APOTROPE
v0.2.0
Security Score
75
/ 100
C
Fair
53 checks evaluated
Executive Summary
The security posture of WORKSTATION-07 has been assessed as Fair with an overall score of 75/100 (C) across 53 security checks. 1 high-severity finding should be addressed promptly. Of the checks performed, 3 checks failed and 3 checks issued warnings. The primary areas of concern are Accounts, Hardening and Encryption. Remediation should be prioritized by severity, addressing critical and high-severity findings first.
Result Distribution53
PASS34
FAIL3
WARN3
INFO13
⚑ Top Issues
Critical & high severity · 1 of 6 open findings
01
Password Policy — Minimum Length
Fix: Require a minimum password length of 14 characters.
PS>net accounts /minpwlen:14
⚠ Review before running — these commands run elevated and can change system settings.
+ 5 additional open findings not shown here —
ChecksChecks whether User Account Control (UAC) is enabled.
FoundUAC (EnableLUA) is enabled.
MappingCIS 2.3.17.6
ChecksChecks the UAC consent prompt behavior for administrator accounts.
FoundConsentPromptBehaviorAdmin = 5: Prompt for consent for non-Windows binaries (Windows default).
MappingCIS 2.3.17.2
ChecksChecks whether UAC prompts appear on the isolated secure desktop.
FoundUAC prompts are displayed on the secure desktop (isolated from user input).
MappingCIS 2.3.17.7
ChecksChecks the UAC consent prompt behavior for standard user accounts.
FoundConsentPromptBehaviorUser = 3: Prompt for credentials (default).
MappingCIS 2.3.17.3
ChecksMinimum password length must be ≥8 (WARN if <12).
FoundMinimum password length: 0 characters.
Remediation
Require a minimum password length of 14 characters.
PS>net accounts /minpwlen:14
⚠ Review before running — these commands run elevated and can change system settings, or require a reboot or maintenance window.
MappingCIS 1.1.4
ChecksChecks whether password complexity requirements are enforced.
FoundPassword complexity requirement: disabled.
Remediation
Enable the password complexity requirement so passwords must mix character types.
# Enable the password-complexity policy via secedit (no reboot needed).PS>$inf = "$env:TEMP\pwcomplexity.inf"PS>@'PS>[Unicode]PS>Unicode=yesPS>[Version]PS>signature="$CHICAGO$"PS>[System Access]PS>PasswordComplexity = 1PS>'@ | Set-Content -Path $inf -Encoding UnicodePS>secedit /configure /db "$env:TEMP\pwcomplexity.sdb" /cfg $inf /areas SECURITYPOLICY
⚠ Review before running — these commands run elevated and can change system settings, or require a reboot or maintenance window.
MappingCIS 1.1.5
ChecksChecks whether the built-in Guest account is disabled.
FoundBuilt-in Guest account is disabled.
MappingCIS 2.3.1.1
ChecksChecks if the built-in Administrator account is enabled and not renamed.
FoundBuilt-in Administrator account is disabled.
MappingCIS 2.3.1.3
ChecksCounts members of the local Administrators group (WARN if >2).
Found2 administrator(s): Administrator, jsmith
ChecksChecks whether account lockout is configured to deter brute-force attacks.
FoundLockout threshold: 10 attempt(s) | Duration: 30 minute(s).
MappingCIS 1.2.1
ChecksChecks whether Windows Defender real-time protection is active.
FoundRealTimeProtectionEnabled: True | AMServiceEnabled: True | AntivirusEnabled: True
MappingCIS 18.10.42.10.3
ChecksChecks whether Defender virus definitions are less than 7 days old.
FoundAntivirus signature age: 0 day(s).
MappingCIS 18.10.42.14
ChecksChecks whether Tamper Protection is enabled to prevent unauthorised changes to Defender settings.
FoundIsTamperProtected: True
ChecksLists antivirus products registered with Windows Security Center.
FoundRegistered AV product(s): Windows Defender
ChecksChecks BitLocker encryption status for drive G:.
FoundDrive: G: | Type: 1 | Status: Unknown | Encrypted: 0% | Protection: Off
Remediation
Encrypt drive G: with BitLocker using the TPM protector.
