The Windows 11 Hardened Edition is a minimalist PowerShell security hardening script that enforces execution policy restrictions (RemoteSigned), disables Windows Script Host to block common malware vectors, disables WinRM remote management ports, removes legacy SMBv1 protocol to prevent network worm exploits, enables Microsoft Defender Attack Surface Reduction and Controlled Folder Access for ransomware protection, and disables hidden admin shares (C$, ADMIN$) to prevent lateral movement. It uses native Windows security capabilities to reduce the attack surface and improve endpoint security on Windows 11 without adding third-party software overhead.

By applying these security hardening measures, the script reduces the risk of unauthorized script execution, remote code execution via WinRM, malware execution through Windows Script Host, network-based worm propagation via SMBv1, ransomware encryption via Defender protections, and lateral movement through administrative shares. This lowers the attack surface and mitigates multiple common attack vectors on Windows 11 endpoints.

This script provides a proactive security hardening approach and is intended to be run by administrators on Windows 11 systems. Since it is an open-source tool, users should review the code before deployment. There is no indication of a vulnerability or exploit requiring patching. No vendor advisory or official patch is applicable. Users should follow the usage instructions to run the script with administrative privileges and reboot to apply the policies.