I had a problem. I wanted a Windows security audit script I could drop on any machine, run as admin, and walk away with a readable report. Just a single .py file. No pip install, no virtualenv, no "wait, do you have Python 3.10 or what."
The catch is that "real" Windows auditing tools usually pull in pywin32, wmi, or some chunky vendor SDK. None of that flies on a locked down workstation. So I tried writing the whole thing on the standard library.
That is what WinRecon turned into. 20 checks, single Python module, no dependencies past stdlib.
Here's how the dependency-free constraint shaped the architecture.
For registry reads I went straight to winreg. Anything that needs Windows tooling goes through subprocess with the actual built-in binaries (netstat, net, sc query, wmic, and PowerShell for Defender and audit policy queries). It is not elegant. You end up parsing CLI text output a lot. But it works on a fresh Windows 11 box with nothing installed.
Example. Getting Defender status without pywin32. PowerShell already returns it as JSON, you just have to ask:
def get_defender_status():
cmd = [
"powershell", "-NoProfile", "-Command",
"Get-MpComputerStatus | ConvertTo-Json"
]
result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
if result.returncode != 0:
return None
return json.loads(result.stdout)
Subprocess plus ConvertTo-Json got me out of a hole on probably half the checks. WMI bindings would have been faster but the trade is dependencies, and I wanted the script to just run.
The 20 checks cover the obvious stuff (firewall state, RDP config, password policy, open ports, BitLocker, Credential Guard, Secure Boot, audit policy, antivirus status) plus the stuff a SOC analyst actually wants to see: suspicious scheduled tasks, sketchy startup entries, weird PowerShell flags. The scheduled task check looks for things like encoded payloads (-enc, frombase64string), LOLBins (certutil, bitsadmin, regsvr32), -windowstyle hidden, IEX, and C2 indicators like ngrok or pastebin URLs. Cheap pattern matching but it catches the lazy stuff.
Output is a self-contained HTML report. All CSS inlined, no external assets. You can email it, drop it on a fileshare, open it on a stripped down server, and it renders. There is also a JSON file for anyone who wants to parse findings into a SIEM later.
Scoring is dumb on purpose. Each finding is CRITICAL (-20), WARNING (-10), or PASS/INFO (0). Start at 100, deduct, end with a letter grade A through F. The point is not "is this CVSS-accurate." The point is that you can hand the HTML to a non-security person and they get it in three seconds.
What broke along the way.
The biggest pain was admin vs standard user. Some checks (BitLocker, audit policy, credential guard, firewall details) just fail or return degraded results without elevation. I wanted them to fail loudly without crashing the whole run, so each check returns a Finding object with status PASS, WARNING, CRITICAL, or INFO, and the runner aggregates them. If one check explodes, the others still finish. Took me a couple iterations to stop having one bad subprocess timeout kill the whole report.
The other thing I underestimated: HTML escaping. All those scheduled task names and registry values go straight into the report. If a malicious task name had <script> in it, my report would happily render it. So I added pytest coverage specifically for the escape path, and a test that drops <img src=x onerror=alert(1)> into a finding to make sure it comes out as text. Coverage is at 80% min, which feels right for a tool you might run on a real machine.
Things I would still fix.
The grading is too coarse. A box with one critical finding and 19 passes lands a C. That is fine for "is this safe" but it overweights single critical findings. I want to weight them by category eventually, so a missing antivirus is not the same as a deprecated SMBv1 enabled.
Subprocess timeouts also have a default of 60s per check, which is fine on a normal machine and miserable on a slow domain-joined one. I should make them adaptive.
The suspicious-pattern detector is regex on strings, which means false positives. A scheduled task named "regsvr32-cleanup" gets flagged. The custom keywords file partially fixes this but I should ship a default trusted-paths list that covers common vendor software.
If you have a Windows machine and 30 seconds:
git clone https://github.com/TiltedLunar123/WinRecon
cd WinRecon
python -m winrecon
It writes the HTML to ./winrecon_reports/. Open it. Tell me which check is wrong on your box. That is actually the most useful feedback I can get right now.
Top comments (0)