WIN-013 · Script
Windows Security Baseline Audit
Checks a set of common Windows security settings on the device and exports the findings for review.
What it does
Read-only audit of settings that are often reviewed in security baselines and cyber insurance questionnaires. Each check is reported as Pass, Fail or Unknown, with the expected value, the actual value and a short recommendation. Nothing is changed.
Checks (use the ID with -SkipChecks to leave one out): FW01 Windows Firewall is on for the Domain, Private and Public profiles AV01 Microsoft Defender real-time protection is on (when Defender is the active antivirus) UAC1 User Account Control is on UAC2 Administrators are prompted for consent or credentials SMB1 The SMB1 server protocol is turned off GST1 The built-in Guest account is disabled RDP1 Remote Desktop, when enabled, requires Network Level Authentication BL01 The operating system drive is protected by BitLocker SB01 Secure Boot is on (UEFI devices) AR01 AutoRun is turned off for all drive types LM01 LAN Manager hashes are not stored LM02 NTLM authentication level sends NTLMv2 only (level 5) WD01 WDigest does not keep plain-text credentials in memory LSA1 LSA protection (RunAsPPL) is on
- PS2: Windows PowerShell 2.0 engine is removed or turned off
PW01 Minimum password length is at least -MinPasswordLength PW02 Account lockout threshold is between 1 and -MaxLockoutThreshold PW03 Password complexity is required ADM1 Local Administrators group has no more than -MaxLocalAdmins members
Local password and lockout policy is read with secedit, which reflects the effective policy on the device. Results are saved to -ReportDir. Runs silently as SYSTEM.
Requirements
Windows PowerShell 5.1+, run as SYSTEM or local admin
How to run it
- Run as: SYSTEM or a local administrator
- Run from: any RMM or MDM, Intune, a Group Policy startup script, a scheduled task, or an elevated PowerShell window
- Script type: PowerShell, 64-bit
- User interaction: none; the script never prompts
- Timeout: 10 minutes (30 for Windows Update installs)
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| MinPasswordLength | Shortest allowed password length for PW01. Default 12. | 12 | |
| MaxLockoutThreshold | Highest allowed number of bad sign-in attempts before lockout for PW02. Default 10. | 10 | |
| MaxLocalAdmins | Most members allowed in the local Administrators group for ADM1. Default 3. | 3 | |
| SkipChecks | Check IDs to leave out, for example "BL01","PS2". | (none) | |
| Format | Csv (default), Json or Both. | Csv, Json, Both | Csv |
| ReportDir | Folder for the findings file. Default C:\ProgramData\Runbookia\Reports | C:\ProgramData\Runbookia\Reports |
Exit codes
- 0 = All checks passed (Unknown results do not count as failures)
- 1 = One or more checks failed
- 2 = Script error
Testing steps
- Run it on one test device and check the output and log.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Report only. Nothing is changed, so nothing needs to be rolled back.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |