WinSentinel runs 40 security audit modules against a Windows machine — real Windows APIs and registry reads, not screenshots from a blog post. Every finding maps to a concrete setting, service, or key you can inspect yourself. The full set runs on a single machine for free, with no license gate.
PS> winsentinel --score Scanning 40 modules… ✓ Firewall OK ✓ Encryption OK ✓ Network 1 critical ✓ Identity & Credential 2 warnings ✓ Event Logs OK … Security score: 78 / 100
Who can log in, who is an admin, and how credentials are protected.
Checks local user accounts, admin membership, password policies, and guest account status.
Audits local admin sprawl, stale accounts, password-never-expires flags, LAPS deployment status, cached credential exposure, LSA Protection (RunAsPPL), WDigest cleartext credential caching, LM/NTLM authentication level (LmCompatibilityLevel, CIS L1 2.3.11.7), and Credential Guard.
Scans for stored credentials, exposed secrets, and credential storage misconfigurations.
Checks security-relevant Group Policy settings including account lockout, NTLM restrictions, audit policy, credential protection, SMB signing, and application whitelisting configuration.
Core OS posture: the settings attackers rely on you leaving at default.
Checks OS version, Secure Boot, BitLocker, UAC level, and RDP configuration.
Checks registry-based security policies including UAC, Remote Desktop, credential storage, LSASS protection, scripting hosts, and persistence mechanisms.
Checks Windows Defender status, real-time protection, and antivirus definition freshness.
Checks Windows Update status, pending updates, and last install date.
Checks Windows Firewall profile states (Domain/Private/Public), per-profile dropped-packet logging (CIS L1), the default inbound policy, the inbound allow-rule surface, and over-permissive wide-open inbound rules that let any program accept connections from any address on any port.
Checks UAC enablement, the admin elevation-prompt behaviour, secure-desktop prompting, Admin Approval Mode for the built-in Administrator, installer detection, and the remote UAC token-filtering override (Pass-the-Hash enabler) against CIS Windows L1.
Checks application allowlisting - AppLocker rule collections and enforcement (Exe/Msi/Script/Dll/Appx), the Application Identity service, WDAC/Code Integrity policy, and Smart App Control - against Essential 8 #1 and CIS Windows L1.
Checks system-wide exploit mitigations - SEHOP (exception-chain validation), mandatory image relocation (ASLR / MoveImages), the machine-wide process MitigationOptions policy, and the DEP/NX boot policy - all foundational memory-corruption defenses on a single machine.
Your exposed attack surface: open ports, shares, and remote entry points.
Checks open ports, listening services, SMB/RDP exposure, SMB signing and encryption (EncryptData) enforcement, IPv6, Wi-Fi security, network profile, LLMNR/NetBIOS/WPAD/mDNS, ICMP redirect acceptance, IPv4 source routing, and ARP anomalies.
Checks DNS server configuration, DNS-over-HTTPS status, LLMNR/NetBIOS exposure, hosts file integrity, and cache settings.
Checks SMB protocol versions, server- and client-side signing enforcement (NTLM relay exposure), share permissions, null session access, encryption status, and hidden share exposure.
Checks RDP settings (NLA, encryption, TLS layer, device redirection for drives/clipboard/printers/COM-LPT/Plug-and-Play, session shadowing, and password prompt on connect), SSH exposure (password auth, root login, TCP port forwarding and GatewayPorts tunneling/pivot exposure), third-party remote tools, WinRM hardening (unencrypted traffic, Basic auth, CredSSP credential delegation, wildcard TrustedHosts, unrestricted listeners), Remote Registry, and Remote Assistance for security risks.
Checks saved WiFi profiles for weak encryption, auto-connect risks, password exposure, MAC randomization, and network privacy settings.
Checks Bluetooth radio state, discoverability, paired device trust, exposed services, authentication settings, and legacy pairing risks.
What is running, what loaded it, and whether any of it is suspicious.
Checks running processes for unsigned executables, suspicious locations, and known risks.
Analyzes parent-child process relationships to detect suspicious execution chains, LOLBin abuse, and living-off-the-land techniques.
Checks Windows services for unquoted paths, excessive privileges, suspicious binaries, disabled security services, and configuration risks.
Checks scheduled tasks for suspicious executables, elevated privileges, persistence mechanisms, encoded commands, and missing binaries.
Checks startup items, scheduled tasks, and registry run keys for persistence mechanisms.
Scans installed programs for unsigned executables, outdated software, suspicious install locations, and potentially unwanted programs.
