Windows security assessment tooling for MSPs, consultants, and internal administrators. The production artifact is NetworkSecurityAudit.ps1, a single-file PowerShell 5.1 tool with 69 automated checks, 11 compliance frameworks, MITRE ATT&CK and MITRE D3FEND mappings, multi-tier reports, and RMM-friendly headless deployment.
The repo also contains an active .NET 10/WPF C# rewrite under src/NetworkSecurityAuditor. The rewrite is locally buildable and test-covered, but the PowerShell script remains the production path for workflows not yet ported to C#.
The C# workstation uses a resizable checks-and-inspector layout, live environment readiness, neutral unscanned posture states, accessible focus treatment, assessment save-status feedback, and a persistent activity console. Scans remain disabled until environment detection and pre-flight checks finish.
Most security audit tools are either expensive commercial platforms that require agents and infrastructure, or basic scripts that check a handful of settings and dump text to a console. There's nothing in between for the IT professional who needs to walk into any environment — a 5-person office, a healthcare clinic, a 500-seat enterprise — and produce a professional, evidence-backed security assessment in under an hour.
This tool fills that gap. It auto-detects the environment, runs every check it can, skips what doesn't apply, scores the results against real compliance frameworks, and generates reports suitable for executives, IT managers, and technical staff. It runs silently via RMM for scheduled fleet assessments or interactively through a polished GUI for on-site audits.
Download NetworkSecurityAudit.ps1
Download without executing immediately, then inspect and run it:
$uri = "https://github.com/SysAdminDoc/Network_Security_Auditor/releases/latest/download/NetworkSecurityAudit.ps1"
Invoke-WebRequest -Uri $uri -OutFile .\NetworkSecurityAudit.ps1 -UseBasicParsing
Get-FileHash .\NetworkSecurityAudit.ps1 -Algorithm SHA256
Get-AuthenticodeSignature .\NetworkSecurityAudit.ps1
notepad .\NetworkSecurityAudit.ps1
.\NetworkSecurityAudit.ps1# Right-click → Run with PowerShell, or:
.\NetworkSecurityAudit.ps1The tool auto-elevates to admin, detects your environment (domain/workgroup/hybrid), and launches the GUI. Click Scan All to run every applicable check.
# Full scan, all exports, silent
.\NetworkSecurityAudit.ps1 -Silent -ScanProfile Full
# Quick triage, executive report only
.\NetworkSecurityAudit.ps1 -Silent -ScanProfile Quick -ReportTier Executive
# HIPAA compliance scan with custom output path
.\NetworkSecurityAudit.ps1 -Silent -ScanProfile HIPAA -OutputPath "C:\Reports\audit.html"
# Full scan with all export formats
.\NetworkSecurityAudit.ps1 -Silent -ExportJSON -ExportCSV -ExportJSONLThe C# rewrite is built and validated locally. It is useful for testing the new WPF/MVVM architecture and exporters, but it does not yet replace every PowerShell MSP workflow.
dotnet restore .\NetworkSecurityAuditor.slnx
dotnet test .\NetworkSecurityAuditor.slnx --no-restore
dotnet build .\NetworkSecurityAuditor.slnx --no-restore
dotnet publish .\src\NetworkSecurityAuditor\NetworkSecurityAuditor.csproj -c Release -o .\publish\NetworkSecurityAuditor --no-restoreRun the C# GUI:
dotnet run --project .\src\NetworkSecurityAuditorThe C# GUI export panel writes the selected format to one output folder and includes SIEM content packs, CMMC HTML/JSON self-assessment exports, and OSCAL POA&M remediation exports.
Run the C# silent mode:
.\publish\NetworkSecurityAuditor\NetworkSecurityAuditor.exe --silent --profile Full --output C:\Reports
.\publish\NetworkSecurityAuditor\NetworkSecurityAuditor.exe --silent --profile Full --output C:\Reports --export-oscal-poam
.\publish\NetworkSecurityAuditor\NetworkSecurityAuditor.exe --silent --profile Full --output C:\Reports --intune-stig-import C:\Exports\stig-audit.json --export-oscal --export-csvUse Start-Process -Wait -PassThru when automating C# headless runs from
PowerShell so Windows reports the WPF executable's exit code. Missing dashboard
input folders return 64, and scans with no applicable/scorable checks return
65 instead of a security-alert exit code. Malformed or unknown headless
arguments are written as warnings rather than consuming the next switch as a
value. --output is treated as an output directory; if a file-looking value such
as C:\Reports\audit.html is supplied, the C# rewrite writes its artifact set to
that file's parent folder.
