[Blackwellcode]

Summary

Carries over the read-only parts of the original manual audit (2026-11-09) that winsec-audit did not cover. Its hardening, rollback and update modes write to the system and are not part of this PR.

 Defender
+  DEF-09 Email/removable drive scanning, CloudExtendedTimeout >= 50 s   (Low, 2)
 Network
-  NET-01 SMBv1 server disabled
+  NET-01 SMBv1 disabled (+ SMB1Protocol feature when elevated)         (High, 6; SMBv1 scored only here)
+  NET-08 Point and Print: drivers by administrators only              (High, 3)   PrintNightmare
+  NET-09 Legacy Telnet and TFTP clients removed                        (Low, 2, elevated; EnablePending = on)
 Logging
+  LOG-04 Security/PowerShell/Defender log sizes                        (Low, 2; unreadable/absent -> Info)
+  LOG-05 Process creation auditing (event 4688 recorded)               (Medium, 3, elevated)

LOG-05 needs elevation: unelevated, a Security log query for 4688 returns NoMatchingEventsFound (not access denied). The audit policy is not read (no auditpol.exe, native allowlist unchanged); a recorded event is the evidence. Its limits are stated in the finding: a switch-off within the last 24 h is not detectable, and Retain log mode warns.

No Pass from unreadable data:

-try { MpStatus = Get-MpComputerStatus; MpPref = Get-MpPreference }   # MpPref $null, MpStatus set
+try { MpStatus = Get-MpComputerStatus }
+try { MpPref = Get-MpPreference }
-Assert-Defender                       # checked MpStatus only
+Assert-Defender -Preference           # DEF-04/05/06/09
-[int]$status.QuickScanAge             # $null -> 0 -> Pass
+[int](Get-DefenderValue $status 'QuickScanAge')   # $null -> Error (DEF-02/03/04/09)

Separate commit 70d6933: $PSScriptRoot param defaults moved into the script body. With [CmdletBinding()], Windows PowerShell 5.1 leaves $PSScriptRoot empty while evaluating param defaults under powershell -File, so the README quick start powershell -ExecutionPolicy Bypass -File .\winsec-audit.ps1 failed with a Join-Path error.

Evidence

• New test Test-DefenderUnavailable.ps1 (shadows Get-MpPreference → throws, Get-MpComputerStatus → ages $null):
  • Before (script from d21950f): DEF-02 Pass, DEF-03 Pass, DEF-09 Pass (expected Error), exit 1
  • After: DEF-02/03/04/05/09 Error, DEF-06 Skipped (unelevated), none as Pass, exit 0
• powershell -File, PS 5.1:
  • Before: Test-ReadOnly.ps1 and winsec-audit.ps1 both exit 1 (Join-Path ... leere Zeichenfolge)
  • After: guard Read-only guard passed, exit 0; audit exit 0, report.json and report.md written
• Local run, unelevated: Test-ReadOnly exit 0; Test-GuardSelf 32 sample(s), exit 0; Test-Smoke Checks 49, score 84, fingerprint 85269D8A3C824F3D, system state unchanged, exit 0
• CI (runs 43241092263, 43241104828, 70d6933): runner Elevated: True, so NET-01 feature, NET-09, LOG-05 and DEF-06 ran; smoke Checks 49 with 0 Error results in both shells; guard via powershell -File passed; Defender test 6/6 incl. DEF-06 Error.

Merge Danger

Door: two-way

Additive checks, stricter error handling, extra tests; each commit reverts on its own.

Blast Radius: score

Report scores shift: five weighted checks are added (12 weight points), and Defender checks that used to Pass on unreadable data now end as Error (not scored). NET-01's title changes to "SMBv1 disabled". No change to the read-only guard rules or the native allowlist.

🤖 Generated with Claude Code