What WinSentinel Actually Audits: All 64 Modules Explained

When you run winsentinel --audit, the CLI executes 64 independent security modules against your live Windows configuration. Each module produces findings with severity levels (Critical, Warning, Info) and actionable remediation steps with one-click fix commands. Here's what's under the hood.

🛡️ Endpoint Protection

1. Windows Defender — Checks real-time protection, cloud-delivered protection, automatic sample submission, tamper protection, and signature freshness. A disabled Defender is the #1 finding on consumer machines.

2. Windows Firewall — Validates all three profiles (Domain, Private, Public) are enabled, checks for overly permissive inbound rules, and flags any rule allowing all traffic on the Public profile.

3. Windows Update — Detects pending critical/security updates, checks the last successful update date (critical if >30 days), validates automatic update settings, and flags paused updates.

4. Exploit Mitigation — Checks system-wide exploit mitigations - SEHOP (exception-chain validation), mandatory image relocation (ASLR / MoveImages), the machine-wide process MitigationOptions policy, and the DEP/NX boot policy - all foundational memory-corruption defenses on a single machine.

5. Defender Network Protection — Checks single-machine Microsoft Defender Network Protection - whether outbound connections from any process are blocked when they target low-reputation (malware C2, phishing, exploit-hosting) domains and IPs, whether the feature is enforcing (Block) or only logging (Audit), and whether Defender real-time and cloud-delivered protection are active to back it - the most effective free control against commodity C2 callbacks.

6. Attachment Manager & Mark-of-the-Web — Checks Windows Attachment Manager / Mark-of-the-Web hardening on a single machine: whether downloaded files keep their untrusted zone mark (so SmartScreen and Office Protected View still fire), whether saved attachments are scanned for malware, and whether any file types have been force-classified as low-risk - the controls that decide how safely untrusted downloads are handled.

7. Boot Integrity — Checks single-machine platform boot-integrity and kernel-protection posture - UEFI Secure Boot, Virtualization-Based Security (VBS), Memory Integrity (HVCI), Kernel DMA Protection, and whether the kernel is booted with test signing or debugging enabled - the mitigations that keep the kernel trustworthy.

🔐 Identity & Access

8. Account Security — Identifies guest accounts, checks password policies, flags accounts with "password never expires", detects local admin sprawl, and verifies UAC configuration.

9. Identity & Credential Hygiene — Audits local admin sprawl (Administrators group membership), stale accounts (90+ days inactive), LAPS deployment status, cached credentials count, LSA Protection (RunAsPPL), and Credential Guard.

10. Credential Exposure — Scans Windows Credential Manager, Git credential stores, SSH key security (passphrase-less keys, weak algorithms), plaintext credential files, saved RDP passwords, browser credential stores, and cloud credential configs.

11. Group Policy — Validates security-relevant GPO settings: account lockout policies, password complexity, audit logging, security options, and restricted software policies.

12. Credential Protection — Checks single-machine LSASS credential-theft defenses - LSA Protection (RunAsPPL), Credential Guard (LsaCfgFlags) and WDigest cleartext caching (UseLogonCredential) - to confirm that credentials in LSASS memory are protected against Mimikatz-style dumping.

13. LSA Hardening — Checks single-machine LSA / credential-protection hardening - LSASS Protected Process (RunAsPPL), WDigest plaintext caching, LM hash storage, NTLM dialect restriction, anonymous null-session enumeration, blank-password remote logon, cached domain logon count, cleartext autologon, and outbound/inbound NTLM restriction (RestrictSending/ReceivingNTLMTraffic) - the classic CIS L1 controls that decide how hard it is to lift, replay, or relay credentials on this box.

14. Kerberos Hardening — Checks single-machine Kerberos client encryption-type hardening - the SupportedEncryptionTypes bitmask that controls which cipher suites the host will negotiate - flagging the broken DES suites and the weak RC4 suite (which enables fast offline Kerberoasting) and confirming a strong AES suite is offered.

15. Interactive Logon — Checks single-machine Windows interactive-logon policy hardening - whether a pre-logon legal-notice banner is configured (LegalNoticeCaption / LegalNoticeText) and, when smart-card logon is in use, whether removing the card locks or logs off the session (ScRemoveOption) - CIS L1 interactive-logon controls.

