访问官网
Github
文档
论文
Harden Windows Security | A New Threat to Malware
Harden Windows Safely, Securely, Only With Official Microsoft Methods
&label=Harden%20Windows%20Security%20Module&labelColor=rgb(233%2C255%2C125)&color=rgb(246%2C%2082%2C%20160))
&label=WDACConfig%20Module&labelColor=rgb(233%2C255%2C125)&color=rgb(246%2C%2082%2C%20160))
Hardening Categories 
How To Use
Features
Related
Trust
Support
Security Recommendations
Resources
License
Wiki
Basic FAQs Roadmap
[!IMPORTANT]
Click/Tap on Each of the Items Below to Access Them on This GitHub Repository
Windows Defender Application Control Resources
The WDACConfig Module for Windows Defender Application Control
Read the Rationale Behind This GitHub Repository
[!NOTE]
Windows by default is secure and safe, this repository does not imply nor claim otherwise. Just like anything, you have to use it wisely and don't compromise yourself with reckless behavior and bad user configuration; Nothing is foolproof. This repository only uses the tools and features that have already been implemented by Microsoft in Windows OS to fine-tune it towards the highest security and locked-down state, using well-documented, supported, recommended and official methods. Continue reading for comprehensive info.
How To Use
Start The Harden Windows Security Using GUI (Graphical User Interface)
(irm 'https://raw.githubusercontent.com/HotCakeX/Harden-Windows-Security/main/Harden-Windows-Security.ps1')+'P'|iex
Install the Harden Windows Security Module from PowerShell Gallery
Check the documentation and How to use
Click/Tap here for commands
Install-Module -Name 'Harden-Windows-Security-Module' -Force
Install-Module -Name 'Harden-Windows-Security-Module' -Force
Protect-WindowsSecurity
Confirm-SystemCompliance
Unprotect-WindowsSecurity
Requirements 
PowerShell (latest version), Install it from 🛍️ Microsoft Store or using Winget: Winget install Microsoft.PowerShell
Any device that meets the Windows 11 hardware and Virtualization Based Security requirements.
Virtualization technology and Secure Boot enabled in your UEFI settings. Official guide - How to enable Secure Boot on: HP - Lenovo - Dell.
No 3rd party AV installed.
Latest available version of Windows installed.
[!TIP]
Restart your device after applying the hardening measures.
Features 
Everything always stays up-to-date with the newest proactive security measures that are industry standards and scalable.
Everything is in clear text, nothing hidden, no 3rd party executable or pre-compiled binary is involved.
No Windows functionality is removed/disabled against Microsoft's recommendations.
All of the links and sources are from official Microsoft websites, straight from the source. No bias, No FUD, No misinformation and definitely No old obsolete methods. That's why there are no links to 3rd party news websites, forums, made up blogs/articles, and such.
With the following exceptions
| Link Count | Link | Reason |
|---|---|---|
| 1 | Intel website | i7 13700k product page |
| 1 | state.gov | List of State Sponsors of Terrorism |
| 1 | orpa.princeton.edu | OFAC Sanctioned Countries |
| 2 | Wikipedia | TLS - providing additional information |
| 1 | UK Cyber Security Centre | TLS - providing additional information |
| 1 | Security.Stackexchange Q&A | TLS - providing additional information |
| 1 | browserleaks.com/tls | TLS - Browser test |
| 1 | clienttest.ssllabs.com | TLS - Browser test |
| 1 | scanigma.com/knowledge-base | TLS - providing additional information |
| 1 | cloudflare.com/ssl/reference/ | TLS - providing additional information |
| 1 | github.com/ssllabs/research/ | TLS - providing additional information |
| 1 | Wayback Machine | Providing additional information about Edge Browser |
The module primarily uses Group policies, the Microsoft recommended way of configuring Windows. It also uses PowerShell cmdlets where Group Policies aren't available, and finally uses a few registry keys to configure security measures that can neither be configured using Group Policies nor PowerShell cmdlets. This is why the module doesn't break anything or cause unwanted behavior.
This Readme page lists all of the security measures applied by the module.
When a hardening measure is no longer necessary because it's applied by default by Microsoft on new builds of Windows, it will also be removed from the module in order to prevent any problems and because it won't be necessary anymore.
The module can be run infinite number of times, it's made in a way that it won't make any duplicate changes.
Applying these hardening measures makes your PC compliant with Microsoft Security Baselines and Secured-core PC specifications (provided that you use modern hardware that supports the latest Windows security features) - See what makes a Secured-core PC - Check Device Guard article for more info
Secured-core – recommended for the most sensitive systems and industries like financial,
