Quick Start Guide

Quick Start Guide

Get up and running with the Windows Security Audit Project in under 5 minutes.

Prerequisites Check

Before starting, verify you have:

✅ Windows 10/11 or Windows Server 2016+

# Check Windows version
[System.Environment]::OSVersion.Version

✅ PowerShell 5.1 or later

# Check PowerShell version
$PSVersionTable.PSVersion

✅ Administrator privileges (required for complete results)

# Verify admin rights
([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
# Should return: True

Installation

Step 1: Download the Script

Option A: Using Git (Recommended)

# Clone the repository
git clone https://github.com/Sandler73/Windows-Security-Audit-Project.git
cd Windows-Security-Audit-Project

Option B: Manual Download

1. Visit https://github.com/Sandler73/Windows-Security-Audit-Project
2. Click Code → Download ZIP
3. Extract to a folder (e.g., C:\SecurityAudit)
4. Open PowerShell as Administrator
5. Navigate to the extracted folder

Step 2: Set Execution Policy

If this is your first time running PowerShell scripts:

# Check current execution policy
Get-ExecutionPolicy

# If it shows "Restricted", set it to allow scripts
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

# Confirm the change by typing: Y

What does this do? Allows locally-created scripts to run while still blocking unsigned downloaded scripts for security.

Step 3: Run Your First Audit

# Navigate to the script directory
cd C:\Path\To\Windows-Security-Audit-Project

# Run the audit with all default settings
.\Windows-Security-Audit.ps1

What happens next:

1. ⏱️ Script runs for ~60-90 seconds with parallel execution (~75-150 seconds sequential), totaling 4,065 checks across 16 modules
2. 📊 Progress displays in real-time with color-coded results
3. 📄 HTML report saved in .\reports\ (does not auto-open; open manually)
4. 📋 JSON companion file generated alongside HTML
5. 📝 Log file auto-created at .\logs\audit-yyyyMMdd-HHmmss.log
6. ✅ Summary statistics displayed in console

Understanding the Output

After the audit completes, you'll see a report file in the current directory:

📄 HTML Report (Default)

.\reports\audit-20260425-143022.html

• Saved in .\reports\ directory (does not auto-open; open manually)
• Interactive interface with dark mode toggle
• Filter and sort results by module, status, or category
• Export selected results to CSV, Excel, JSON, XML, or TXT
• Contains executive summary, all findings, and remediation guidance
• Best for human review and management reporting

HTML Report Features :

• 🌓 Dark Mode - Toggle for comfortable viewing
• 🔍 Live Filtering - Search within any column
• 📊 Sortable Columns - Click headers to sort
• ✅ Select & Export - Choose specific findings to export
• 📦 Multiple Export Formats - CSV, Excel, JSON, XML, TXT
• 📱 Responsive Design - Works on desktop and mobile

Output Format Options

You can generate reports in different formats:

# HTML (default) - Interactive browser report
.\Windows-Security-Audit.ps1 -OutputFormat HTML

# CSV - For Excel analysis
.\Windows-Security-Audit.ps1 -OutputFormat CSV

# JSON - For automation and SIEM integration
.\Windows-Security-Audit.ps1 -OutputFormat JSON

# XML - For SIEM ingestion and structured data
.\Windows-Security-Audit.ps1 -OutputFormat XML

# Console only - No file output
.\Windows-Security-Audit.ps1 -OutputFormat Console

📋 JSON Report

audit-20260425-143022.json

• Structured data for automation and integration
• Use with SIEM, ticketing systems, or custom analysis tools
• Machine-readable format
• Contains execution metadata and all results

📊 CSV Report

audit-20260425-143022.csv

• Open in Excel for filtering and analysis
• Great for tracking remediation over time
• Easy to create charts and dashboards
• Simple tabular format

📄 XML Report

audit-20260425-143022.xml

• SIEM-compatible format for security operations
• Structured for automated ingestion
• Includes metadata and all security events
• Standards-compliant XML structure

Reading the Results

Results are categorized into 5 status levels:

Status	Meaning	Action	Color
✅ Pass	Configuration meets security requirement	None needed	Green
❌ Fail	Security issue detected	Remediate immediately	Red
⚠️ Warning	Potential issue or deviation from best practice	Review and consider fixing	Yellow
ℹ️ Info	Informational finding for awareness	Note for future reference	Cyan
🔴 Error	Check could not be completed	Investigate why check failed	Magenta

