Verification

[26zl]

Hi! First of all thank you for an incredible script/program! So grateful for this thank you! Keep up the good work! I will jump right into the question is it possible to verify if the things that got implemented through the script is actually working like if its kind of active? And is it possible to run the script again just to make sure things are implemented will that affect anything? And is it right that the kernel memory isolation protection through windows defender should be off? Tried to turn it on again but it didnt work got reset. I think you wrote something abt it but didnt quite understand (my bad). Thanks again!

[HotCakeX]

Hi,
Thank you for the kind words ^^

Can you verify the implemented security measures? Yes, you can, the Harden Windows Security module offers it along with other features:
https://github.com/HotCakeX/Harden-Windows-Security/wiki/Harden%E2%80%90Windows%E2%80%90Security%E2%80%90Module

You can run the script or module as many times as you want, they don't make duplicate changes.

Kernel-mode hardware-enforced stack protection or kernel memory isolation protection, is part of the Device Guard, I have a wiki article about it:
https://github.com/HotCakeX/Harden-Windows-Security/wiki/Device-Guard-and-Virtualization-Based-Security-in-Windows

If it doesn't turn on after running the script/module like this

Then I think either your hardware doesn't meet the requirements for it (requires Intel 11th gen/AMD Zen3 and beyond) or there might be a driver that is preventing it from being turned on. It could also be controlled by another software on your system, or a register key that you set previously is stopping it. Also please make sure hardware drivers are installed and up to date.

Here is the official article about it

https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-11-version-22h2-security-baseline/ba-p/3632520

Hope that helps!

[26zl]

Thank you so much! I will try this tomorrow! Thanks again! 😀😀

[HotCakeX]

You're welcome ^^

[26zl]

So i tried the script again.

But after the restart both memory integrity and firmware protection turns off (see picture) i wrote earlier kernel mode hardware enforced stack protection because i thought i had it but that setting is not avaible for me (10th intel cpu).

But isnt both memory integrity and firmware protection something that should be on? Or is it actually on but a UI-kind for error in windows defender program? (Tried to repair it through settings app same with sfc /scannow, didnt help).

Another question the tpm/bitlocker password lock before windows boot i had to turn that off incase i forget it (student pc).

Is this the right code to remove the WDAC policy added through the script? Remove-WdacPolicy -PolicyId a09cb0d6-2b33-4ba2-8287-29501dafa3c8
? It wouldnt let me install some programs i need for school.

The firewall ip blocking section of the script didnt work for me is there any other way to implementate them?

Again thank you for taking the time to explain and help, i really appreciate it, thank you!

[HotCakeX]

Firmware protection requires System Guard Secure Launch which is something only Secured-core PCs have

• https://www.microsoft.com/en-us/windows/business/windows-11-secured-core-computers
• https://learn.microsoft.com/en-us/windows/security/hardware-security/system-guard-secure-launch-and-smm-protection

Here is article for Memory integrity

• https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity

I think you need to enable virtualization features in your UEFI

The firewall ip blocking section of the script didnt work for me

Umm what do you mean? I need more info to be able to help

Is this the right code to remove the WDAC policy added through the script? Remove-WdacPolicy -PolicyId a09cb0d6-2b33-4ba2-8287-29501dafa3c8 ? It wouldnt let me install some programs i need for school.

It only prevents any executable to run from the Downloads folder, you can copy/move them to other locations to run them if you're sure they are trustworthy.

You can remove that WDAC policy using this command

Remove-WDACConfig -UnsignedOrSupplemental -PolicyNames 'Downloads-Defense-Measures'

This cmdlet part of the Harden Windows Security module also removes that policy: Unprotect-WindowsSecurity