# HardeningKitty Windows auditing and hardening

> HardeningKitty is a PowerShell module that audits and changes Windows configuration through finding lists, registry reads, CSV reports, and logs. It fits administrators who need repeatable policy checks, but its English-system assumption and direct configuration changes require careful scope.

**scipag/HardeningKitty** — HardeningKitty - Checks and hardens your Windows configuration

- Repository: https://github.com/scipag/HardeningKitty
- Stars: 1,869 · Forks: 220
- Language: PowerShell
- License: MIT
- Published: 2026-10-16 · Updated: 2026-10-16 · Language: en
- Canonical page: https://hysenlabs.com/projects/scipag-hardeningkitty

## The Windows configuration problem HardeningKitty addresses

HardeningKitty addresses the problem of assessing whether a Windows computer matches a defined configuration baseline. It can report deviations and change settings to predefined values, which makes it relevant to administrators, blue-team practitioners, and operators responsible for Windows hardening checklists. Its scope includes machine settings rather than application configuration or general source-code security.

The repository presents itself as the stable version of the Windows Hardening Project by Michael Schneider. The README says this stable version is signed with the code signing certificate of sci AG. It also says pull requests are not accepted in this repository and directs proposed changes to the development repository at `0x6d69636b/windows_hardening`.

Checks are organized through a finding list. For each applicable item, HardeningKitty retrieves the current configuration, compares it with a recommended value, and records the result and severity. The sample output includes account lockout settings, reversible password encryption, network access rights, printer driver restrictions, LSA protection, and Lsass audit mode. A completed run also produces an aggregate score and totals for passed, low, medium, and high findings.

This is a PowerShell module for Windows, not a cross-platform endpoint security product. Its usefulness depends on the operator selecting suitable checks and understanding what each change means. A passing or failing result is meaningful only in the context of the finding list, Windows edition, current policy, and organizational requirements.

## Finding lists, registry reads, and report generation

HardeningKitty reads Windows settings from the registry and uses other modules for configuration outside the registry. The finding list supplies the checks and recommended values. This arrangement keeps the audit criteria data-driven and allows a run to use either the default list or a list selected through `FileFindingList`.

The default execution mode is audit. According to the README, an audit saves results to a CSV file and can also create a log file. Both outputs normally receive automatic names and timestamps, while `ReportFile` and `LogFile` can supply explicit destinations. The report is therefore the main record for review, storage, or comparison after execution.

Filtering happens inside PowerShell through a ScriptBlock. The documented fields are ID, Category, Name, Method, and Severity. A filter can reduce the run to a particular control or severity level. The README gives `{ $_.Severity -eq "Medium" }` as an example for checking only medium-severity findings.

The config mode performs a different task. It retrieves current settings and, when a setting has not been configured, substitutes a default value stored in the finding list. The README says config can be combined with other functions, including backup creation. The repository layout contains `HardeningKitty.psm1`, `HardeningKitty.psd1`, and the `lists` directory, so the module and its finding data must be copied together.

## Installing HardeningKitty as a PowerShell module

The following commands create the module directory. Run them from a directory containing the downloaded repository files, in a PowerShell session that can write under `$Env:ProgramFiles`.

```powershell
$Version = "0.9.3"
New-Item -Path $Env:ProgramFiles\WindowsPowerShell\Modules\HardeningKitty\$Version -ItemType Directory
Copy-Item -Path .\HardeningKitty.psd1,.\HardeningKitty.psm1,.\lists\ -Destination $Env:ProgramFiles\WindowsPowerShell\Modules\HardeningKitty\$Version\ -Recurse
```

After a successful copy, the versioned directory should contain `HardeningKitty.psm1`, `HardeningKitty.psd1`, and `lists`. For a first audit, import the copied implementation and invoke the module in audit mode with logging and reporting enabled.

```powershell
Import-Module "$Env:ProgramFiles\WindowsPowerShell\Modules\HardeningKitty\$Version\HardeningKitty.psm1"
Invoke-HardeningKitty -Mode Audit -Log -Report
```

The README says administrative privileges are needed to access machine settings. It recommends using a normal user account for user settings and suggests the account used for daily work. The command should generate timestamped CSV and log files, while the console lists individual findings and the final score.

## Running focused HardeningKitty checks

A useful first follow-up is to narrow an audit before reviewing the complete output. The `Filter` parameter evaluates fields in the finding list, so it can select a severity class or a single ID. This avoids mixing unrelated results with a focused policy review.

This command uses the default finding list and checks only items whose severity is `Medium`.

```powershell
Invoke-HardeningKitty -Filter { $_.Severity -eq "Medium" }
```

HardeningKitty can also load a particular CSV list and omit machine information. The README presents that option for repeated runs on the same machine or when machine details should not be included in the report.

```powershell
Invoke-HardeningKitty -FileFindingList .\lists\finding_list_0x6d69636b_user.csv -SkipMachineInformation
```

For a report with an explicit path, config mode retrieves current settings and writes them to the specified CSV file.

```powershell
Invoke-HardeningKitty -Mode Config -Report -ReportFile C:\tmp\my_hardeningkitty_report.csv
```

The visible README excerpt does not show a complete command for applying hardening changes. That omission matters. Administrators should not infer the precise remediation syntax from the audit examples alone. The README states that the system can be hardened according to predefined values, but its documented installation and execution examples focus on audit and config operations.