16. Automatic Sign-On — Checks single-machine Windows Automatic Restart Sign-On (ARSO) and sign-in-screen hardening - whether ARSO is disabled (DisableAutomaticRestartSignOn) so the machine does not silently re-establish the last user's session after an update reboot, and whether the sign-in screen is blocked from displaying account details (BlockUserFromShowingAccountDetailsOnSignin) - CIS L1 interactive-logon controls.

17. UAC Hardening — Checks UAC enablement, the admin elevation-prompt behaviour, secure-desktop prompting, Admin Approval Mode for the built-in Administrator, installer detection, and the remote UAC token-filtering override (Pass-the-Hash enabler) against CIS Windows L1.

🌐 Network Security

18. Network Posture — Identifies open listening ports vs. known processes, audits firewall rules for gaps, checks SMBv1/LLMNR/NBT-NS status, and flags public profile exposure.

19. SMB Share Security — Detects SMBv1 enabled (WannaCry/NotPetya vector), SMB signing not required (NTLM relay risk), exposed administrative shares, and user-created shares with overly permissive ACLs.

20. DNS Security — Checks for insecure DNS servers, DNS-over-HTTPS not enabled, DNS cache poisoning exposure, LLMNR/NetBIOS spoofing risk, and hosts file tampering.

21. Wi-Fi Security — Detects saved profiles using weak/no encryption (Open, WEP, WPA-TKIP), auto-connect to insecure networks, cleartext password exposure, and MAC randomization status.

22. Remote Access — Validates RDP settings and NLA, SSH server exposure, VNC/TeamViewer/AnyDesk configurations, WinRM/PSRemoting exposure, Remote Registry, and Remote Assistance.

23. Bluetooth — Flags Bluetooth radio left enabled when unneeded, discoverable mode (BlueBorne/BlueSmack risk), paired devices with outdated profiles, and services exposing sensitive capabilities.

24. Firewall Rule Analysis — Deep analysis of individual inbound firewall Allow rules: flags rules exposing dangerous ports (RDP, SMB, WinRM, SQL, Redis, MongoDB, …), overly-permissive wide-open rules, Public-profile exposure, duplicate rules, and shadowed/redundant rules, with an overall firewall risk score.

25. Firewall Logging — Checks single-machine Windows Firewall logging per profile (Domain/Private/Public) - dropped-packet logging, successful-connection logging, log file size, and log file path - the CIS L1 controls that decide whether the firewall leaves any evidence of scans, blocked C2, or unexpected egress.

26. SMB Security Hardening — Checks SMB server/client signing enforcement, the legacy SMBv1 protocol, SMB share encryption, null-session access, and insecure guest-logon fallback against CIS Windows L1.

27. Hosts File Integrity — Checks the local hosts file for tampering - security/update domains blackholed to a non-routable address (blocks Windows Update and AV), hostnames redirected to public IPs (traffic hijack / phishing), and unusually large blocklists - to catch a common, low-effort DNS-override attack on a single machine.

28. Name Resolution (LLMNR / mDNS) — Checks single-machine name-resolution poisoning hardening - whether LLMNR, NetBIOS over TCP/IP (NBT-NS), mDNS and WPAD proxy auto-discovery are disabled - to remove the Responder/NetNTLM-capture and proxy-MITM surface on untrusted networks.

29. Remote Desktop (RDP) Hardening — Checks Remote Desktop (RDP) hardening on a single machine: whether RDP is enabled, whether Network Level Authentication is required, the minimum encryption level, the TLS security layer, and whether RDP listens on the default port 3389 - the primary controls on one of the most-attacked Windows remote-access surfaces.

30. WinRM Hardening — Checks Windows Remote Management (WS-Man) service and client hardening - unencrypted traffic, Basic/Digest auth, channel-binding-token enforcement, and wildcard TrustedHosts - against CIS Windows L1.

💻 System & Configuration

31. System Security — Checks Windows version (end-of-life detection), Secure Boot, TPM 2.0 presence, Kernel DMA protection, and Virtualization-Based Security (VBS).

