[Open Source] Lightweight PowerShell Hardening Script for Windows 11
Source Reddit BlueTeam
Discussion
This is an open-source PowerShell script designed to harden Windows 11 systems by leveraging native OS security features. It restricts PowerShell script execution, disables Windows Script Host, closes remote management ports, disables SMBv1, enables Microsoft Defender Attack Surface Reduction rules, and disables hidden administrative shares. The script aims to reduce the attack surface against ransomware, phishing, lateral movement, and network worms without relying on third-party software.
r/blueteamsec (opens in a new tab)u/Hasan0101-lab0 points0 comments
Hi everyone,
I built a lightweight, open-source PowerShell script designed to harden **Windows 11** endpoints using native OS security capabilities—without relying on heavy third-party software/bloat.
### 🛡️ What it does:
* **PowerShell Execution Restriction:** Sets execution policy to `RemoteSigned` to prevent unauthorized local script execution.
* **WinRM & WSH Mitigation:** Disables Windows Script Host to block `.vbs` / `.js` malware vectors and closes remote management ports.
* **Network Hardening:** Disables SMBv1 to protect against network-based lateral movement and exploits (e.g., WannaCry).
* **Defender ASR & Exploit Guard:** Enables Controlled Folder Access (ransomware protection) and blocks malicious downloads via PowerShell.
* **Admin Share Lockdown:** Disables hidden admin shares (`C$`, `ADMIN$`) to restrict unauthorized lateral movement.
---
### 🚀 How to use:
Open PowerShell as Administrator.
Run: `.\Windows11_Hardening.ps1`
Reboot to apply all policies.
---
🔗 **GitHub Repository:** https://github.com/Hasan0101-lab/Windows_11_Hardened_Edition
I’d love to get feedback from the community on code structure, additional hardening rules, or potential compatibility edge cases. Feel free to review the code or leave a ⭐ if you find it useful!