## HardeningKitty language, privilege, and policy constraints

The clearest limitation is language-related. The README says the script was developed for English systems and warns that analysis may be incorrect on systems using other languages. It asks users to create an issue if this occurs. That warning matters because HardeningKitty was developed for English systems, so its analysis may be incorrect in other languages.

Privilege is another constraint. Machine settings require administrative privileges, while user settings are better evaluated under a normal user account. HardeningKitty therefore does not represent every result equally across account contexts. An administrator-only invocation may expose machine controls that are not visible or applicable to the daily user account.

The README does not document a complete rollback procedure. Audit and config output can support later investigation, and the README associates config mode with backup creation, but it does not explain how an administrator should reverse every applied setting. Operators should retain their existing change-management process and verify the selected finding list before applying modifications.

The score should not be treated as a complete security assessment. HardeningKitty evaluates controls represented in its finding lists. It does not document vulnerability scanning, patch management, identity governance, application hardening, logging review, or endpoint monitoring as functions of this project. Those subjects may be essential to a Windows program, but the repository describes a configuration audit and hardening module.

## HardeningKitty versus centralized policy management

HardeningKitty's practical alternative is a centralized Windows policy management approach that distributes policies through mechanisms such as Group Policy. The difference is architectural. HardeningKitty runs as a PowerShell module on an individual machine, retrieves configuration, compares it with a finding list, and can produce local CSV and log output. A centralized policy system instead manages policy definitions and propagates them across an organization, reducing dependence on an administrator running a local script against each host.

The two approaches can cover overlapping settings, but their operating models differ. HardeningKitty is useful for inspection, local evidence, finding-level filtering, and systems where the administrator needs an explicit PowerShell run. A centralized policy management approach may be a better fit when policy ownership and organization-wide distribution are priorities. That distinction reflects the documented architecture, not a claim that HardeningKitty cannot be used alongside Group Policy.

HardeningKitty also differs from a general security scanner. The repository describes checks against predefined finding-list values, with registry and module-based retrieval, rather than vulnerability detection through a vulnerability database. Its reports are configuration assessment records. They should not be interpreted as proof that the host has no exploitable software vulnerabilities.

## HardeningKitty maintenance, licensing, and upgrade handling

The repository is not archived. Its last push was on 2026-07-21, and the latest listed release is `v.0.9.4`, dated 2026-07-21. The earlier listed releases are `v.0.9.3` from 2024-12-23 and `v.0.9.2` from 2023-12-04. These dates show recent repository activity, but the README does not promise a release schedule or describe a compatibility policy for every Windows release.

An upgrade involves more than replacing one script. The repository requires `HardeningKitty.psm1`, `HardeningKitty.psd1`, and the complete `lists` directory. The manual installation procedure places these files in a version-specific module directory. Keeping versions separate avoids overwriting an existing module installation and makes the deployed version identifiable.

The README also provides an automatic installer that queries the latest release from `0x6d69636b/windows_hardening`, downloads a ZIP archive, extracts it, copies the required components, and imports the module. The README does not describe signature verification for that downloaded archive, so operators should account for that omission in internal acquisition controls.

HardeningKitty uses the MIT license. The license permits use, modification, distribution, and sublicense subject to its conditions, including preservation of the copyright and license notice. This is a statement about the repository's licensing model, not legal advice for a particular deployment.

## Conclusion

HardeningKitty is appropriate for Windows administrators who need a finding-list-driven PowerShell audit and already understand the policy changes being applied. It is less suitable for environments requiring a documented localized baseline, centralized policy orchestration, or continuous monitoring. Verify first that the target Windows installation is compatible, review the selected finding list, and inspect the generated CSV and log before treating any result as authoritative.

## FAQ

### What operating system and account does HardeningKitty require?

HardeningKitty is designed for Windows and is executed through PowerShell. The README says machine settings require administrative privileges, while user settings are better checked with a normal user account, ideally the account used for daily work.

### How do I install HardeningKitty from a downloaded release?

Create a versioned directory under a path in `PSModulePath`, then copy `HardeningKitty.psd1`, `HardeningKitty.psm1`, and the `lists` directory into it. The README provides PowerShell commands using `$Env:ProgramFiles\WindowsPowerShell\Modules`.

### Can HardeningKitty filter or export Windows audit results?

Yes. Audit mode saves results to CSV and can create a log file. The `Filter` parameter can select finding-list fields such as ID or Severity, while `ReportFile` and `LogFile` can set explicit output paths.

## Sources

- [Issues](https://github.com/scipag/HardeningKitty/issues)
- [License: MIT](https://github.com/scipag/HardeningKitty/blob/master/LICENSE)
- [README](https://github.com/scipag/HardeningKitty/blob/master/README.md)
- [Releases](https://github.com/scipag/HardeningKitty/releases)
- [scipag/HardeningKitty on GitHub](https://github.com/scipag/HardeningKitty)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/scipag-hardeningkitty