# BitLocker requires Windows Pro/Enterprise/Education (absent on Home).PS>if (Get-Command Enable-BitLocker -ErrorAction SilentlyContinue) {PS> Enable-BitLocker -MountPoint 'G:' -EncryptionMethod XtsAes256 -UsedSpaceOnly -RecoveryPasswordProtector -SkipHardwareTestPS> if ('G:' -eq $env:SystemDrive) { Add-BitLockerKeyProtector -MountPoint 'G:' -TpmProtector } else { Enable-BitLockerAutoUnlock -MountPoint 'G:' }# SAVE THIS BEFORE YOU REBOOT. The recovery password is the only# way back in once the key stops being released automatically. The# cmdlets above return a volume object whose default table shows the# protector TYPES but not the password, and it cannot be read back# from the recovery prompt itself.PS> $rp = (Get-BitLockerVolume -MountPoint 'G:').KeyProtector | Where-Object KeyProtectorType -eq 'RecoveryPassword'PS> $rp | Format-List KeyProtectorId, RecoveryPassword# Domain- or Entra-joined? Escrow it centrally as well:# Backup-BitLockerKeyProtector -MountPoint 'G:' -KeyProtectorId $rp.KeyProtectorId# BackupToAAD-BitLockerKeyProtector -MountPoint 'G:' -KeyProtectorId $rp.KeyProtectorIdPS>} else {PS> Write-Warning 'BitLocker is unavailable on this Windows edition.'PS>}
⚠ Review before running — these commands run elevated and can change system settings, or require a reboot or maintenance window.
MappingCIS 18.10.10
ChecksChecks BitLocker encryption status for drive C:.
FoundDrive: C: | Type: Unknown | Status: 1 | Method: 6 | Encrypted: 100% | Protection: On
MappingCIS 18.10.10
ChecksChecks that SMBv1 is disabled (mitigates EternalBlue/WannaCry/NotPetya).
FoundSMBv1 protocol is disabled.
MappingCIS 18.4.2
ChecksChecks that SMB message signing is required (mitigates NTLM relay attacks).
FoundSMB signing is required on this server.
MappingCIS 2.3.9.2
ChecksChecks whether SMB encryption is enforced (SMB 3.0+ feature).
FoundSMB encryption (EncryptData) is disabled.
Remediation
Enable SMB encryption for sensitive environments: Set-SmbServerConfiguration -EncryptData $true -Force. Note: requires all clients to support SMB 3.0+
MappingCIS 18.6.8.7
ChecksChecks whether the Windows Firewall Domain profile is enabled.
FoundProfile: Domain | Enabled: True
MappingCIS 9.1.1
ChecksChecks whether the Windows Firewall Private profile is enabled.
FoundProfile: Private | Enabled: True
MappingCIS 9.2.1
ChecksChecks whether the Windows Firewall Public profile is enabled.
FoundProfile: Public | Enabled: True
MappingCIS 9.3.1
ChecksChecks that the Domain profile does not explicitly allow all unsolicited inbound connections by default.
FoundProfile: Domain | DefaultInboundAction: NotConfigured | DefaultOutboundAction: NotConfigured
MappingCIS 9.1.2
ChecksChecks that the Private profile does not explicitly allow all unsolicited inbound connections by default.
FoundProfile: Private | DefaultInboundAction: NotConfigured | DefaultOutboundAction: NotConfigured
MappingCIS 9.2.2
ChecksChecks that the Public profile does not explicitly allow all unsolicited inbound connections by default.
FoundProfile: Public | DefaultInboundAction: NotConfigured | DefaultOutboundAction: NotConfigured
MappingCIS 9.3.2
ChecksChecks whether AutoPlay is disabled for all drive types.
FoundAutoPlay is partially disabled (NoDriveTypeAutoRun = 158). Some drive types may still trigger AutoPlay.
Remediation
Disable AutoPlay for all drive types so the remaining drive types can no longer auto-execute content.
PS>reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /fPS>if ($LASTEXITCODE -ne 0) { throw "reg.exe add failed ($LASTEXITCODE)" }
⚠ Review before running — these commands run elevated and can change system settings, or require a reboot or maintenance window.
MappingCIS 18.10.8.3
ChecksChecks that key audit policy subcategories log Success/Failure events.
FoundNot all expected audit subcategories are confirmed logging: Sensitive Privilege Use. Security-relevant events may not be recorded.
Remediation
Enable audit logging for the subcategories confirmed disabled so security-relevant events are recorded. This can also be configured via Group Policy (secpol.msc → Advanced Audit Policy Configuration).
PS>auditpol /set /subcategory:'Sensitive Privilege Use' /success:enable /failure:enable
⚠ Review before running — these commands run elevated and can change system settings, or require a reboot or maintenance window.
MappingCIS 17.1.1
ChecksChecks whether the Windows Remote Management (WinRM) service is running.
FoundWinRM service is not running.
MappingCIS 18.10.90.2.2
ChecksChecks that the screen automatically locks within 15 minutes.
FoundScreen lock timeout: 10 minute(s).
ChecksChecks whether Spectre/Meltdown mitigations have been explicitly disabled.
FoundNo FeatureSettingsOverride registry key found — Windows default mitigations apply (recommended).
ChecksChecks whether NetBIOS over TCP/IP is disabled on all network adapters.
