Harden-Windows-Security: Apply Supported Windows Security Controls

Overview

Harden-Windows-Security provides two Windows apps and supporting guidance for configuring built-in security features: Harden System Security and AppControl Manager. It aims to help users apply and understand Windows hardening measures without adding third-party security components.

The project is intended for both individual Windows users and organizations. Its tools cover system hardening and compliance visibility, as well as creating and managing Application Control policies. The repository describes its methods as based on supported Microsoft features and includes documentation for choosing and deploying them.

Key Features

• Harden System Security app for configuring Windows security settings and reviewing device security status.
• Intune security policies and compliance checks for enterprise administrators.
• AppControl Manager for configuring Windows Application Control policies.
• Guidance on security topics including WDAC, BitLocker, Defender, firewall configuration, and TPM 2.0.
• Build provenance attestations and SBOMs, which the project says support SLSA Level 3 build-process security.
• Apps distributed through the Microsoft Store, with source and documentation available in the repository and wiki.

Use Cases

• A personal Windows user wants to apply built-in security protections and inspect security settings without assembling separate hardening scripts.
• An IT administrator wants to deploy security policies to managed workstations and check policy compliance.
• A security practitioner needs to create or manage Application Control policies for a personal or enterprise Windows device.
• A Windows team wants reference material on supported hardening controls and their deployment considerations.

Getting Started

Install the apps from the Microsoft Store for Harden System Security and Microsoft Store for AppControl Manager. Consult the repository README and wiki for setup and usage guidance.

Considerations

• These tools change Windows security configuration. Review the documentation and understand the impact of policies before applying them, especially on managed or production devices.
• Application Control policies can restrict which software runs, so deployment should be planned and tested for the target environment.
• The project targets Windows and relies on Windows security capabilities; it is not a cross-platform hardening tool.
• The README recommends using a standard user account for everyday work and emphasizes keeping Windows up to date. Security settings are not a substitute for updates or environment-specific security planning.