---

name: windows-ps-security description: Use when hardening Windows systems via PowerShell — Windows Firewall (NetSecurity), Windows Defender/Microsoft Defender, BitLocker drive encryption, audit policy and event log analysis, local security policy, credential management (SecureString, Windows Credential Manager), AppLocker, Windows Update management, and security compliance scanning. Part of the windows-ps-* skill family. family: windows

Windows Security Administration via PowerShell

Companion skill to windows-powershell (parent). Focused on security hardening, compliance, and threat mitigation on Windows 10/11 and Windows Server 2019/2022/2025.

---

Reference Files

Detailed code examples, patterns, and configuration are in the reference files below. Read the relevant file when working on that area.

File	Covers
credentials-applocker-compliance.md	credential management, AppLocker, local security policy, Windows Update management, security compliance, network security, user account security, and the quick security audit script
firewall-defender-bitlocker-audit.md	Windows Firewall (NetSecurity), Windows Defender/Microsoft Defender, BitLocker drive encryption, and audit policy/event log analysis

---

---

Anti-Patterns

Anti-Pattern	Why It Fails	Correct Approach
Disabling UAC or Windows Defender for "convenience"	Removes primary defense layers; malware runs with full privileges; fails every security audit	Configure exclusions for specific paths/processes; use GPO to manage settings rather than disabling wholesale
Storing passwords in scripts as plain text	Scripts in SCM, shared drives, or backup tapes expose credentials; single compromise escalates to domain admin	Use Get-Credential, SecureString, or external vaults (Azure Key Vault, CyberArk); never hardcode credentials
Not enabling PowerShell ScriptBlock logging	No visibility into what scripts execute; incident response has no forensic trail; attackers operate undetected	Enable ScriptBlock and Module logging via GPO; forward to SIEM; essential for detecting encoded/obfuscated attacks
Using NTLM authentication instead of Kerberos	NTLM is vulnerable to relay attacks, pass-the-hash, and brute force; cannot use modern security features	Restrict NTLM via GPO (Network security: Restrict NTLM); audit NTLM usage first, then block progressively
Running PowerShell remoting without JEA (Just Enough Administration)	Full administrative sessions over WinRM; any command can be executed; no command-level access control	Configure JEA endpoints with role capabilities; limit available cmdlets and parameters per role

---

Related Skills

Skill	Scope
windows-powershell	Parent skill — core PowerShell syntax, modules, remoting, scripting patterns
windows-ps-server-admin	Windows Server roles (AD DS, DNS, DHCP, IIS, Hyper-V, clustering)
windows-cmd	Legacy CMD commands, batch scripting, low-level system tools