32. Registry Security — Audits UAC disabled or weakened, Remote Desktop without NLA, AutoPlay/AutoRun not disabled, WDigest plain-text credential storage, and credential caching.

33. Environment Variables — Detects PATH hijacking via writable directories, secrets leaked in environment variables (API keys, tokens), dangerous PATHEXT entries, insecure proxy settings, and overly permissive TEMP/TMP ACLs.

34. Privacy & Telemetry — Checks advertising ID, location tracking, diagnostic data levels, activity history, feedback frequency, and speech recognition privacy settings.

35. Optional Windows Features — Checks for risky enabled Windows optional features - SMB 1.0/CIFS, the legacy PowerShell 2.0 engine, and cleartext legacy clients (Telnet, TFTP) - that expand the local attack surface or bypass other controls.

36. Diagnostics Hardening — Checks single-machine Windows diagnostics / troubleshooting hardening - the scripted-diagnostics (MSDT) engine, the ms-msdt: URL protocol handler behind Follina (CVE-2022-30190), built-in MSDT troubleshooter policy, and the diagnostic-data (telemetry) floor - the local controls that decide how much of the MSDT / diagnostics attack surface is exposed on this box.

37. Time Synchronization — Checks single-machine Windows time-synchronization security - the Windows Time service (W32Time) state, the sync source type (NTP / NT5DS / NoSync), the NTP peer relative to the machine's domain role, and whether clock phase-correction caps are bounded - because accurate time underpins Kerberos auth, certificate validity, and log correlation.

38. Windows Script Host — Checks single-machine Windows Script Host hardening - whether wscript.exe/cscript.exe are disabled, whether a per-user override re-enables WSH over a machine-wide disable, whether remote script execution is allowed, and whether signed-only (Authenticode) TrustPolicy is enforced - to reduce the .vbs/.js living-off-the-land execution surface.

39. Windows Installer (MSI) — Checks single-machine Windows Installer (MSI) hardening - whether AlwaysInstallElevated is enabled in both HKLM and HKCU (a classic local privilege-escalation path that lets any user install an MSI as SYSTEM), whether ad-hoc MSI installs are restricted (DisableMSI), and whether unprivileged users can override restricted install properties (EnableUserControl) - CIS L1 controls that decide how easily msiexec becomes a local escalation and malware-delivery surface on this box.

40. Session Lock & Sign-In — Checks single-machine interactive-session lock and sign-in hardening - machine inactivity auto-lock, a password-protected screensaver fallback, hiding the last user on the logon/locked screen, requiring Ctrl+Alt+Del, and disabling automatic passwordless console logon - CIS L1 session-security controls.

41. Windows Recall — Checks single-machine Windows Recall exposure - whether Recall snapshotting is disabled by policy (DisableAIDataAnalysis), whether Recall is blocked from being enabled (AllowRecallEnablement), and whether a Recall snapshot store already exists on disk - to reduce local screen-capture data exposure that can include passwords, tokens and private data.

42. Delivery Optimization — Checks single-machine Windows Delivery Optimization download-source posture - whether the machine peers update/Store content with other machines and, critically, whether it peers across the public Internet (DODownloadMode=3) - to avoid turning the machine into an Internet-facing content peer.

🔒 Encryption & Storage

43. Encryption — Checks BitLocker status per volume, recovery key backup, encryption method strength, and drive encryption completeness.

44. Certificate Store — Detects expired certificates, soon-to-expire certs, weak signature algorithms (SHA-1, MD5), untrusted root CAs, and self-signed certs in trusted stores.

45. USB & Removable Media — Checks AutoRun/AutoPlay settings, USB write-protect policy, BitLocker-to-Go enforcement, device connection history, USBSTOR service status, and removable disk encryption requirements.

46. Backup & Recovery — Validates Volume Shadow Copy (VSS) service and shadow copies, System Restore configuration, File History, Windows Backup, ransomware resilience indicators, and recovery partition presence.

🏗️ Application & Service Security

47. Application Security — Checks UAC level, SmartScreen, exploit protection (DEP, ASLR, CFG), developer mode, sideloading policy, and .NET Framework security settings.

