Windows Secure Toolkit v1.4.0

Highlights

• Adds read-only BitLocker status for the Windows system volume.
• Adds read-only UEFI Secure Boot status.
• Adds audit --json for automation-friendly JSON on standard output.
• Restores compatibility with valid v1.3.2 and v1.3.3 backup manifests.
• Aligns WinSecure.exe assembly and file metadata with version 1.4.0.

Verification

• Windows CI: passed on the merged main commit.
• Repository validation: 25 checks passed.
• Security regression gate: 19 invariants passed.
• Release build: 0 warnings and 0 errors.
• Extracted-package checks: version, self-test, JSON audit schema, BitLocker field, and Secure Boot field passed.
• Maintainer machine: Windows 11 Pro for Workstations build 26200 reported Secure Boot enabled. BitLocker was Unavailable from the non-elevated validation token; this is not reported as an unencrypted result.
• Apply/Restore behavior is unchanged from the paths already validated by the maintainer on Windows 10 and Windows 11.

Integrity and trust

• SHA-256: EB735CB2F871EA66E7570DE0CAC94C745121C1EB43AAF03D1AC33387E3BB0640
• Authenticode: not signed. Verify the tag, release source, and SHA-256 before use.

v1.3.3

v1.3.3

A small compatibility maintenance release for Windows Secure Toolkit.

• restore now accepts v1.3.1 backup manifests alongside the supported earlier versions;
• self-test covers the previous-release backup compatibility path;
• existing Windows 10/11 runtime validation notes remain included;
• no new default ports, remote scripts, or system policy targets were added.

Download windows-secure-toolkit-v1.3.3-win-x64.zip below and verify its SHA-256:

6937E9A78AFF83CC09A6F4BF2FADAE63EEBCF7ABC7ED455D5CA415D515E3F192

v1.3.2

v1.3.2

A small maintenance release for Windows Secure Toolkit.

• synchronized the toolkit version metadata;
• kept quick-start downloads on the general Releases page;
• kept the README focused on setup and issue reporting;
• no command behavior changes are included in this release.

Windows x64 package

Download windows-secure-toolkit-v1.3.2-win-x64.zip below.

v1.3.1

Added

• Added the read-only backups command to list local backup directories.
• Added text and --json output with manifest and SHA-256 status.
• Added the command to the Windows smoke-test path.

Verification

• Windows CI passed on the release commit.
• Local scripts\\Test-Repository.cmd passed: 22 checks.
• No system-changing Apply or Restore operation was run.

SHA-256 (ZIP): F53204DD44865372CB6F56A18DA7E71BF7B5E56AF71A894ADCA842FA0B12C662

v1.3.0

v1.3.0

This release promotes the diagnostics preview into the default main branch.

Added

• read-only doctor and doctor --json capability checks for Windows/.NET/WMI/native tools/Defender;
• a Windows validation matrix that separates CI evidence, local smoke tests, and untested system-changing paths;
• restore compatibility for v1.2.0 and v1.2.1 backup manifests when the existing machine, hash, schema, and allowlist checks pass.

Verification

• PR #4 merged into main: #4;
• GitHub Actions CI passed: https://github.com/KBT096/windows-secure-toolkit/actions/runs/32367195693;
• scripts\\Test-Repository.cmd passed 19 checks on the maintainer Windows workstation;
• packaged version and self-test both passed;
• SHA-256: 003a2d72de7d221bc179ba92c48f9af41cef3e10d438798cb64ca70774e78288;

Apply/Restore system-changing operations remain unexecuted on the maintainer workstation. Review the validation notes before applying changes.

v1.2.1

v1.2.1

This patch tightens restore-manifest validation.

Changed

• reject duplicate registry targets in a restore manifest;
• require the complete registry allowlist before restore;
• add a no-change self-test for the duplicate-target tamper path;
• refresh the README and package references to v1.2.1.

Verification

• Windows CI passed on the merged pull request;
• scripts\\Test-Repository.cmd passed with 16 checks on Windows 11 Pro for Workstations build 26200;
• the packaged entry point reports 1.2.1 and passes self-test;
• system-changing Apply/Restore remains unexecuted on the maintainer workstation.

v1.2.0

Windows Secure Toolkit v1.2.0

这次是真的换了发动机：核心从脚本改成 C# .NET Framework 4.8，CMD/BAT 入口继续保留。

变化

• C# 本地核心，直接使用注册表、WMI、Defender、DISM、SFC 和防火墙接口；
• 保留审计、Markdown/JSON 报告、计划、备份、恢复、扫描、验证、端口和更新检查；
• 测试入口改为 scripts/Test-Repository.cmd；
• README、威胁模型、贡献说明和变更记录同步更新；
• 不下载或执行远程脚本，不上传本机报告。

验证

• Windows 11 专业工作站版 build 26200；
• scripts\\Test-Repository.cmd：PASS: 16 checks completed；
• PR #1 的公开 Windows CI：通过；
• 已验证构建、启动、版本、自检、审计、计划、报告、端口和 Release 检查；
• Apply/Restore 的真实系统修改没有在维护者机器上执行，使用前请先看计划和备份。

v0.1.0

Windows Secure Toolkit v0.1.0

首个版本，面向 Windows 10/11 与 Windows Server 的本地安全审计和可回滚加固。

包含内容

• CMD/BAT 入口与 Windows PowerShell 5.1 引擎
• 只读审计、Markdown/JSON 报告、监听端口检查
• 计划模式、带 SHA-256 校验的备份与受限恢复
• Windows 防火墙、Defender、UAC、SMBv1、Guest、RDP NLA 和 AutoRun 的保守基线
• 仓库自检、GitHub Actions Windows CI、更新元数据检查

验证范围

• 本地 Windows 11 专业工作站版、Windows PowerShell 5.1
• 仓库验证器：52 项检查通过
• GitHub Actions Windows CI：通过
• 已验证启动、帮助、版本、自检、审计、监听端口和计划模式

实际修改系统的 Apply/Restore 流程没有在维护者机器上执行；生产环境使用前请先审阅计划、备份和恢复说明。