Endpoint Security Assessment

Get-MpComputerStatus | Select TamperProtection
TamperProtectionSource: N/A
IsTamperProtected: False

Real-time protection: Enabled
Behavior monitor: Enabled
Signature age: 0 days (current)

Enable Tamper Protection via Windows Security > Virus & threat protection > Virus & threat protection settings > Tamper Protection = On.

For managed environments, deploy via Intune: Endpoint security > Antivirus > Windows Security experience > Tamper Protection = Enable.

Note: Tamper Protection requires cloud-delivered protection to be enabled.

Get-LocalUser | Where-Object { $_.Enabled -eq $true }
Name: User01 | PasswordRequired: False | PasswordExpires: Never | Enabled: True

Admin group membership confirmed: DEMO-WS01\User01 is a local administrator

Set a strong password on the account immediately:
  net user User01 * (interactive prompt)

Then enforce password policy:
  net accounts /minpwlen:12 /maxpwage:90

For enterprise management, deploy via Intune or Group Policy:
  Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy

Get-NetTCPConnection -State Listen | Where LocalPort -eq 3389
LocalAddress: 0.0.0.0  LocalPort: 3389  Process: svchost (PID 2000)
LocalAddress: ::       LocalPort: 3389  Process: svchost (PID 2000)

Firewall profiles: Domain=Enabled, Private=Enabled, Public=Enabled

Restrict RDP access via Windows Firewall:
  1. Create inbound rule allowing RDP only from trusted IPs/subnets
  2. Enable NLA: System Properties > Remote > "Allow connections only from computers running Remote Desktop with Network Level Authentication"
  3. Consider disabling RDP entirely if not needed, or restrict to VPN/Tailscale only

For managed environments: Deploy RDP restrictions via Intune Endpoint Security > Attack surface reduction rules.

Get-Service wuauserv | Select Status, StartType
Status: Stopped
StartType: Manual

Note: Windows 11 starts this service on-demand for update checks. Verify updates are being applied via Settings > Windows Update.

Verify update status: Settings > Windows Update > Check for updates.

If updates are stale, restart the service:
  Start-Service wuauserv
  (New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()

For managed environments: Verify Windows Update for Business or WSUS policies are applying correctly via Intune compliance policies.

Registry: HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
EnableScriptBlockLogging: Not configured (disabled)

Module Logging: Also disabled
Transcription: Disabled
Language Mode: FullLanguage

Enable via Group Policy:
  Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on PowerShell Script Block Logging = Enabled

Or via registry:
  New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Force
  Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name 'EnableScriptBlockLogging' -Value 1

For managed environments: Deploy via Intune Settings Catalog > PowerShell Script Block Logging.

VirtualizationBasedSecurityStatus: 2 (Enabled)
SecurityServicesRunning: [0] (None)
SecurityServicesConfigured: [0] (None)

LSA Protection (RunAsPPL): Enabled
WDigest UseLogonCredential: 0 (plaintext passwords disabled)

Enable Credential Guard:
  1. Verify hardware supports VBS: msinfo32 > Virtualization-based security
  2. Enable via Group Policy: Computer Configuration > Administrative Templates > System > Device Guard > Turn on Virtualization Based Security > Credential Guard = Enabled with UEFI lock
  3. Reboot required

For managed environments: Deploy via Intune Endpoint Security > Account Protection > Credential Guard.

Path Exclusions (10):
  - Development directories (source code repos)
  - Package manager caches (npm, fnm)
  - User temp directories
  - Local AppData temp

Process Exclusions (12):
  - node.exe, npm.cmd, npx.cmd
  - git.exe, git-remote-https.exe
  - ssh.exe
  - File sync utilities
  - Various wildcard patterns

Review and minimize exclusions:
  1. Remove broad temp directory exclusions — use specific process exclusions instead
  2. Replace directory-level exclusions with file-type exclusions where possible
  3. Audit: Get-MpPreference | Select-Object -ExpandProperty ExclusionPath

Consider using ASR (Attack Surface Reduction) rules to compensate:
  Set-MpPreference -AttackSurfaceReductionRules_Ids <rule-id> -AttackSurfaceReductionRules_Actions Enabled

For managed environments: Audit exclusions via Intune > Endpoint Security > Antivirus > Exclusions report.

Service: AsSysCtrlService
Display: ASUS System Control Service
Path: C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe
State: Stopped
StartMode: Disabled

Path contains spaces but is not quoted.