Available Security Modules

The script includes 16 compliance framework modules totaling 4,065 security checks:

Module	Description	Checks
acsc	ACSC Essential Eight + ISM/PSPF	170
cis	CIS Controls v8 + IG2/IG3 + Cloud/Mobile/ICS-OT	260
cisa	CISA Best Practices + KEV catalog + ZTMM + CPGs	289
cmmc	CMMC 2.0 L1/L2/L3 + DFARS + NIST 800-172	145
core	Foundational Windows Security Baseline + Win11 modern features	243
enisa	ENISA + NIS2 Directive + Cyber Resilience Act + DORA	248
gdpr	GDPR Art. 5/15-21/28/32/35 + ePrivacy + Schrems II	183
hipaa	HIPAA Security Rule + 405(d) HICP + HITECH + 800-66 R2	237
iso27001	ISO 27001:2022 + 27002/27017/27018/27701	286
ms	Microsoft Security Baseline (Win11 24H2/Server 2025) + Edge + M365	367
ms-defenderatp	Microsoft Defender for Endpoint (ATP/EDR)	155
nist	NIST 800-53 R5 + CSF 2.0 + 800-171 R3 + 800-207 + FedRAMP	520
nsa	NSA Cybersecurity (CSI + AD hardening + Top 10 Mitigations)	225
pcidss	PCI DSS v4.0/v4.0.1 + PIN Security + 3DS + SSF	279
soc2	SOC 2 Trust Service Criteria + AICPA TSP Section 100	162
stig	DISA STIGs + SRG cross-mapping + Microsoft Defender STIG	225

Common First-Run Scenarios

Scenario 1: "I want to see what's wrong with my system"

# Run with all modules (default)
.\Windows-Security-Audit.ps1

Look for ❌ Fail items in the HTML report - these are security issues that need attention.

Scenario 2: "I only care about critical security issues"

# Run STIG module (includes CAT I critical findings)
.\Windows-Security-Audit.ps1 -Modules STIG

In the HTML report, filter for "CAT I" findings - these are the most critical.

Scenario 3: "I need to assess NIST 800-53 compliance"

# Run NIST module only
.\Windows-Security-Audit.ps1 -Modules NIST

Results will show NIST control family mappings (AC, AU, IA, SC, CM, IR, etc.).

Scenario 4: "I want to check multiple specific frameworks"

# Run multiple specific modules
.\Windows-Security-Audit.ps1 -Modules STIG,NIST,CIS

Generates a combined report with findings from all specified modules.

Scenario 5: "I need JSON output for automation"

# Generate JSON only
.\Windows-Security-Audit.ps1 -OutputFormat JSON

Perfect for automated scheduled tasks, CI/CD pipelines, or SIEM integration.

Scenario 6: "I want to export to a specific location"

# Specify output file path
.\Windows-Security-Audit.ps1 -OutputPath "C:\Reports\Security-Audit.html"

Report will be saved to the specified path instead of the default location.

Remediation Workflows

The script now includes powerful remediation capabilities:

Interactive Remediation

Prompt for each issue:

# Review and fix all remediable issues interactively
.\Windows-Security-Audit.ps1 -RemediateIssues

# Fix only failures
.\Windows-Security-Audit.ps1 -RemediateIssues_Fail

# Fix only warnings
.\Windows-Security-Audit.ps1 -RemediateIssues_Warning

# Fix multiple types
.\Windows-Security-Audit.ps1 -RemediateIssues_Fail -RemediateIssues_Warning

You'll be prompted for each issue:

[*] Issue: Guest account is ENABLED
    Module: STIG | Status: Fail | Category: STIG - V-220929 (CAT I)
    Remediation: Disable-LocalUser -Name Guest
    Apply remediation? (Y/N/S=Skip remaining): _

Automatic Remediation

Auto-fix with safety confirmations:

# Automatically remediate all failures (requires double confirmation)
.\Windows-Security-Audit.ps1 -RemediateIssues_Fail -AutoRemediate

Safety features:

• ✅ Double confirmation required (type "YES" then "CONFIRM")
• ✅ 10-second timeout for final confirmation
• ✅ All actions logged to JSON file
• ✅ Success/failure statistics displayed
• ✅ Optional system restart prompt

Targeted Remediation

Fix only specific issues:

# 1. Run audit and review HTML report
.\Windows-Security-Audit.ps1

# 2. In HTML report, select specific issues and click "Export Selected"
#    (saves Selected-Security-Audit-Report.json)

# 3. Run auto-remediation on selected issues only
.\Windows-Security-Audit.ps1 -AutoRemediate -RemediationFile "Selected-Security-Audit-Report.json"

This workflow allows you to:

1. Review all findings
2. Select only the issues you want to fix
3. Auto-remediate just those specific issues
4. Review remediation log for results

Remediation Best Practices

⚠️ Important Safety Tips:

• Always run audit first and review findings
• Test remediation on non-production systems first
• Create system restore point before bulk remediation
• Review remediation commands in the HTML report
• Some remediations may require system restart
• Remediation log saved to: Remediation-Log-[timestamp].json

Step-by-Step Usage

1. Run Initial Audit

.\Windows-Security-Audit.ps1

2. Review Critical Findings

Open the HTML report and look for:

• ❌ Failed checks (red) - Security issues
• ⚠️ Warnings (yellow) - Best practice deviations

Use the filter boxes to search for specific issues or sort by clicking column headers.

3. Understand Remediation

Each finding includes:

• Details - Why it matters and security impact
• Remediation - Specific PowerShell commands or GPO settings to fix

4. Fix Issues

Option A: Manual Remediation

# Example from report
Disable-LocalUser -Name Guest

Option B: Interactive Remediation

# Prompt for each issue
.\Windows-Security-Audit.ps1 -RemediateIssues_Fail

Option C: Targeted Auto-Remediation

# Export selected issues from HTML report, then:
.\Windows-Security-Audit.ps1 -AutoRemediate -RemediationFile "Selected-Security-Audit-Report.json"

5. Re-Run Audit

After fixing issues, run the audit again to verify:

.\Windows-Security-Audit.ps1

Compare the before/after reports to track progress!

6. Schedule Regular Audits

Option A: Task Scheduler

# Create a scheduled task to run weekly
$action = New-ScheduledTaskAction -Execute "PowerShell.exe" `
    -Argument "-ExecutionPolicy Bypass -File C:\SecurityAudit\Windows-Security-Audit.ps1"
$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Monday -At 2am
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
Register-ScheduledTask -TaskName "Security Audit" -Action $action -Trigger $trigger -Principal $principal

Option B: Manual Monthly Review

• Run audit at the start of each month
• Compare results to track security posture over time
• Document remediation progress

Troubleshooting Quick Fixes

"Script cannot be loaded because running scripts is disabled"

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

"Access is denied" errors

• Right-click PowerShell → Run as Administrator
• Some checks require admin privileges
• Without admin, many checks will show "Error" status

"Module not found" error

# Ensure you're in the correct directory
cd C:\Path\To\Windows-Security-Audit-Project

# Verify Modules folder exists
Get-ChildItem .\modules\

Script runs but takes a long time

• First run may be slower (loading modules, checking 700+ settings)
• Subsequent runs should be faster
• Average runtime: 2-5 minutes for all modules
• Single module: 30-60 seconds

HTML report doesn't open automatically

# Manually open the report
Start-Process "Windows-Security-Audit-*.html"

Results show many "Error" status findings

• Verify running as Administrator
• Check that required PowerShell modules are installed
• Review error messages in Details column for specific issues

Want to see detailed progress?

# Run with verbose output
.\Windows-Security-Audit.ps1 -Verbose

Remediation failed for some issues

• Check Remediation-Log-[timestamp].json for details
• Some remediations require reboot to take effect
• Domain-joined systems may have GPO overrides
• Verify you have necessary permissions