Build the local C# installable artifact:
.\tools\Publish-CSharpRelease.ps1The release tool cleans artifacts/csharp-release, runs the xUnit suite,
publishes the C# rewrite, signs .exe/.dll files when a local code-signing
certificate is available, then writes
artifacts/csharp-release/release/NetworkSecurityAuditor-csharp-v<version>-windows-net10.zip,
a CycloneDX SBOM (*.cdx.json), SHA256SUMS.txt, and
release-manifest.json with package inventory and runtime support metadata.
Users install the C# preview by unzipping that package on Windows with the .NET 10 Desktop Runtime installed and running NetworkSecurityAuditor.exe.
Roll up many scans into one static HTML dashboard (no server, no scan, no host
changes). Point it at a folder of *_findings.json exports collected from your
fleet or RMM output share:
# Build a dashboard from a folder of findings exports
.\NetworkSecurityAudit.ps1 -Dashboard -InputDir "C:\MSP\ScanArchive" -OutputPath "C:\MSP\dashboard.html"
# Flag scans older than 14 days as stale
.\NetworkSecurityAudit.ps1 -Dashboard -InputDir "C:\MSP\ScanArchive" -StaleDays 14The dashboard shows each client's latest grade/score, ransomware readiness, critical-finding count, compliance-framework coverage, a per-client score trend, and a stale-scan flag, with a critical-findings-by-category rollup. It links back to each client's individual HTML report when one sits next to its JSON, writes a companion CSV, and embeds only aggregate scores — never finding evidence or notes.
Run the same scan on a schedule and the tool tracks change over time. Each silent
run writes a compact snapshot, compares it to the previous baseline, and records a
run summary to history.jsonl:
# Recurring scan with history (delta vs. the last run is computed automatically)
.\NetworkSecurityAudit.ps1 -Silent -ScanProfile Full -HistoryPath "C:\MSP\Acme\history"
# Preview the delta alert/webhook payload without sending anything
.\NetworkSecurityAudit.ps1 -Silent -HistoryPath "C:\MSP\Acme\history" -AlertPreviewEach run reports new/resolved/worsened/improved findings, new and resolved
criticals, a score delta, and a critical-finding exposure window (how long each
critical has been failing). The HTML report gains a "Change Since Baseline"
section, the findings JSON gains a continuous block (delta, exposure, and a
preview alert payload), and RMM fields gain ScoreDelta, NewCriticals,
ResolvedCriticals, WorstExposureDays, and BaselineAgeDays. The GUI Diff
button uses the same comparison engine and writes a *_delta.json. Snapshots are
pruned past -HistoryRetentionDays; -NoHistory turns the whole feature off.
Every check runs in an isolated runspace with timeout protection. Results include findings text, evidence collection, severity rating, and compliance mapping.
Identity & Access (12 checks)
| ID | Check | Severity |
|---|---|---|
| IA01 | Privileged Groups + Delegation | Critical |
| IA02 | Service Accounts + Kerberoast Risk | Critical |
| IA03 | Local MFA / Strong Auth Signals | Critical |
| IA04 | Terminated Employee Accounts | Critical |
| IA05 | Password Policy | High |
| IA06 | PAM / Privileged Access (LAPS) | High |
| IA07 | Shared/Generic Accounts | Medium |
| IA08 | Guest/Vendor Account Lifecycle | Medium |
| IA09 | Remote Access / RMM Exposure | Medium |
| IA10 | Stale/Inactive Accounts (90+ days) | High |
| IA11 | Kerberos RC4/DES Deprecation Readiness | High |
| IA12 | BadSuccessor / dMSA Privilege Escalation Exposure | Critical |
IA03 and IA09 are local/remote-access indicator checks. They do not prove
tenant-wide Entra MFA or Conditional Access policy coverage; use cloud assessment
imports or future Graph-backed checks for tenant proof.
