CIS Windows Hardening

View in Gitea

Synopsis: PowerShell module for auditing and hardening Windows systems (Machine and User level) against CIS benchmarks.

HardeningKitty reads the current system configuration (registry, policies, security settings) and compares it against the values recommended in a finding list — a CSV file containing the checked settings and their expected values.

This repository contains custom finding lists (./lists) built on the CIS benchmarks (Windows 10, Windows 11, Windows Server) in versions 2019v4, 2022v5, 2025v2, and W11v5, always for both the Machine and User level and in various variants (e.g. (L1), (L1)(noDC)).

The module supports five modes: Audit (compares the current settings against the finding list and generates a report/log), Config (reads the current configuration), Backup (saves the current configuration in finding-list format for later restore), HailMary (applies the recommended settings from the finding list), and GPO, an experimental mode that generates a Group Policy Object from the finding list (registry settings only, for now).

Based on the HardeningKitty project by Michael Schneider.

Usage examples:

Invoke-HardeningKitty -Mode Audit -FileFindingList .\lists\TS_CIS_2025v2_Machine.csv -Log -Report

Runs an audit against the given finding list and saves both a CSV report and a log file.

Invoke-HardeningKitty -FileFindingList .\lists\TS_CIS_2025v2_Machine.csv -Filter { $_.Severity -eq "Medium" }

Audit restricted to settings with Severity Medium.

Invoke-HardeningKitty -Mode Config -Backup -BackupFile .\myBackup.csv -FileFindingList .\lists\TS_CIS_2025v2_Machine.csv

Backs up the current configuration in finding-list format — a supplement to a real system backup (image/snapshot), not a replacement for one.

Invoke-HardeningKitty -Mode HailMary -Log -Report -FileFindingList .\lists\TS_CIS_2025v2_Machine.csv

Applies the recommended settings from the finding list to the system. An irreversible configuration change — run only after an audit and a backup.

Invoke-HardeningKitty -Mode GPO -FileFindingList .\lists\TS_CIS_2025v2_Machine.csv -GPOName HardeningKitty-Machine-01

Generates a GPO object from the finding list (requires the Group Policy Management module; registry settings only, for now).