Severity and CrossReferences)
🔧 EXPANDED: 1,855 total checks across 8 modules

Version 5.3 - February 2025

✨ NEW: Interactive and automated remediation system
✨ NEW: Targeted remediation from HTML report selections
✨ NEW: SIEM-compatible XML output format
✨ NEW: Enhanced HTML reports with theme toggle
✨ NEW: Multi-format export from HTML (CSV, Excel, JSON, XML, TXT)
🔧 IMPROVED: Safety mechanisms for automated remediation
🐛 FIXED: Status value consistency across modules

Version 5.0 - December 2024

Complete rewrite with modular architecture
550+ security checks across 7 frameworks
Multiple output formats (HTML, JSON, CSV)
documentation

See CHANGELOG.md for complete version history.

⭐ If this project helps you secure Windows systems, please consider giving it a star! ⭐

⬆ Back to Top

Made with ❤️ for the cybersecurity community

Name		Name	Last commit message	Last commit date
.github		.github
Modules		Modules
Shared_Components		Shared_Components
assets		assets
tests		tests
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
CI-CD-Testing-CHANGELOG.md		CI-CD-Testing-CHANGELOG.md
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
USAGE_GUIDE.md		USAGE_GUIDE.md
Windows-Security-Audit.ps1		Windows-Security-Audit.ps1

Latest commit

History

Folders and files

Repository files navigation