Endpoint Security (10 checks)
| ID | Check | Severity |
|---|---|---|
| EP01 | Defender / EDR Deployment + ASR Rules | Critical |
| EP02 | BitLocker / Disk Encryption | Critical |
| EP03 | SMB / Protocol Hardening (signing, NTLM, LLMNR) | High |
| EP04 | Patch Compliance | High |
| EP05 | Local Admin / Privilege Escalation Paths | High |
| EP06 | Host Firewall + Attack Surface | Medium |
| EP07 | Application Control + Macro Policy (AppLocker/WDAC) | Medium |
| EP08 | Hardware Security (VBS, Credential Guard, LSA, TPM, Secure Boot) | High |
| EP09 | AutoRun / AutoPlay | Low |
| EP10 | End-of-Life Operating Systems | High |
Network Perimeter (10 checks)
| ID | Check | Severity |
|---|---|---|
| NP01 | Firewall Rules (any/any, stale, overbroad) | Critical |
| NP02 | Open Ports + Listening Services | Critical |
| NP03 | VPN Configuration + Split Tunneling | High |
| NP04 | DNS Filtering Configuration | High |
| NP05 | Egress / Outbound Filtering | High |
| NP06 | Stale Firewall Rules | Medium |
| NP07 | IDS/IPS Presence + Signatures | Medium |
| NP08 | TLS / Crypto Configuration (SCHANNEL) | Low |
| NP09 | NAT / Port Forwarding Exposure | High |
| NP10 | Firmware / Software Version Hygiene | Medium |
Backup & Recovery (8 checks)
| ID | Check | Severity |
|---|---|---|
| BR01 | Backup Solution Detection (3-2-1 rule) | Critical |
| BR02 | Backup Restore Test Evidence | Critical |
| BR03 | Immutable / Air-Gapped Backups | Critical |
| BR04 | RTO/RPO Documentation | High |
| BR05 | Backup Encryption | High |
| BR06 | Backup Monitoring / Alerting | High |
| BR07 | DR Plan / Tabletop Exercise | Medium |
| BR08 | Cloud/SaaS Backup (M365, Google Workspace) | Medium |
Logging & Monitoring (8 checks)
| ID | Check | Severity |
|---|---|---|
| LM01 | DNS Query Logging | High |
| LM02 | Centralized Logging / SIEM | High |
| LM03 | Audit Policy + PowerShell Logging | High |
| LM04 | Firewall Logging + Retention | Medium |
| LM05 | Failed Logon Monitoring | Medium |
| LM06 | File Integrity Monitoring | Medium |
| LM07 | Log Retention + Event Log Sizes (CIS benchmarks) | Medium |
| LM08 | Security Alerting + Notification | High |
Network Architecture (7 checks)
| ID | Check | Severity |
|---|---|---|
| NA01 | Network Segmentation | Critical |
| NA02 | VLAN Separation (user/server/IoT/guest) | High |
| NA03 | Wireless Security (WPA3/WPA2-Enterprise) | High |
| NA04 | Network Documentation / Diagram Currency | Medium |
| NA05 | 802.1X / NAC Deployment | Medium |
| NA06 | Management Interface Isolation | Medium |
| NA07 | Switch Port Security + Unused Port Management | High |
Physical Security (6 checks)
| ID | Check | Severity |
|---|---|---|
| PS01 | Physical Access Controls + Screen Lock | High |
| PS02 | Visitor Sign-in / Access Policy | Medium |
| PS03 | Camera / Surveillance Coverage | Medium |
| PS04 | Clean Desk / Credential Exposure | Medium |
| PS05 | Network Jack / Guest VLAN Security | Low |
| PS06 | UPS / Power Protection | Low |
Common Findings (8 checks)
| ID | Check | Severity |
|---|---|---|
| CF01 | Service Accounts with DA + Weak Passwords | Critical |
| CF02 | Egress Filtering Absent | Critical |
| CF03 | Security Awareness Training | Medium |
| CF04 | Former Employee Accounts Active | Critical |
| CF05 | Open File Shares | High |
| CF06 | Flat Network (no segmentation) | High |
| CF07 | Broad Local Admin Rights | High |
| CF08 | No DNS / Content Filtering | High |
Every check maps to one or more controls across 11 frameworks. Framework-specific scan profiles run the most relevant checks for that standard:
| Framework | Standard | Profile checks |
|---|---|---|
| CIS | Controls v8.1 | 69 checks |
| NIST | SP 800-171 Rev 3 | 69 checks |
| CMMC | Level 2 (v2.0) | 69 checks |
| HIPAA | Security Rule | 49 checks |
| PCI-DSS | v4.0.1 | 51 checks |
| ACSC Essential Eight | Maturity Model | 28 checks |
| Cyber Essentials | UK NCSC v3.3 | 37 checks |
| SOC 2 | Type II (Trust Criteria) | 67 checks |
| ISO 27001 | :2022 (Annex A) | 69 checks |
| DISA STIG | Windows Server/Client | 69 checks |
| FedRAMP | Moderate (NIST 800-53 Rev 5) | 69 checks |
The C# rewrite does not score fabricated sequential STIG V-IDs. Until genuine rule IDs are sourced, its STIG profile is limited to the IA11/IA12 prose-backed readiness checks.
