One command scans your Windows machine for firewall gaps, missing updates, weak accounts, exposed services, and dozens of other misconfigurations, then scores your posture out of 100. This page lists every command, option, and exit code — and all of it is free and unlimited on a single machine.
WinSentinel ships as a .NET global tool. If you have the .NET SDK, you are one command away.
# install (or upgrade) from NuGet
dotnet tool install --global WinSentinel.Cli
# run your first audit
winsentinel --audit
# check the version, then self-update from NuGet
winsentinel --version
winsentinel self-update # add --check to compare onlyInvoke everything as winsentinel <command> [options]. Run winsentinel --help any time for the built-in reference.
The everyday loop: scan, score, fix, re-check.
| Command | What it does |
|---|---|
--audit, -a | Run a full security audit and print color-coded results with per-module scores and remediation. |
--score, -s | Print the overall security score and letter grade only (fast, great for a status glance). |
--fix-all, -f | Run an audit and auto-fix every fixable finding, with elevation prompts where required. |
--status | Quick security posture dashboard from the last run — no new scan. |
--checklist | Generate a prioritized remediation checklist (fix-this-first ordering). |
--harden | Generate a reviewable PowerShell hardening script you can inspect before running. |
--summary | Executive, plain-English security brief suitable for a stakeholder. |
--threats | Build a STRIDE threat model from the current audit findings. |
--attack-paths | Kill-chain attack-path analysis with chokepoint detection. |
--version, -v | Show version info. Add --quiet or --json for CI / inventory use. |
--help, -h | Show the full built-in help. |
winsentinel --audit # full audit, colored output
winsentinel --score --quiet # score only, no formatting
winsentinel --audit --modules firewall,network # scan specific modules
winsentinel --fix-all # auto-fix everything fixable
winsentinel --checklist # prioritized fix planAny command that produces findings can render them in a machine- or human-friendly format, and be saved to a file.
| Option | Effect |
|---|---|
--json, -j | Output as JSON (machine-parseable) for scripting and pipelines. |
--html | Render a standalone HTML report. |
--markdown, --md | Render GitHub-flavored Markdown. |
--csv | Render CSV, one row per finding. |
-o, --output <file> | Write output to a file instead of stdout. |
--modules, -m <list> | Run only specific modules (comma-separated). |
--profile, -p <name> | Apply a compliance profile: home, developer, enterprise, or server. |
--quiet, -q | Minimal output (score + exit code only). |
--threshold, -t <n> | Exit non-zero if the score is below n (0–100) — the CI/CD gate. |
--show-ignored | Include suppressed findings in the audit output. |
winsentinel --audit --html -o report.html # save an HTML report
winsentinel --audit --markdown -o report.md # save Markdown
winsentinel --audit --json # JSON for scripting
winsentinel --audit --profile enterprise # apply a profile
winsentinel --audit --threshold 90 # CI/CD gate: fail if < 90Every scan is stored locally, so you can see what changed, where you are heading, and which findings never go away.
| Command | What it does |
|---|---|
--history | View past audit runs and score trends. Add --compare, --diff, --days <n>, or --limit <n>. |
--trend | Score trend analysis over time. Add --trend-days <n>, --alert-below <n>, --trend-modules. |
--forecast | Predict a future score from historical trend. Add --forecast-days <n> (max 365) or --forecast-weekly. |
--burndown | Findings burndown chart with a zero-date projection. Add --burndown-days, --burndown-severity. |
--age | Finding-age tracker: report / priority / chronic / new / resolved. |
--noise | Identify the noisiest finding sources across your audit history. |
--heatmap | GitHub-style calendar heatmap of your audit activity. |
--mission | Goal-oriented improvement plan. Add --mission-target <n> and --mission-phases <n>. |
winsentinel --history --diff # new / resolved since last run
winsentinel --history --compare # latest two runs side-by-side
winsentinel --trend --alert-below 80 # alert if score drops below 80
winsentinel --forecast --forecast-days 90 --forecast-weekly
winsentinel --age priority # what to fix firstSuppress accepted-risk findings so your score reflects reality, and snapshot a known-good state to detect drift.
| Command | What it does |
|---|---|
--ignore add <text> | Suppress findings matching text. Scope with --ignore-module, --ignore-severity, --ignore-reason, --match-mode (exact/contains/regex), --expire-days. |
--ignore list | Show all active ignore rules with their IDs. |
--ignore remove <id> | Remove a single ignore rule by ID. |
--ignore clear | Remove every ignore rule. |
--ignore purge | Remove only the expired ignore rules. |
--baseline save <name> | Save the current state as a named baseline. Add --desc "..." or --force to overwrite. |
--baseline list | List all saved baselines. |
--baseline check <name> | Compare the current posture against a saved baseline (drift detection). |
--baseline delete <name> | Delete a saved baseline. |
--tag | Manage finding tags & annotations: add / remove / list / search / report / autotag / rename / delete / export / import. |
winsentinel --ignore add "SMB" --ignore-reason "Accepted risk"
winsentinel --ignore add "^BitLocker" --match-mode regex
winsentinel --ignore add "test" --expire-days 30 # auto-expire in 30d
winsentinel --baseline save prod --desc "Golden image"
winsentinel --baseline check prod --json # drift as JSONMap every finding to the frameworks auditors ask about, and see how your score compares to your peer group. On a single machine this is entirely free — fleet-wide compliance rollups across many machines are the Pro tier.
