Windows 11 DefCon Hardening

An auditable, reversible PowerShell framework for hardening a Windows 11 Home laptop used for development and VMware Workstation at DefCon 34.

The Conference profile contains 131 source-mapped controls across credentials, Windows Hello, local password and lockout policy, VBS and Memory Integrity, endpoint protection, firewalls, network protocols, remote access, removable media, exploit protection, audit logging, privacy, updates, encryption checks, and physical-security checks. It keeps outbound access available for IDEs, Git, package managers, Codex, Claude Code, and other AI clients. It does not disable Windows Hello fingerprint sign-in, WSL, Virtual Machine Platform, VMware services, Windows Security services, or third-party endpoint protection.

No script can make a connected computer impossible to compromise. This project reduces attack surface, verifies important runtime state, fails closed when endpoint protection is unhealthy, and provides rollback and operational guidance for risks that cannot be safely automated.

Requirements

• Windows 11, Home or Pro, build 22000 or later.
• Windows PowerShell 5.1 (built in) or PowerShell 7 or later.
• An administrator-capable account. Get-Windows11HardeningAssessment (the read-only audit) does not require elevation, but a handful of hardware-backed checks — BitLocker, Secure Boot, TPM — only return a real result when PowerShell runs elevated; run PowerShell as Administrator to see a complete audit instead of Error entries for those checks. Invoke-Windows11Hardening and Restore-Windows11Hardening always require elevation.

Commands

Command	Purpose
Get-Windows11SystemInfo	Reports the detected Windows edition, build, and computer name. Every audit, apply, and restore report includes this, so it is always visible what system a run actually applied to.
Get-Windows11HardeningAssessment	Read-only audit of the selected profile. Never changes the system.
Invoke-Windows11Hardening	Applies the selected profile (or audits it with -AuditOnly). Creates a backup first and rolls back automatically if endpoint protection becomes unhealthy.
Restore-Windows11Hardening	Restores system state from a framework-generated backup.
Get-EndpointProtectionStatus	Reports registered antivirus/firewall products and aggregate Windows Security health.
Test-VMwareWorkstationSecurity	Reports VMware Workstation, VBS, and Memory Integrity posture, plus optional .vmx configuration checks.

Each command has comment-based help; run Get-Help <command> -Full for parameters and examples after importing the module.

Start here

Use a fully patched disposable test VM before applying the profile to the laptop. Clone or download this repository, open an elevated PowerShell session in the repository folder, and run a read-only audit. If script execution is restricted, allow it for this session only:

Set-ExecutionPolicy -Scope Process Bypass -Force

Import-Module .\Windows11Hardening\Windows11Hardening.psd1 -Force
Get-Windows11SystemInfo | Format-List

Get-Windows11HardeningAssessment -Profile Conference |
    Sort-Object Severity, Category, Id |
    Format-Table Id, Severity, Status, Title -AutoSize

Get-EndpointProtectionStatus | Format-List
Test-VMwareWorkstationSecurity -VmxPath 'C:\VMs\Lab\Lab.vmx' | Format-List

Get-Windows11SystemInfo confirms exactly what this ran against — edition, build, and computer name — before you read anything else. It is also included in every audit, apply, and restore report, so a saved JSON report is self-documenting about the system it describes without needing to cross-reference anything.

Replace C:\VMs\Lab\Lab.vmx with the path to your own .vmx file, or omit -VmxPath to skip the VM configuration checks.

The operator wrapper writes a JSON evidence report and defaults to audit mode:

.\scripts\Invoke-ConferenceHardening.ps1 -Mode Audit -VmxPath 'C:\VMs\Lab\Lab.vmx'

After reviewing the report and the DefCon runbook, apply from an elevated PowerShell session:

.\scripts\Invoke-ConferenceHardening.ps1 -Mode Apply -AcknowledgeSystemChanges

A protected backup is created before changes. Restore it from an elevated session if needed:

Restore-Windows11Hardening -BackupPath 'C:\ProgramData\Windows11Hardening\Backups\hardening-....json' -Confirm:$false

Controls marked as highly disruptive are skipped unless -AllowDisruptive is explicitly supplied. The main example is disabling Print Spooler when printing is not needed.

Endpoint protection behavior

The framework uses the documented Windows Security Center health API and SecurityCenter2 registrations to discover Microsoft Defender, Bitdefender, and other registered products. It validates aggregate antivirus, firewall, and Security Center health and reports executable signature status.

If a healthy third-party antivirus is registered, Defender-specific settings are skipped. The framework does not use undocumented vendor registry keys or reverse-engineer Windows productState bits. Vendor settings are returned as manual, vendor-supported verification guidance. Windows Security Center queries retry a small, bounded number of times when the API itself is temporarily unavailable after restart; an authoritative unhealthy result still fails immediately. If endpoint protection becomes unhealthy after any host change, the framework automatically restores the captured settings and stops.

See Endpoint Protection for the Bitdefender checklist and design boundaries.

VMware posture

VMware Workstation remains supported. The host keeps VBS and Memory Integrity enabled even though VMware may use Windows Hypervisor Platform and run more slowly. Optional .vmx inspection flags bridged networking, shared folders, clipboard copy/paste, and drag-and-drop integration. NAT plus disabled host integration is the Conference recommendation.

Windows 11 Home does not provide the full Hyper-V role, so this framework does not require it or attempt to install it. See Threat Model and Architecture.

Windows Hello posture

The Conference profile preserves the last signed-in tile so Windows Hello fingerprint, PIN, and security-key providers remain available. It shows only the non-secret display name and prevents the sign-in screen from revealing the local username, domain name, or Microsoft account email address. The stricter hide-the-last-user policy remains available only in the Strict profile because Microsoft documents that it prevents the Windows passwordless experience.

Fingerprint readiness and Enhanced Sign-in Security are assessment-only. The framework never enrolls, reads, exports, or removes biometric templates. See Windows Hello and fingerprint sign-in.

Testing

# All safe suites; the destructive system test is discovered and skipped.
.\build.ps1 -Suite All -CodeCoverage

# Individual suites.
.\build.ps1 -Suite Unit
.\build.ps1 -Suite Functional
.\build.ps1 -Suite Integration

The current suite enforces 99.5% command coverage and includes unit, functional, integration, Windows PowerShell 5.1 compatibility, static analysis, an opt-in apply-and-restore system test, and a separately guarded post-reboot system test. The system tests require an elevated disposable Windows 11 VM and explicit environment acknowledgements. See Testing.

Documentation

• DefCon 34 preparation, use, and recovery runbook
• Architecture and threat model
• Endpoint protection and Bitdefender
• Windows Hello and fingerprint sign-in
• Baseline scope and mappings
• Primary research sources and pinned artifacts
• Testing strategy
• Releasing
• Generated control catalog

Contributing and security

See Contributing before opening a pull request — this project is test-driven, and every change must pass the full quality gate described there. Report a suspected vulnerability in the framework itself through the Security Policy rather than a public issue. Participation is governed by the Code of Conduct. This project is built and maintained with AI coding agents; agent-specific instructions live in AGENTS.md.

Scope and compliance

This is a tailored standalone-laptop profile, not a claim of formal DISA STIG, CIS, NIST, or Microsoft compliance. Windows 11 Home lacks some enterprise management and virtualization features, and several physical, firmware, encryption-recovery, account, vendor-product, and guest-VM decisions require the owner. Every automated control carries its source and rationale so decisions can be reviewed and changed without hiding policy inside procedural code.

Licensed under Apache-2.0.