All 69 checks map to ATT&CK Enterprise techniques (v19.1) with tactic and technique IDs. The HTML report includes a visual heatmap showing coverage across the ATT&CK matrix and identifying gaps.
All 69 checks also map to MITRE D3FEND defensive techniques (v1.4.0). Reports show D3FEND stage coverage for Model, Harden, Detect, Isolate, Deceive, Evict, and Restore, while JSON, JSONL, CSV, and SARIF exports include D3FEND technique fields for downstream GRC, SIEM, and MSP analytics.
The EP04 patch compliance check automatically downloads the CISA Known Exploited Vulnerabilities catalog and cross-references it against detected Microsoft products on the system, flagging any actively exploited CVEs with remediation due dates. It also calls out CVE-2025-33073 Windows SMB Client remediation evidence and correlates missing June 2025+ patch state with SMB signing and AD delegation exposure.
Beyond misconfiguration checks, the tool detects active indicators of compromise:
- Golden Ticket risk — krbtgt password age monitoring (should rotate every 180 days)
- DCSync permissions — non-standard accounts with Replicating Directory Changes rights
- AdminSDHolder tampering — unexpected ACEs on the AdminSDHolder container
- SID History abuse — accounts with SID History from foreign domains
- ADCS vulnerabilities — ESC1/ESC6/ESC8/ESC9/ESC10/ESC11/ESC13/ESC15 certificate template and CA misconfigurations
- Kerberos legacy encryption — RC4/DES-only or default-dependent accounts, trusts, and KDC event evidence
- BadSuccessor / dMSA exposure — Windows Server 2025 delegated MSA objects, migration links, and OU create/control rights
A dedicated scoring engine evaluates AD security maturity across four domains:
- Privileged Access (30%) — DA minimization, LAPS, Kerberoast risk, service accounts
- Identity Hygiene (25%) — Stale accounts, password policy, MFA, vendor lifecycle
- Infrastructure Hardening (25%) — Credential Guard, SMB/TLS, EDR, patching
- Visibility (20%) — SIEM, audit policy, failed logon monitoring, IDS/IPS
A dedicated scoring engine evaluates ransomware resilience across four domains:
- Prevention — EDR, AppLocker/WDAC, macro restrictions, egress filtering
- Protection — Credential Guard, LSA Protection, BitLocker, local admin controls
- Detection — IDS/IPS, SIEM, logging, alerting
- Recovery — Backup immutability, restore testing, DR planning, RTO/RPO
The score produces an independent letter grade separate from the overall security score.
Checks are weighted by severity (Critical=10, High=7, Medium=5, Low=3) and category importance. The weighted score produces an overall letter grade:
| Grade | Score | Meaning |
|---|---|---|
| A | 90-100% | Strong security posture |
| B | 80-89% | Good with minor gaps |
| C | 70-79% | Moderate risk, action needed |
| D | 60-69% | Significant gaps |
| F | <60% | Critical risk |
Every HTML report can include up to three tiers, each targeting a different audience:
- Executive — Letter grade, risk summary, top 5 findings, ransomware readiness, compliance status. One page, no jargon.
- Management — Category breakdowns, remediation roadmap with priority/effort/timeline, framework scorecards, trend indicators.
- Technical — Full findings with evidence, per-check compliance mapping, MITRE technique references, remediation steps, scan timestamps.
