Security Hardening
🎣 Advanced Phishing Protection
4 settings↓ JSON
SmartScreen warns when a user types credentials into a phishing page or stores them somewhere dumb.
service enablednotify malicious sitenotify password reusenotify unsafe storage
⌨️ Disable Win+R
1 setting↓ JSON
Kills the Run dialog to block ClickFix and paste-and-run social engineering attacks.
Run dialog disabled
📜 Script File Associations
1 setting↓ JSON
.bat, .js, .vbs, .ps1, .hta and a dozen more open in Notepad instead of executing on double click.
17 script types → Notepad
🛡️ Endpoint Security Baseline
34 settings↓ JSON
General device hardening: UAC, autoplay, account lockdown, logging, and the usual suspects.
UAC hardeningautoplay/autorun offadmin + guest accounts disabledanonymous SAM enumeration blockedPS script block loggingDMA protectionremote assistance offnetwork bridge blocked+26 more
🚫 Disable Insecure Protocols
37 settings↓ JSON
Legacy and insecure protocols shut off across the board. SMBv1 belongs in a museum.
SMBv1 offSMB signing requiredinsecure guest logons offNTLMv2 min session securityLM hash storage offWinRM basic auth offWinRM unencrypted traffic offCredSSP encryption oracle fixmulticast DNS off+28 more
🔑 Disable Edge Password Manager
1 setting↓ JSON
Turns off the built-in password manager so no new credentials get stored. Existing passwords stay available until deleted, so users don't scream.
password manager disabled
📵 Disable Phone Link
1 setting↓ JSON
Blocks Phone Link to help prevent data exfiltration to personal phones.
phone-PC linking blocked
🔒 Lock Screen
11 settings↓ JSON
Locks down what is visible and usable from the lock screen.
camera blockedslideshow blockedno app notificationsno toasts above lockno Cortana above lockno voice apps above lockdisplay timeoutspassword reveal offpassword requiredAAD password reset
Device & User Experience
🌍 Auto Timezone
3 settings↓ JSON
Detects timezone via location services and updates the device automatically.
NTP client enabledNTP client configuredusers can change timezone
🌐 Edge Auto Logon
8 settings↓ JSON
Forces the work profile and controls what syncs.
browser sign-in forcedimplicit sign-innon-removable profileno extra profilesno ephemeral profilesforced syncno first-run importAAD site SSO
☁️ OneDrive Settings
15 settings↓ JSON
Locks OneDrive to your tenant, signs users in silently, and moves their folders before they notice.
silent account configKFM no wizardKFM opt-out blockedFiles On-Demandpersonal sync blockedtenant allow listauto startupdate ringsync admin reports+6 more
✨ User Experience
10 settings↓ JSON
Windows stops trying to sell you things.
Spotlight offWindows Tips offchat icon offcloud optimized content offBing web results offcloud search offnews & interests offorg messages