Windows Security Audit: Hardening & Compliance Check

WINDOWS

The Challenge

Ensuring the security posture of Windows endpoints across a distributed fleet is a constant battle. IT administrators often struggle to verify if basic hardening controls—like Windows Defender, Firewall profiles, and BitLocker encryption—are actually active and functioning correctly. Shadow IT and unauthorized local administrators further complicate the landscape, leaving devices vulnerable to ransomware and data theft.

The goal was to perform a non-intrusive, read-only audit to:

Verify the operational status of Windows Defender and Real-Time Protection
Confirm that BitLocker is fully encrypting the boot drive
Identify all users with local Administrative privileges
Detect any unsigned or suspicious startup programs

The Prompt Sent to Myrmex

Using the Myrmex Agent (Perseus) installed on the target device, we sent:

Audit the current Windows security posture by checking the status of Windows Defender,
Firewall profiles, and BitLocker encryption on all drives.
List all local users with Administrative privileges and identify any startup programs
that are unsigned. Provide a summary of the system’s hardening state without applying any changes.

Note: Myrmex acts as a security auditor, querying WMI classes (like Win32_BitLockerVolume and Root\SecurityCenter2) and system registries to build a comprehensive health report.

What Myrmex Did

Myrmex executed a multi-vector security audit on the endpoint DEMO-WIN11.

Security Audit Report: DEMO-WIN11

Category	Status	Details
Windows Defender	✅ Secure	Active with Real-Time Protection enabled (v4.18.26010.5).
Firewall	✅ Active	All profiles (Domain, Private, Public) are enabled.
BitLocker	✅ Encrypted	Drive `C:` is 100% encrypted with protection active.
Privileged Access	⚠️ Review	2 Administrative accounts identified.
Persistence	✅ Verified	No unsigned startup programs detected.

Technical Findings

1. Endpoint Protection

Myrmex verified that the Antimalware Service was operational and signatures were up to date (Version: 1.443.1118.0). Crucially, it confirmed that all three Firewall profiles (Domain, Private, Public) were strictly enabled, unauthorized inbound traffic is blocked.

2. Data Protection (BitLocker)

The audit confirmed Volume C: is 100% encrypted. This is a critical compliance check for HIPAA and GDPR, ensuring data remains inaccessible even if the laptop is physically stolen.

3. Identity & Access Management

Two users were found in the local Administrators group:

LAPTOP-HTFLDVV6\Administrador (Built-in)
LAPTOP-HTFLDVV6\ANX-NB04 (Local User)

Risk: The user ANX-NB04 having permanent admin rights violates the Principle of Least Privilege (PoLP).

4. Persistence Analysis

A scan of Win32_StartupCommand verified that all auto-start binaries, such as SecurityHealthSystray.exe, had valid digital signatures. No persistence mechanisms for malware were found.

Benefits of the Approach

🛡️ Automated Hardening Verification

Instead of manually checking Control Panel or Group Policy settings on every machine, Myrmex provides a "green check" snapshot of the actual device state.

🕵️ Shadow Admin Detection

Instantly highlighting which local users have Admin rights allows IT to revoke unnecessary privileges, reducing the attack surface for lateral movement.

🔒 Compliance Evidence

The report serves as proof of encryption and protection for compliance audits (ISO 27001, SOC2).

Result

With Myrmex analysis:

✅ Validated Hardening: Confirmed Defender and Firewall are protecting the OS.
✅ Data Safety: Verified BitLocker encryption on the main drive.
✅ Actionable Insight: Identified a specific user (ANX-NB04) for privilege reduction.

Prompt Variations

The same pattern can be used for deep-dive investigations:

For software inventory:

List all installed applications on the Windows device.
Flag any software that has not been updated in the last 6 months.

For USB auditing:

Retrieve the history of all USB mass storage devices connected
to this machine in the last 30 days.