Detects outdated, end-of-life, and insecure software by scanning installed programs against known-safe minimum versions, flagging EOL products, suspicious installs, duplicate x86/x64 installations, MSIX/AppX sideloading & developer-mode posture, and installed remote-access/RMM tools (AnyDesk, TeamViewer, ScreenConnect, RustDesk, ...) that are a common attacker foothold (MITRE ATT&CK T1219).
Checks installed browsers (Chrome, Edge, Firefox), versions, extensions, saved passwords, auto-update, Safe Browsing, SmartScreen, and security settings.
Checks loaded drivers for unsigned binaries, known vulnerable driver hashes (BYOVD), suspicious load paths, revoked certificates, and driver age risks.
Checks PowerShell execution policy, script block/module logging, transcription, language mode, the legacy v2 engine, AMSI status (including the AmsiEnable=0 registry kill switch), and WinRM remoting exposure (unencrypted transport, Basic and CredSSP authentication). Scans profile.ps1 scripts for tampering: download cradles, AMSI bypasses, WMI event-subscription and scheduled-task persistence, Mimikatz credential dumping, and mshta/regsvr32/rundll32 LOLBin execution. Flags the persisted __PSLockdownPolicy environment variable, a Constrained Language Mode bypass that forces FullLanguage ahead of WDAC/AppLocker enforcement (MITRE T1562.001).
Encryption at rest, certificate hygiene, backups, and removable media.
Checks BitLocker status, TPM availability, EFS usage, certificate store health, TLS/SSL configuration, Credential Guard, DPAPI protection, and Kernel DMA Protection (blocks drive-by DMA / evil-maid attacks from malicious PCIe / Thunderbolt / USB4 peripherals), and Diffie-Hellman key-exchange strength (flags weak <2048-bit DH primes vulnerable to Logjam).
Checks Windows certificate stores for expired, weak, or untrusted certificates.
Checks Volume Shadow Copy, System Restore, File History, backup recency, and ransomware resilience posture.
Checks USB device history, autorun/autoplay settings, BitLocker-to-Go coverage, USB write-protect policies, and WPD/MTP portable-device restrictions (phones, cameras, media players that transfer files outside USBSTOR) for removable storage.
Checks telemetry level, location tracking, advertising ID, diagnostic data, clipboard sync, and activity history.
Evidence of compromise and the virtualization layers attackers hide in.
Analyzes Windows Event Logs for failed logins, successful remote logons from external IPs (exposed RDP/network), account lockouts, privilege escalation, suspicious PowerShell, audit policy gaps, service installations, log tampering, and Defender events.
Checks Hyper-V, WSL, Windows Sandbox, Docker, and virtualization-based security features for misconfigurations and exposure risks.
Checks PATH hijacking risks, secrets in environment variables, proxy configuration, and dangerous PATHEXT/TEMP settings.
Checks Windows Error Reporting upload posture (additional in-memory data, automatic consent level), local crash-dump writing (WER LocalDumps and full-dump type), and whether WER is disabled - all data exposure / credential-harvesting surfaces on a single machine.
Checks single-machine Windows time-synchronization security - the Windows Time service (W32Time) state, the sync source type (NTP / NT5DS / NoSync), the NTP peer relative to the machine’s domain role, and whether clock phase-correction caps are bounded - because accurate time underpins Kerberos auth, certificate validity, and log correlation.
Checks single-machine Windows interactive-logon policy hardening - whether a pre-logon legal-notice banner is configured (LegalNoticeCaption / LegalNoticeText) and, when smart-card logon is in use, whether removing the card locks or logs off the session (ScRemoveOption) - CIS L1 interactive-logon controls.
Checks single-machine Windows Automatic Restart Sign-On (ARSO) and sign-in-screen hardening - whether ARSO is disabled (DisableAutomaticRestartSignOn) so the machine does not silently re-establish the last user’s session after an update reboot, and whether the sign-in screen is blocked from displaying account details (BlockUserFromShowingAccountDetailsOnSignin) - CIS L1 interactive-logon controls.
There is no “lite” tier. Every module on this page runs on your machine for free, forever — along with the real-time monitor, scheduled scans, one-click fixes, score history, and PDF/HTML/SARIF export. WinSentinel Pro does not add more checks; it takes these same agents and gives an organisation a control plane — run every module across a whole fleet from one place, with drift alerts, compliance rollups, and RBAC.
WinSentinel ships as a .NET global tool. Audit your machine in under a minute.