Full WPF interface with:
- Catppuccin Mocha dark theme in the C# rewrite; the legacy PowerShell WPF artifact retains the seven-theme selector
- Security-operations workstation shell with a persistent category progress rail, command/status bar, risk score band, dense virtualized check table, selected-check inspector, and integrated activity console
- Per-check controls — status dropdown, findings, evidence, notes, remediation assignment/due date/status
- Live risk score dashboard updated as checks complete
- Pre-flight connectivity check before scanning (ping, WinRM, AD module, SMB, DNS, elevation, Defender)
- Turnkey environment setup — auto-installs RSAT, configures WinRM, sets audit policies
Designed for RMM deployment. The -Silent flag runs the full scan pipeline with zero interaction:
- Auto-elevates to admin
- Detects environment (domain/workgroup/standalone)
- Runs selected scan profile
- Exports HTML report + structured data
- Writes findings to RMM platform fields
- Returns exit code for RMM alerting
Automatic platform detection and field population:
| Platform | Method | Fields |
|---|---|---|
| NinjaRMM | Ninja-Property-Set |
Grade, Score, Date, Findings, Ransomware, Compliance |
| Datto RMM | CentraStage UDF Registry | Custom1-5 |
| ConnectWise Automate | LabTech EDF Registry | Grade, Score, Date, Ransomware, Compliance, ReportPath |
| Syncro | Set-SyncroCustomField |
SecurityAuditGrade, Score, Ransomware, Compliance |
| HaloPSA | Registry Cache | Grade, Score, Ransomware, Compliance |
| Generic | HKLM:\SOFTWARE\NetworkSecurityAudit |
All fields (any RMM can read) |
| Code | Condition | RMM Action |
|---|---|---|
| 0 | A/B grade, no critical failures | Green |
| 1 | D/F grade OR ransomware score < 40% | Immediate alert |
| 2 | Findings present, grade C+ | Review needed |
| 3 | Any compliance framework < 60% | Compliance alert |
| Format | File | Use Case |
|---|---|---|
| HTML | SecurityAudit_*.html |
Human-readable report with all three tiers |
| JSON | *_findings.json |
Per-finding structured data with compliance, ATT&CK, D3FEND, evidence-mode metadata, an exceptions list (accepted-risk/deferred items with owner, expiration, and rationale), per-framework control summaries, observed-fact/narrative separation, and write disclosure |
| JSONL | *_siem.jsonl |
One event per finding for Splunk/Elastic/Sentinel with truncation, evidence-mode, and D3FEND fields |
| Run Log JSONL | *_runlog.jsonl |
Per-check timing, timeout, skip reason, error, and slow-check metadata |
| CSV | *.csv |
Pivot table analysis with compliance, ATT&CK, D3FEND, and evidence-mode columns |
| SARIF | *.sarif |
Static Analysis Results Interchange Format with D3FEND and evidence-mode rule properties |
*.pdf |
Portable report via Edge/Chrome headless rendering | |
| Intune | *_intune.json |
Device compliance discovery script for Conditional Access |
| Compliance Summary | *_summary.json |
Compact RMM dashboard payload |
| ATT&CK Navigator | *_navigator.json |
MITRE ATT&CK Navigator v4.5 layer with technique scoring |
| OCSF | *_ocsf.jsonl |
OCSF v1.8.0 Security Finding events for vendor-neutral SIEM/MDR |
| OSCAL | *_oscal.json |
NIST OSCAL v1.2.2 assessment results for GRC and FedRAMP |
| OSCAL POA&M | *_oscal_poam.json |
OSCAL plan of action and milestones risks/tasks linked to finding UUIDs, waiver status, owner, due date, and remediation text |
Machine-readable contract schemas for JSON, JSONL, OCSF, OSCAL, OSCAL POA&M,
Intune, compliance summary, dashboard aggregate rows, and SIEM field mappings are
committed under schemas/exports and covered by xUnit golden fixture tests.
The C# silent mode can also import an Intune STIG audit baseline JSON or CSV
export with --intune-stig-import. Imported STIG evidence remains explicitly
external: reports carry source URL/version, device scope, timestamps, XCCDF
status mapping, and NotLicensed/NotPermitted states without adding local
STIG rule IDs to the built-in check catalog.
Reports and exports label each check as Automated, Heuristic, Checklist,
InterviewRequired, or ExternalRequired. Framework scores keep the existing
default scoring behavior but also expose manual-validation counts and an
automated-only score_excluding_manual_evidence value for consumers that need
to separate machine-collected evidence from checklist, interview, or external
console evidence.
- PowerShell 5.1+ (ships with Windows 10/11 and Server 2016+)
- Windows 10/11 or Server 2016/2019/2022/2025
- Administrator elevation (auto-prompted via UAC)
- No external modules required — the script handles everything
Optional for full coverage:
- RSAT / Active Directory module — required for AD-type checks (IA01-IA08, IA10-IA12, CF01, CF04, EP10). The tool auto-offers to install RSAT on first run.
- Domain-joined machine — non-domain machines skip AD checks automatically and run all 55 local checks.
