How to Harden Windows 11 with Native PowerShell Scripts (No 3rd Party Apps)

Third-party antivirus solutions and "bloatware" security tools often consume high system resources and introduce unnecessary background processes. However, Windows 11 already includes powerful enterprise-grade security capabilities—they are just disabled by default for home and standard users.

In this article, I’ll walk through how we can harden Windows 11 using native PowerShell commands to protect against ransomware, phishing scripts, and lateral network attacks.

---

🔑 Key Hardening Policies Applied

1. PowerShell Execution Restriction (RemoteSigned)
   Restricts execution policies to prevent unsigned scripts from running automatically in the background.

2. WinRM & Windows Script Host (WSH) Mitigation
   Blocks common email malware vectors (like .vbs and .js file executions) and closes remote administrative ports.

3. SMBv1 Deprecation
   Completely removes the vulnerable SMBv1 protocol to prevent lateral movement and network exploits like WannaCry / EternalBlue.

4. Defender Attack Surface Reduction (ASR) & Exploit Guard
   Enables Controlled Folder Access to block ransomware encryption attempts and restricts executable downloads via PowerShell.

5. Administrative Share Lockdown
   Disables hidden network administrative shares (C$, ADMIN$) to secure network boundaries.

---

🚀 Quick Start & Usage

Open PowerShell as an Administrator and execute the hardening script:

powershell
.\Windows11_Hardening.ps1
Note: A system reboot is required for all security policies to take full effect.
🔗 Source Code & GitHub Repository
The complete script is open-source and available on GitHub. Feel free to inspect the code, suggest improvements, or contribute:

👉 https://github.com/Hasan0101-lab/Windows_11_Hardened_Edition
If you find this project helpful for your personal setup or lab environment, consider leaving a ⭐ on the repository!