Do anyone know of a script that uses no third party executables (preferably a batch file) that can be used to audit windows machine state security wise? (including best practices features - gpo, services, shares, updates etc.) so one can run the script on a server/workstation and analyze the output elsewhere?

  • 1
    Is there any reason you can't use a third party set of tools? SCAP (security content automation protocol) is designed specifically to do this with various policies and benchmarks.
    – iivel
    Commented Nov 21, 2011 at 15:57
  • 1
    There is. It is supposed to serve us with auditing cliets off-site, and many of them are not eager to run a 3rd party tool on their production systems.
    – dalimama
    Commented Nov 21, 2011 at 17:58
  • Well, I can't think of anything solid out there other than MBSA for the moment, but it does look like MSFT and NIST are teaming up with some SCAP/OVAL cmdlets for powershell scap.nist.gov/events/2011/itsac/presentations/day2/… , services.nvd.nist.gov/jira/browse/SCAPDEV-1
    – iivel
    Commented Nov 22, 2011 at 15:39
  • 1
    @dalimama - I can sympathize with clients not being "eager to run a third-party tool on their production systems". However, you might want to keep in mind that even a script - especially one as complex as this task requires - can be considered a "third-party tool". Your clients may want a copy of the script for their IT folks to review prior to usage or, if they lack the expertise to review it, may still opt to disallow it altogether.
    – Iszi
    Commented Nov 22, 2011 at 22:10
  • I have exactly what you are looking for, uses no 3rd party stuff at all: github.com/HotCakeX/Harden-Windows-Security
    – SpyNet
    Commented Sep 28, 2023 at 11:17

2 Answers 2


No, not really. A script really doesn't have enough reach within a Windows environment to get all of the information you would need. PowerShell might be able to do it, but I would be surprised if such a script exists. +1 if there really is one.

With that being said, your best bet may be the Baseline Security Analyzer by Microsoft: http://technet.microsoft.com/en-us/security/cc184923. The nice thing about it is that it can be scripted, however parts of it need to be installed on the workstation.

  • I'm pretty sure a batch script could be used, if you can presume the presence of reg.exe on the system. I'm also fairly certain that PowerShell is more than capable of getting the information as well. The trick is knowing where to get it all, and writing the script so that it outputs only what you're looking for (and, ideally, flags policy violations).
    – Iszi
    Commented Nov 22, 2011 at 22:08
  • It's also worth noting that, while not technically "third-party", some clients may not want to install "additional" tools such as PowerShell on systems that don't already have it (i.e.: Windows XP/2003).
    – Iszi
    Commented Nov 22, 2011 at 22:14

Tenable Nessus Vulnerability scanner can be used as a compliance scanner to determine configurations that do not meet a particular standard including FDCC, Center for Internet Security, SCAP, DISA STIG, etc. Another tool that can be used for free is the Microsoft Security Compliance Manager. There are a lot more. Google those products first.

  • 2
    The op explicitly requested no 3rd party tools.
    – Rory Alsop
    Commented Dec 30, 2013 at 1:08

Not the answer you're looking for? Browse other questions tagged .