- The default scan mode is read-only. In read-only mode the tool refuses to run any host-modifying setup (WinRM/PSRemoting, Remote Registry, firewall rules, audit policy); those require an explicit
-ReadOnly:$falseplus user action. - Every persistent side effect (RMM field write, registry cache, setup action) is routed through a single write gate and recorded in a write manifest. Silent mode prints a post-run write summary (intended / written / skipped / failed), and the structured JSON export discloses
writes.any_attemptedand the full manifest, so a report always states whether anything was written. - Use
-WriteManifestOnlyto dry-run the side effects: the tool reports every write it would perform and performs none of them. - The tool reads local Windows security state, event logs, registry policy keys, service status, installed patch data, and AD data when the host has RSAT/domain access.
- Internet access is limited to documented lookup/probe paths such as the CISA KEV catalog, DNS filtering tests, and egress checks.
- Use
-NoInternetto skip public internet downloads, external DNS tests, and outbound egress probes. - Reports and structured exports are written to the selected output folder. No report data is uploaded by the script.
- RMM field writes are limited to the configured RMM integration paths documented below.
- Use
-NoRmmWritein silent mode when reports should be generated without updating RMM fields. - Use
-NoRegistryWritewhen registry-backed RMM/cache writes should be suppressed while command-based RMM integrations remain available. -BrandingConfigwarns when the file is missing, accepts logo data only as a supporteddata:image/...;base64URI or supported image path, and only renders website links when they are absolutehttp://orhttps://URLs.- The script does not auto-update or replace itself.
- In sensitive environments, download the script first, inspect it, and verify the checksum before running.
Every release publishes a SHA256SUMS.txt checksum manifest alongside the script.
# Compare the downloaded file against the published checksum
$hash = (Get-FileHash .\NetworkSecurityAudit.ps1 -Algorithm SHA256).Hash
Write-Host "SHA256: $hash"
# Match against SHA256SUMS.txt from the same releaseIf you have the GitHub CLI installed, you can also verify build provenance:
gh attestation verify NetworkSecurityAudit.ps1 --owner SysAdminDocThe quality gate is static and never executes a real audit check or modifies the host. Builds, tests, validation, and releases are run locally from the repo:
# 1. Static validation gate (parser, catalog/profile/framework/risk/D3FEND IDs,
# version surfaces, export pass-through). Requires nothing but PowerShell.
.\tools\Test-NetworkSecurityAudit.ps1
# 2. Lint (PSScriptAnalyzer with the project rule set in PSScriptAnalyzerSettings.psd1)
Invoke-ScriptAnalyzer -Path .\NetworkSecurityAudit.ps1 -Settings .\PSScriptAnalyzerSettings.psd1
# 3. Pester suite (wraps the gate, adds catalog/version/export/lint assertions)
Invoke-Pester -Path .\tools\NetworkSecurityAudit.Tests.ps1
# 4. C# rewrite test/build gate
dotnet test .\NetworkSecurityAuditor.slnx --no-restore
dotnet build .\NetworkSecurityAuditor.slnx --no-restorePSScriptAnalyzerSettings.psd1 enforces syntax, correctness, and security rules;
it documents each excluded rule as an intentional single-file design choice
(console Write-Host output, graceful empty-catch guards, runspace credential
arguments, the WinRM-bootstrap WMI call, and so on). The lint gate must report
zero findings. The Pester suite also includes offline Microsoft Graph wrapper
fixtures for paging, throttling, and permission/license classification; these do
not require tenant credentials.
The C# xUnit suite validates Data/BenchmarkMetadata.json so CIS, STIG,
Microsoft lifecycle/SMB, and hardening-list provenance includes source URLs,
review dates, supported OS/builds, check coverage, and stale-review windows.
-Silent Run headless (no GUI). Auto-scans, exports, exits.
-ScanProfile Quick | Standard | Full | ADOnly | LocalOnly |
Cloud | HIPAA | PCI | CMMC | E8 | CyberEssentials |
SOC2 | ISO27001 | STIG | FedRAMP
Default: Full (all 69 checks)
-OutputPath Report output path. Default: Desktop
-ReportTier Executive | Management | Technical | All
Default: All
-ReadOnly Safety mode - skip system-modifying checks.
Default: $true
-NoRmmWrite Silent mode only: skip RMM and registry field writes
-NoRegistryWrite Silent mode only: skip registry-backed RMM/cache writes
-WriteManifestOnly Preview every intended RMM/registry/setup write without
performing any of them. Implies -NoRmmWrite and
-NoRegistryWrite; the write manifest still lists what
would have been written.
-NoInternet Skip public internet downloads and probe checks
-NoElevate Do not auto-relaunch with UAC elevation
-Client Client name for report header.