Found2 adapter(s) inherit NetBIOS setting from DHCP. If the DHCP server does not explicitly disable NetBIOS, it may be active.
Remediation
Explicitly disable NetBIOS on all adapters rather than relying on DHCP.
PS>Get-CimInstance Win32_NetworkAdapterConfiguration -Filter 'IPEnabled=True' | ForEach-Object {PS> $r = Invoke-CimMethod -InputObject $_ -MethodName SetTcpipNetbios -Arguments @{ TcpipNetbiosOptions = 2 }PS> switch ($r.ReturnValue) {PS> 0 { "$($_.Description): NetBIOS disabled" }PS> 1 { Write-Warning "$($_.Description): disabled, REBOOT REQUIRED" }PS> default { Write-Warning "$($_.Description): failed, ReturnValue=$($r.ReturnValue)" }PS> }PS>}
⚠ Review before running — these commands run elevated and can change system settings, or require a reboot or maintenance window.
ChecksChecks whether LLMNR is disabled (LLMNR is susceptible to poisoning attacks).
FoundLLMNR is disabled via Group Policy.
MappingCIS 18.6.4.4
ChecksEnumerates all TCP ports in LISTEN state.
Found10 listening port(s): 135, 139, 445, 5040, 49664, 49665, 49666, 49667, 49668, 49669
ChecksReports whether IPv6 is active on any network adapter (informational).
FoundIPv6 is active on 3 adapter(s).
ChecksChecks when the most recent Windows Update was installed.
FoundLast update installed 0 day(s) ago (2026-07-16).
MappingCIS 18.10.94.2.1
ChecksChecks whether the Windows Update (wuauserv) service can run.
FoundWindows Update service start type is Automatic (current state: Stopped); it starts on demand when updates are needed.
MappingCIS 18.10.94.2.1
ChecksCounts Windows Updates that are available but not yet installed.
FoundNo pending Windows Updates were found; the system is up to date.
MappingCIS 18.10.94.2.1
ChecksEnumerates programs configured to run at startup (registry Run keys + startup folders).
Found6 startup program(s): OneDrive, Microsoft Teams, Windows Security, Realtek Audio Console, Synaptics TouchPad, Snipping Tool
ChecksEnumerates non-Microsoft scheduled tasks (potential persistence points).
Found8 non-Microsoft task(s): Adobe Acrobat Update Task, GoogleUpdateTaskMachineCore, GoogleUpdateTaskMachineUA, MicrosoftEdgeUpdateTaskMachineCore, MicrosoftEdgeUpdateTaskMachineUA, OneDrive Standalone Update Task, Dell SupportAssist Trigger, Intel Driver & Support Assistant
ChecksChecks whether PowerShell Script Block Logging is enabled (critical for forensics/IR).
FoundScript Block Logging is enabled — PowerShell commands are logged to the event log.
MappingCIS 18.10.88.1
ChecksChecks whether PowerShell Module Logging is enabled.
FoundModule Logging is enabled — module pipeline execution events are logged.
ChecksChecks the LocalMachine PowerShell execution policy.
FoundExecution policy is 'Undefined'.
ChecksChecks whether PowerShell v2 is installed (downgrade attack vector).
FoundCould not determine PowerShell v2 status (state: '').
ChecksChecks whether PowerShell Constrained Language Mode is active.
FoundPowerShell language mode: FullLanguage.
ChecksChecks whether Remote Desktop is enabled.
FoundRemote Desktop is disabled (fDenyTSConnections = 1).
MappingCIS 18.10.57.3.2.1
ChecksChecks for services whose executable path contains spaces but is not quoted (privilege-escalation vector).
FoundNo services with unquoted paths containing spaces found.
ChecksChecks for known-risky services (Remote Registry, Telnet, SNMP).
FoundNo known-risky services are running.
ChecksChecks whether the installed Windows build is still supported by Microsoft.
FoundWindows 11 25H2 is supported until 2027-10-12 (452 days remaining).
ChecksWarns when uptime exceeds 30 days (suggests pending patch reboots).
FoundSystem uptime is 7 day(s).
ChecksChecks whether UEFI Secure Boot is enabled.
FoundSecure Boot is enabled.
MappingCIS 18.10.10.2.2
ChecksChecks whether a TPM chip is present and functional.
FoundTPM present. Ready: True. Firmware version: 7.2.2.0.
ChecksReports the installed Windows version and build number.
FoundMicrosoft Windows 11 Pro (Build 26200, Version 10.0.26200)
ChecksReports whether this machine is joined to an Active Directory domain.
FoundWorkgroup member. Workgroup: WORKGROUP
For authorized security assessment use only · No data leaves this machine · CIS Benchmark v5.0.0
apotrope.sh · github.com/hexorcist404/apotrope · MIT