The latest articles on DEV Community by Ömer Koç (@mer_ko_30187155d69a4823). https://dev.to/mer_ko_30187155d69a4823 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4060746%2Fe4471709-c164-45ed-9d37-9b269e6521a5.png https://dev.to/mer_ko_30187155d69a4823 en Ömer Koç Mon, 03 Aug 2026 13:33:40 +0000 https://dev.to/mer_ko_30187155d69a4823/how-to-harden-windows-11-with-native-powershell-scripts-no-3rd-party-apps-1ehj https://dev.to/mer_ko_30187155d69a4823/how-to-harden-windows-11-with-native-powershell-scripts-no-3rd-party-apps-1ehj <p>Third-party antivirus solutions and "bloatware" security tools often consume high system resources and introduce unnecessary background processes. However, Windows 11 already includes powerful enterprise-grade security capabilities—they are just disabled by default for home and standard users.</p> <p>In this article, I’ll walk through how we can harden Windows 11 using native PowerShell commands to protect against ransomware, phishing scripts, and lateral network attacks.</p> <h3> 🔑 Key Hardening Policies Applied </h3> <ol> <li><p><strong>PowerShell Execution Restriction (<code>RemoteSigned</code>)</strong><br> Restricts execution policies to prevent unsigned scripts from running automatically in the background.</p></li> <li><p><strong>WinRM &amp; Windows Script Host (WSH) Mitigation</strong><br> Blocks common email malware vectors (like <code>.vbs</code> and <code>.js</code> file executions) and closes remote administrative ports.</p></li> <li><p><strong>SMBv1 Deprecation</strong><br> Completely removes the vulnerable SMBv1 protocol to prevent lateral movement and network exploits like WannaCry / EternalBlue.</p></li> <li><p><strong>Defender Attack Surface Reduction (ASR) &amp; Exploit Guard</strong><br> Enables Controlled Folder Access to block ransomware encryption attempts and restricts executable downloads via PowerShell.</p></li> <li><p><strong>Administrative Share Lockdown</strong><br> Disables hidden network administrative shares (<code>C$</code>, <code>ADMIN$</code>) to secure network boundaries.</p></li> </ol> <h3> 🚀 Quick Start &amp; Usage </h3> <p>Open PowerShell as an Administrator and execute the hardening script:</p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code> powershell .\Windows11_Hardening.ps1 Note: A system reboot is required for all security policies to take full effect. 🔗 Source Code &amp; GitHub Repository The complete script is open-source and available on GitHub. Feel free to inspect the code, suggest improvements, or contribute: 👉 https://github.com/Hasan0101-lab/Windows_11_Hardened_Edition If you find this project helpful for your personal setup or lab environment, consider leaving a ⭐ on the repository! </code></pre> </div> powershell cybersecurity windows11 opensource