Default: domain name or computer name
-Auditor Auditor name for report header.
Default: current username
-ExportJSON Also export structured findings JSON
-ExportCSV Also export CSV
-ExportJSONL Also export SIEM-format JSONL
-ExportSARIF Also export SARIF 2.1.0 for GitHub/Azure DevOps
-ExportPDF Also export PDF via Edge/Chrome headless
-ExportNavigator Also export MITRE ATT&CK Navigator layer JSON
-ExportOCSF Also export OCSF v1.8.0 security finding JSONL
-ExportOSCAL Also export NIST OSCAL v1.2.2 assessment results JSON
-PrivacyMode Redact hostnames, IPs, and identities in all exports
-CloudAssessmentPath Path(s) to Maester or CISA ScubaGear JSON results
to import and include in reports
-Dashboard Generate a static multi-client rollup dashboard from a
folder of findings JSON exports, then exit (no scan,
no elevation, no host changes)
-InputDir Dashboard mode: folder of *_findings.json exports to roll
up. Default: folder of -OutputPath, else Desktop
-StaleDays Dashboard mode: scans older than this many days are
flagged stale. Default: 30
-HistoryPath Continuous mode: directory for history.jsonl, snapshots,
and the baseline. Default: a per-client folder next to the
report output
-BaselinePath Explicit baseline snapshot to compare this run against.
Default: the history folder's latest snapshot
-NoHistory Disable continuous delta/history entirely
-TrendDays Trend window in days for history reporting. Default: 90
-AlertPreview Print the delta alert/webhook payload (never sends it)
-HistoryRetentionDays Prune snapshot files older than this. 0 = keep all.
Default: 365
Imported cloud assessment results preserve unavailable status semantics:
NotLicensed, NotPermitted, NotConfigured, Skipped, and Error are
reported separately from true Fail findings. When -PrivacyMode is used,
imported cloud tenant names, tenant IDs, source paths, and token-like values are
pseudonymized in report/export provenance.
In the PowerShell artifact, -ScanProfile Cloud runs the Microsoft Graph cloud
assessment path without an on-premises domain. It currently emits CL01 Secure
Score, CL02 Conditional Access baseline gaps/exclusions, and CL06 stale guest
lifecycle evidence; CL01 through CL12 are declared in the cloud manifest with
permissions, license prerequisites, endpoints, output fields, skip states, and
privacy classes. Cloud provenance is also carried into JSONL, CSV, SARIF,
Intune, compliance summary, and dashboard exports with the same privacy
redaction rules.
In the C# rewrite, the Cloud profile is intentionally disabled until real CLxx checks exist. Selecting it exits without running local or Active Directory checks so a cloud scan cannot be mistaken for endpoint/domain coverage.
| Profile | Checks | Time | Use Case |
|---|---|---|---|
| Quick | ~22 | ~15 min | Critical-only field triage |
| Standard | ~52 | ~30 min | Routine assessment |
| Full | 69 | ~60 min | Comprehensive audit |
| ADOnly | ~14 | ~10 min | Domain-focused checks only |
| LocalOnly | ~55 | ~45 min | Endpoint-only (no AD required) |
| Cloud | PowerShell: 3 live / 12 manifest; C#: disabled until CLxx checks land | ~5 min | Microsoft Graph cloud assessment |
| HIPAA | 49 | ~30 min | Healthcare compliance |
| PCI | 51 | ~35 min | Payment card compliance |
| CMMC | 69 | ~60 min | Defense contractor compliance |
| E8 | PowerShell: 28; C#: 25 | ~25 min | ACSC Essential Eight maturity indicators |
| CyberEssentials | PowerShell: 37; C#: 35 | ~35 min | UK NCSC Cyber Essentials technical controls |
| SOC 2 | 67 | ~50 min | Service organization compliance |
| ISO 27001 | 69 | ~60 min | International standard compliance |
| STIG | 69 | ~60 min | DISA STIG for DoD/government |
| FedRAMP | 69 | ~60 min | FedRAMP Moderate for federal cloud |
# Add as a scripted condition or scheduled automation
powershell.exe -ExecutionPolicy Bypass -File "C:\Tools\NetworkSecurityAudit.ps1" -Silent -ScanProfile Standard
# Results appear in device custom fields automatically# Component script — results write to UDF Custom1-5
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Tools\NetworkSecurityAudit.ps1" -Silent -ScanProfile Quick -ReportTier Executive# Script — results write to EDF registry keys
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Tools\NetworkSecurityAudit.ps1" -Silent -ExportJSON -ExportCSV
# Monitor exit codes: 0=green, 1=critical, 2=warning, 3=compliance-fail# Weekly security posture check
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -File C:\Tools\NetworkSecurityAudit.ps1 -Silent -ScanProfile Standard -OutputPath C:\Reports"
$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Monday -At 6am
Register-ScheduledTask -TaskName "WeeklySecurityAudit" -Action $action -Trigger $trigger -RunLevel Highest -User "SYSTEM"-TargetsCsv runs silent-mode audits across many hosts with bounded concurrency:
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Tools\NetworkSecurityAudit.ps1" -Silent -TargetsCsv "C:\Reports\targets.csv" -ThrottleLimit 8 -PerHostTimeout 900 -PrivacyMode -ReportTier Executive -Auditor "MSP Security"-ThrottleLimit accepts 1-64 and -PerHostTimeout accepts 1-86400 seconds. Fleet child scans inherit privacy, auditor, report-tier, and optional export switches. Remote runs use unique temp artifact names and best-effort cleanup before returning the per-host JSON to the aggregate fleet_summary.csv and fleet_summary.json.