Quote the service path:
  sc.exe config AsSysCtrlService binPath= '"C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe"'

Or if the service is no longer needed (ASUS utility), remove it:
  sc.exe delete AsSysCtrlService

Audit for other unquoted paths:
  Get-CimInstance Win32_Service | Where-Object { $_.PathName -match '\s' -and $_.PathName -notmatch '"' }

Get-LocalUser User01 | Select PasswordExpires
PasswordExpires: Never

System password policy:
  Maximum password age: 42 days
  Minimum password length: 0
  Lockout threshold: 10 attempts
  Lockout duration: 10 minutes

Note: System policy enforces 42-day max age but the per-user setting overrides this.

Set password expiry on the account:
  Set-LocalUser -Name User01 -PasswordNeverExpires $false

This will inherit the system password policy (42-day maximum age).

For managed environments: Enforce via Intune compliance policy requiring password expiry aligned with organisational policy.

Get-NetTCPConnection -State Listen | Where LocalPort -eq 5432
LocalAddress: 0.0.0.0  LocalPort: 5432  Process: postgres (PID 8616)
LocalAddress: ::       LocalPort: 5432  Process: postgres (PID 8616)

Context: Development workstation PostgreSQL instance.

Restrict PostgreSQL to localhost only:
  Edit postgresql.conf: listen_addresses = 'localhost'
  Restart PostgreSQL service

If remote access is needed, use pg_hba.conf to restrict to specific IP addresses and require SSL connections.

Alternatively, add Windows Firewall rules to block port 5432 from external networks.

Registry: HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging
EnableModuleLogging: Not configured (disabled)

Transcription logging: Also disabled

Enable via Group Policy:
  Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on Module Logging = Enabled
  Module Names: * (all modules)

Or via registry:
  New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging' -Force
  Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging' -Name 'EnableModuleLogging' -Value 1

Service: Cloudflared
Path: C:\Users\User01\cloudflared.exe
State: Running

Expected location: C:\Program Files\Cloudflare\cloudflared.exe

Move Cloudflared to a standard installation directory:
  1. Stop the service: sc stop Cloudflared
  2. Copy binary: Copy-Item cloudflared.exe 'C:\Program Files\Cloudflare\cloudflared.exe'
  3. Update service path: sc config Cloudflared binPath= '"C:\Program Files\Cloudflare\cloudflared.exe" --config ...'
  4. Start the service: sc start Cloudflared
  5. Remove old binary from user profile

Alternatively, install via winget: winget install Cloudflare.cloudflared

Get-LocalGroupMember -Group 'Administrators'
DEMO-WS01\Administrator (User, Local) — Disabled
DEMO-WS01\SvcAccount01 (User, Local) — Enabled, password expires 2026-04-06
DEMO-WS01\User01 (User, Local) — Enabled, no password required

Total enabled admin accounts: 2

Review admin group membership:
  1. Verify SvcAccount01 requires admin privileges — if not, remove from Administrators group
  2. Consider using a standard user account for daily operations and elevating via UAC when needed
  3. For managed environments: Deploy LAPS (Local Administrator Password Solution) via Intune

Audit regularly: Get-LocalGroupMember -Group 'Administrators'

$ExecutionContext.SessionState.LanguageMode
FullLanguage

Note: FullLanguage is expected on admin/developer workstations. CLM is recommended for standard user endpoints in managed environments.

For standard user endpoints (not admin/developer workstations):
  Deploy Constrained Language Mode via AppLocker or WDAC policy

This finding is informational for admin workstations — no action required unless organisational policy mandates CLM.

For managed environments: Deploy WDAC (Windows Defender Application Control) policies via Intune to enforce CLM on non-admin endpoints.

Startup Folder Items (7):
  ActivityWatch, Dell Display Manager (x2), OneNote, ShareX, RustDesk Tray, Tailscale

Registry Run Keys (10):
  Discord, Backblaze, Spotify, Claude Desktop, Spark Desktop, MicroSIP, Teams, Todoist, NebulaTray, Discord (HKLM)

WMI Event Subscriptions: 1 (SCM Event Log Filter — Windows built-in)

All entries verified as legitimate software.

Review and reduce autostart entries:
  1. Disable apps that don't need to start at boot (e.g., Spotify --autostart, Todoist)
  2. Use Task Manager > Startup tab to manage impact
  3. Consider removing duplicate entries (Discord appears in both HKCU and HKLM)

Periodically audit: Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'