Quick Reference Commands

# === Basic Usage ===
# Run all modules (default)
.\Windows-Security-Audit.ps1

# Run specific modules
.\Windows-Security-Audit.ps1 -Modules Core,STIG,NIST
.\Windows-Security-Audit.ps1 -Modules STIG

# Run all modules explicitly
.\Windows-Security-Audit.ps1 -Modules All

# === Output Formats ===
# Generate HTML (default)
.\Windows-Security-Audit.ps1 -OutputFormat HTML

# Generate CSV for Excel
.\Windows-Security-Audit.ps1 -OutputFormat CSV

# Generate JSON for automation
.\Windows-Security-Audit.ps1 -OutputFormat JSON

# Generate XML for SIEM
.\Windows-Security-Audit.ps1 -OutputFormat XML

# Console output only (no file)
.\Windows-Security-Audit.ps1 -OutputFormat Console

# Custom output path
.\Windows-Security-Audit.ps1 -OutputPath "C:\Reports\Audit.html"

# === Remediation ===
# Interactive - prompt for each issue
.\Windows-Security-Audit.ps1 -RemediateIssues
.\Windows-Security-Audit.ps1 -RemediateIssues_Fail
.\Windows-Security-Audit.ps1 -RemediateIssues_Warning

# Automatic - fix all failures (requires confirmation)
.\Windows-Security-Audit.ps1 -RemediateIssues_Fail -AutoRemediate

# Targeted - fix specific issues from JSON file
.\Windows-Security-Audit.ps1 -AutoRemediate -RemediationFile "Selected-Report.json"

# === Advanced Options ===
# Verbose output
.\Windows-Security-Audit.ps1 -Verbose

# Debug mode
.\Windows-Security-Audit.ps1 -Debug

# Get help
Get-Help .\Windows-Security-Audit.ps1 -Full
Get-Help .\Windows-Security-Audit.ps1 -Examples

Understanding Module Output

Each module displays statistics upon completion:

[STIG] Module completed:
  Total Checks: 87
  Passed: 52
  Failed: 23
  Warnings: 8
  Info: 3
  Errors: 1

  STIG Categories:
  CAT I (High):   5
  CAT II (Medium): 18
  CAT III (Low):  0

What this means:

• Total Checks - Number of security controls evaluated
• Passed - Configurations meeting requirements
• Failed - Security issues requiring remediation
• Warnings - Non-critical deviations from best practices
• Info - Informational findings
• Errors - Checks that couldn't complete (permission issues, etc.)

Next Steps

📖 Learn More

• Usage Guide - Detailed usage instructions and advanced scenarios
• Framework Reference - Understand what each module checks
• Module Documentation - Deep dive into each security module

🛠️ Advanced Topics

• Development Guide - Create custom modules
• Troubleshooting - Solve common issues
• API Integration - Integrate with SIEM and ticketing systems

💡 Best Practices

1. Run regular audits - Monthly at minimum, weekly recommended
2. Track progress - Compare reports over time
3. Prioritize failures - Fix critical (CAT I) issues first
4. Document exceptions - Record why certain findings are accepted
5. Test before production - Validate remediations in test environment
6. Review remediation logs - Verify all fixes were successful

🔒 Security Recommendations

• Always run as Administrator for complete results
• Review remediation commands before applying
• Create system restore point before bulk fixes
• Test in non-production first
• Keep regular backups
• Document your baseline security configuration

---

Version Information

Current Version: 6.7.0

What's New in v6.1.x:

• ✅ Risk Priority Scoring -- 1-100 score combining severity, exploitability, exposure, asset criticality (-ShowRiskPriority)
• ✅ Cross-Framework Correlations -- group findings that test the same underlying control across modules (-ShowCorrelations)
• ✅ Compensating Control Detection -- flag failed checks where a passing related control mitigates risk (-ShowCompensatingControls)
• ✅ Baseline Drift Comparison -- diff against previous audit JSON (-Baseline)
• ✅ Rollback Script Generation -- auto-generate inverse-script from applied remediations (-RollbackPath)
• ✅ Group Policy Export -- generate .pol file from registry-modifying remediations (-ExportGPO)
• ✅ Remediation Bundles -- DisableLegacyProtocols, HardenAuthentication, EnableAuditLogging, LockDownRDP, EssentialEightLevel1
• ✅ Help -- in-script help via -Help, -H, -help, -h, -ShowHelp or -? (prefixed forms only)
• ✅ Auto-Logging -- log file auto-generated when -LogFile omitted; color-coded console output by default
• ✅ +795 New Checks -- every module expanded; total now 4,065 across 16 modules