Each of the 69 checks has a severity weight (Critical=10, High=7, Medium=5, Low=3). Each category also has a weight reflecting its relative importance. The score is calculated as:
Per-category: (earned points / max points) * 100
Overall: weighted average across all categories
Pass = full points, Partial = half points, Fail = zero, N/A = excluded from calculation.
A separate 100-point scale evaluates specific ransomware defense capabilities mapped to the four-domain model (Prevention, Protection, Detection, Recovery). This produces an independent grade — an environment can score well overall but poorly on ransomware readiness if backup and recovery controls are weak.
Each framework profile defines which checks map to which controls. C# compliance summaries now separate met, partial, failed, and not-assessed mapped checks so partial coverage is visible without being counted as fully met.
Audit state (all check statuses, findings, evidence, notes, remediation tracking) can be saved to JSON and reloaded later. This enables:
- Pausing and resuming audits across sessions
- Comparing two audit snapshots to show improvement over time
- Building a historical record of security posture
The production PowerShell artifact stays single-file for low-friction RMM deployment. The C# rewrite uses a normal multi-project .NET structure for maintainability, local tests, and release publishing.
NetworkSecurityAudit.ps1 # Production single-file PowerShell artifact
README.md # This file
PSScriptAnalyzerSettings.psd1 # Lint rule set (correctness/security gate)
tools/Test-NetworkSecurityAudit.ps1 # Static validation gate
tools/NetworkSecurityAudit.Tests.ps1 # Pester v5 quality-gate suite
tools/Test-ThemeContrast.ps1 # WCAG 2.2 AA theme contrast validation
tools/Publish-CSharpRelease.ps1 # Local C# zip/checksum/signing artifact flow
src/NetworkSecurityAuditor/ # .NET 10 WPF rewrite
src/NetworkSecurityAuditor/Data/BenchmarkMetadata.json # C# benchmark/lifecycle source manifest
tests/NetworkSecurityAuditor.Tests/ # xUnit tests for the C# rewrite
publish/NetworkSecurityAuditor/ # Local publish output, generated and not committed
artifacts/csharp-release/ # Local C# release artifacts, generated and not committed
The C# rewrite exports SARIF 2.1.0 for tools that ingest code-scanning results. Generate it locally during a silent run:
dotnet publish .\src\NetworkSecurityAuditor\NetworkSecurityAuditor.csproj -c Release -o .\publish\NetworkSecurityAuditor --no-restore
.\publish\NetworkSecurityAuditor\NetworkSecurityAuditor.exe --silent --export-sarif --output C:\ReportsThe generated .sarif file includes severity, category, stable logical check locations, and remediation links for downstream import.
Contributions are welcome. Areas where help is most needed:
- Additional auto-check scripts for specific technologies (Exchange, SQL Server, VMware, etc.)
- Cloud/hybrid identity checks (Entra ID, M365 Secure Score, Intune compliance)
- Additional compliance framework mappings
- Bug reports from diverse environments (different OS versions, domain configurations, edge cases)
- Localization of check descriptions and report text
Please open an issue before starting work on major features to discuss approach.
MIT
Built with PowerShell 5.1, WPF, and an unreasonable number of hours reading CIS Benchmarks, NIST publications, and RMM API documentation.