48. Browser Security — Audits Chrome/Edge/Firefox for dangerous extensions, SmartScreen settings, pop-up blocker, safe browsing, and password manager integration.

49. Service Security — Scans for unquoted service paths (privilege escalation), services running as SYSTEM from user-writable paths, disabled security services, auto-start services pointing at missing binaries, and suspicious cmd/PowerShell service wrappers.

50. Software Inventory — Detects unsigned/tampered executables, programs in suspicious locations, outdated software with known vulnerability indicators, PUPs via heuristic patterns, and orphaned installations.

51. Startup Programs — Analyzes Registry Run/RunOnce entries, Startup folder programs, scheduled task triggers, and service auto-start entries for persistence mechanisms.

52. Driver Security — Finds unsigned or self-signed drivers, drivers from user-writable paths, known vulnerable drivers used in BYOVD attacks, revoked certificates, and ancient unpatched drivers.

53. Virtualization — Validates Hyper-V isolation settings, WSL version and distribution security, Windows Sandbox availability, Docker daemon security, Credential Guard, VBS, and HVCI status.

54. Application Control (AppLocker / WDAC) — Checks application allowlisting - AppLocker rule collections and enforcement, the Application Identity service, WDAC/Code Integrity policy, and Smart App Control - against Essential 8 #1 and CIS Windows L1.

55. Office Macro Security — Checks single-machine Microsoft Office macro-security posture - whether macros run without a prompt (VBAWarnings), whether macros in files from the internet are hard-blocked, and whether Protected View is disabled for risky document origins - to reduce the phishing-borne macro initial-access surface.

56. Print Spooler Hardening — Checks Print Spooler / PrintNightmare hardening on a single machine: whether the spooler is running, whether printer-driver installation is restricted to administrators (CVE-2021-34527), and whether Point-and-Print suppresses the install/update elevation prompts - the controls on one of the most-exploited Windows privilege-escalation surfaces.

57. SmartScreen — Checks single-machine Windows SmartScreen reputation posture - whether App & File (Explorer) SmartScreen is enabled and set to Block, whether Microsoft Edge SmartScreen and PUA blocking are on, and whether SmartScreen still evaluates Store/App Installer web content - to preserve the built-in reputation check against downloaded-executable droppers and browser-borne malware.

⚡ Threat Detection & Forensics

58. Process Security — Analyzes running processes for SYSTEM-level execution, unsigned executables, processes from temp directories, and high-privilege process count.

59. Process Lineage Analysis — Maps parent-child process relationships to detect LOLBin abuse, Office macro execution spawning command interpreters, WMI lateral movement, deep interpreter nesting (obfuscation), and orphaned processes. References MITRE ATT&CK techniques.

60. Scheduled Task Security — Identifies persistence via tasks running as SYSTEM with suspicious actions, tasks executing from user-writable/temp directories, hidden tasks, and tasks using encoded PowerShell.

61. Event Log Analysis — Checks for brute force indicators (failed logins), privilege escalation events, audit policy completeness, log size/retention, and critical security events in the last 24 hours.

62. PowerShell Security — Validates execution policy, script block logging, module logging, transcription logging, AMSI status, PowerShell v2 engine (downgrade attack vector), and ConstrainedLanguageMode.

63. Audit Policy — Checks this machine's advanced audit policy - whether the security-relevant subcategories (Logon, Credential Validation, Process Creation, Audit Policy Change, User Account Management) are recording the Success/Failure events an investigation relies on.

64. Windows Error Reporting Exposure — Checks Windows Error Reporting upload posture (additional in-memory data, automatic consent level), local crash-dump writing (WER LocalDumps and full-dump type), and whether WER is disabled - all data exposure / credential-harvesting surfaces on a single machine.

Getting started

dotnet tool install --global WinSentinel.Cli
winsentinel --audit

That's it. Two commands, zero configuration, 64 modules covering every attack surface on your Windows machine. Every finding includes a "why" explanation and a concrete fix — many of which the CLI can apply automatically with --fix.

Want to focus on a specific area? Use profiles: winsentinel --audit --profile network or winsentinel --audit --profile identity.