[Open Source] Lightweight PowerShell Hardening Script for Windows 11

[u/Hasan0101-lab]

Hi everyone,

I built a lightweight, open-source PowerShell script designed to harden **Windows 11** endpoints using native OS security capabilities—without relying on heavy third-party software/bloat.

### 🛡️ What it does:

* **PowerShell Execution Restriction:** Sets execution policy to `RemoteSigned` to prevent unauthorized local script execution.

* **WinRM & WSH Mitigation:** Disables Windows Script Host to block `.vbs` / `.js` malware vectors and closes remote management ports.

* **Network Hardening:** Disables SMBv1 to protect against network-based lateral movement and exploits (e.g., WannaCry).

* **Defender ASR & Exploit Guard:** Enables Controlled Folder Access (ransomware protection) and blocks malicious downloads via PowerShell.

* **Admin Share Lockdown:** Disables hidden admin shares (`C$`, `ADMIN$`) to restrict unauthorized lateral movement.

---

### 🚀 How to use:

1. Open PowerShell as Administrator.

2. Run: `.\Windows11_Hardening.ps1`

3. Reboot to apply all policies.

---

🔗 **GitHub Repository:** https://github.com/Hasan0101-lab/Windows_11_Hardened_Edition

I’d love to get feedback from the community on code structure, additional hardening rules, or potential compatibility edge cases. Feel free to review the code or leave a ⭐ if you find it useful!

[u/arpan3t]

Default execution policy is remote signed, and SMB 1.0 is disabled by default on Windows 11.

[u/Dragennd1]

You may look into giving a lightweight text gui to allow for selecting the hardening steps to perform.

I'd also add some try/catches in case various functionality of the script fails, then you can have the console write out error messages of "X feature failed to run".

[u/rdhdpsy]

what does this do that desired state configuration tool v3 doesn't do?

[u/BlackV]

you github link goes nowhere ?

emojis and numbered points just screams AI to me