Short answer: not exactly. Lynis runs on Linux, macOS, and BSD, not Windows. The closest equivalent for Windows is Apotrope: a single executable that audits the local machine against CIS Benchmark controls, scores it 0-100, and writes a self-contained HTML report. Offline, read-only, no agent, MIT-licensed.
Lynis earned its reputation by being simple and honest: one command, runs locally, no agent, tells you what's weak and how to harden it. There's never been a clean Windows counterpart. The options have been a Java assessor behind a signup, a pile of one-off PowerShell scripts, or reading a 40-tab CIS PDF by hand.
Apotrope is built to fill that gap. You run one .exe (or pip install apotrope) on the machine in front of you. It checks 50+ controls across 14 categories — firewall, BitLocker, SMB signing, RDP, UAC, PowerShell logging, unquoted service paths, and more — maps each to its CIS Microsoft Windows Benchmark control ID, scores the box, and hands you plain-English remediation. The exact count is machine-dependent (typically 52–56). Nothing leaves the machine.
It isn't a port of Lynis and shares no code with it. It's the same idea, built natively for Windows.
Lynis vs Apotrope
| Lynis | Apotrope | |
|---|---|---|
| Platform | Linux, macOS, BSD | Windows 10 / 11 |
| Install | Shell script / package | Single .exe or pip install |
| Runs offline | Yes | Yes |
| Agent / cloud | No | No |
| Benchmark mapping | CIS / various | CIS Microsoft Windows (Win11 v5.0.0 / Win10 v4.0.0) |
| Output | Terminal + log | Terminal + self-contained HTML + JSON |
| Score | Hardening index | 0-100 score, A-F grade |
| License | GPLv3 (Enterprise tier paid) | MIT, free |
FAQ
Can Lynis run on Windows?
No. Lynis targets Unix-like systems (Linux, macOS, BSD). For Windows, use a native tool like Apotrope.
Is Apotrope a Lynis port?
No. It shares no code with Lynis. It is an independent, native Windows auditor built on the same offline, agentless idea.
Is Apotrope free?
Yes. MIT licensed, with no account or key.