| Command | What it does |
|---|---|
--profiles | List the available compliance profiles. |
--compliance | Map findings to frameworks: CIS, NIST, PCI-DSS, HIPAA, SOC 2, Essential 8. |
--compliance-framework <f> | Single framework: cis, nist, pci-dss, hipaa, soc2, essential8. |
--compliance-gaps | Show only failing / partial controls (gap analysis). |
--compliance-all | Show all frameworks in full detail. |
--benchmark | Compare your scores against peer-group benchmarks. |
--benchmark-group <g> | Peer group: home, developer, enterprise, server, or auto. |
--benchmark-all | Compare against all peer groups at once. |
winsentinel --compliance --compliance-framework cis
winsentinel --compliance --compliance-gaps # only what fails
winsentinel --benchmark --benchmark-group developer
winsentinel --benchmark-all --benchmark-format jsonSnapshot exactly what is installed and running — the raw material for a security review or an asset record.
| Command / option | What it does |
|---|---|
--inventory | Snapshot installed apps, services, listening ports, startup items, and scheduled tasks. |
--inventory-format <f> | Output format: text (default), json, markdown. |
--no-apps | Skip installed applications. |
--no-services | Skip Windows services. |
--no-ports | Skip listening ports. |
--no-startup | Skip startup programs. |
--no-tasks | Skip scheduled tasks. |
winsentinel --inventory # full snapshot
winsentinel --inventory --inventory-format json # as JSON
winsentinel --inventory --no-apps --no-tasks # ports/services/startup onlyShip findings to other tools. export is a first-class subcommand — SARIF makes it trivial to feed GitHub code scanning.
| Command | What it does |
|---|---|
export json | Export findings as JSON. |
export csv | Export findings as CSV (one row per finding). |
export sarif | Export SARIF for GitHub code scanning & other SAST viewers. |
export markdown | Export a GitHub-flavored Markdown report. |
-o, --output <file> | Write the export to a file instead of stdout. |
winsentinel export json -o findings.json
winsentinel export csv -o findings.csv
winsentinel export sarif -o results.sarif # upload to GitHub code scanning
winsentinel export markdown -o findings.mdKeep watching after the first scan. The monitor reacts to posture changes as they happen; scheduled scans run audits unattended. Both are free single-machine features — no license, no account.
monitor | Real-time watch |
|---|---|
monitor start | Start the real-time security monitor in the foreground. |
monitor stop | Stop the running monitor process. |
monitor status | Check whether the monitor is running. |
schedule | Unattended scans |
|---|---|
schedule create | Create or update a recurring scheduled scan. |
schedule status | Show the current schedule configuration. |
schedule results | List results from past scheduled scans. |
schedule remove | Remove the scheduled scan task. |
winsentinel monitor start # real-time posture watch
winsentinel monitor status # is it running?
winsentinel schedule create # set up a recurring scan
winsentinel schedule results # review unattended-scan resultsThe agent is a background daemon (or a Windows Service) that runs local scans on a schedule. It is free in standalone mode — no license required — giving you unattended auditing on a single machine. If you later add a Pro license, the same agent can also register with a central control plane and accept remote commands; that control plane is the Pro tier.
| Command | What it does |
|---|---|
agent start | Start the agent in the background. |
agent status | Show agent status and health. |
agent stop | Stop the running agent. |
agent install | Install the agent as a Windows Service. |
agent uninstall | Remove the Windows Service. |
Standalone agent mode needs no account. Registering agents into a managed fleet — the control plane, remote dispatch, and RBAC — is WinSentinel Pro.
Every command on this page runs unlimited on a single machine at no cost — full audits, one-click fixes, history, trends, compliance mapping, reports, the monitor, scheduled scans, and the standalone agent. There is no license gate on single-machine WinSentinel.
WinSentinel Pro begins where one machine ends. When you need to
manage many machines as a fleet — a central posture dashboard, remote scan/fix dispatch,
policy push, cross-node compliance rollups, drift alerts, and role-based access — that is the
winsentinel fleet commands and the control plane, and that is Pro.
Every run returns a process exit code, so you can gate a CI/CD pipeline on posture without parsing output.
| Code | Meaning |
|---|---|
0 | All checks pass (or score is at/above --threshold). |
1 | Warnings found (or score below --threshold). |
2 | Critical findings found (or a trend alert triggered). |
3 | An error occurred during execution. |
- name: WinSentinel audit gate
run: |
dotnet tool install --global WinSentinel.Cli
winsentinel --audit --threshold 90 # non-zero exit fails the jobTarget a subset of checks with --modules. Use these short names (comma-separated):
Each of these expands into many individual checks. See the full module catalog for every check WinSentinel runs.
Install the free CLI, run winsentinel --audit, and know your Windows security posture in seconds.