Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    Windows Hardening Audit

    1

    Audit Windows security posture and identify credential theft, network, and logging vulnerabilities via PowerShell.

    $4.99

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    Security scanned
    Windows Hardening Audit

    Windows Hardening Audit

    Example session with this skill installed

    I need to run a security audit on a Windows 11 workstation and get a summary of the most critical credential theft risks and network vulnerabilities found.

    • Read your context and instructions
    • Compiled the windows hardening audit

    I have performed a security hardening audit focused on credential protection and network exposure. The audit identified several high-risk configurations including legacy protocols and missing memory protections.

    Windows Hardening Audit Findings

    CategoryCheckStatusRisk LevelRecommendation
    CredentialsLSA Protection (RunAsPPL)FAILCRITICALEnable RunAsPPL to prevent LSASS memory dumping.
    CredentialsWDigest AuthenticationFAILHIGHDisable WDigest to prevent cleartext password storage in memory.
    NetworkLLMNR / NBT-NSFAILHIGHDisable legacy name resolution to prevent spoofing attacks.
    NetworkSMB SigningWARNMEDIUMRequire SMB signing to prevent man-in-the-middle attacks.
    NetworkSMBv1 Client/ServerPASSLOWSMBv1 is correctly disabled on this system.
    ProtectionTamper ProtectionFAILHIGHEnable Tamper Protection to prevent local disabling of Defender.
    LoggingPowerShell ScriptBlockFAILMEDIUMEnable ScriptBlock logging for visibility into malicious scripts.
    ConfigPrint SpoolerWARNMEDIUMDisable Spooler service if printing is not required on this host.

    Next steps

    1. Enable LSA Protection and disable WDigest via Group Policy or registry to secure system credentials.
    2. Disable LLMNR and NetBIOS over TCP/IP across the network adapter settings.
    3. Configure Advanced Audit Policy subcategories to ensure successful logon/logoff events are captured.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Manual security audits for Windows fleets are time-consuming and prone to human error. This skill provides a read-only PowerShell framework to instantly evaluate the security posture of Windows 10, 11, and Windows Server 2016 through 2025. It identifies credential theft vectors, lateral movement risks, and visibility gaps without altering system state.

    What it does

    • Evaluates credential security by checking WDigest, LSA protection, Credential Guard, and LAPS status.
    • Audits network protocols for SMBv1 usage, SMB signing requirements, and legacy discovery protocols like LLMNR and NetBIOS.
    • Inspects endpoint defense including Microsoft Defender real-time protection, tamper protection, and firewall profile status.
    • Validates logging visibility by checking PowerShell ScriptBlock logging, advanced audit policies, and Sysmon presence.
    • Scans for common misconfigurations such as unquoted service paths, AlwaysInstallElevated flags, and Print Spooler status.

    How it works

    1. Initiate audit by running the provided PowerShell script in an elevated session to gather system metadata.
    2. Export results to HTML, CSV, or JSON formats for documentation or ingestion into other security tools.
    3. Analyze findings using the built-in logic that prioritizes high-risk failures like missing LSA protection or local admin sprawl.
    4. Remediate gaps following the output guidance, specifically identifying settings that should be controlled via Group Policy.

    Frameworks & tools

    The skill utilizes native Windows PowerShell (5.1 or 7+) and standard Windows management instrumentation. It is compatible with Intune, Microsoft Endpoint Configuration Manager, and Group Policy for fleet-wide execution.

    Why this beats prompting it yourself

    Writing individual scripts for over 30 distinct hardening checks is tedious and difficult to maintain across different OS versions. This skill centralizes these checks into a single, high-performance tool that outputs structured data ready for professional reporting.

    Use cases

    • Perform a baseline security audit on a newly provisioned Windows Server.
    • Identify credential theft vulnerabilities across a workstation fleet.
    • Prepare for a compliance audit by generating HTML reports of current settings.
    • Verify that Group Policy Objects are correctly applying hardening configurations.

    Known limitations

    Requires an elevated PowerShell prompt for full visibility. Non-elevated execution will cause several system-level checks to be skipped.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 1 day ago

    • Passed all security checks, Safe to install

    Listed1 day ago
    Updatedtoday

    What's inside

    Frequently Asked Questions