Skip to content

v2.2.4 — Windows 11 Security & Privacy Hardening Framework

Choose a tag to compare

View all tags
@NexusOne23 NexusOne23 released this 18 May 01:52
· 1 commit to main since this release
v2.2.4
ffc7eed

What This Is

NoID Privacy is a PowerShell framework for hardening Windows 11 against
common attack vectors and privacy leakage. It applies the Microsoft
Security Baseline for Windows 11 v25H2 plus six additional hardening
modules. Every applied setting is backed up before it is written, so
the system can be returned to its prior state with one command.

This is a standalone tool for Windows 11 hosts without Intune / Active
Directory infrastructure. If you have Intune or an AD domain, integrate
the equivalent settings into your management plane instead.

Quick Start

# Run PowerShell as Administrator, then:
irm https://raw.githubusercontent.com/NexusOne23/noid-privacy/main/install.ps1 | iex

Alternative (manual install):

git clone https://github.com/NexusOne23/noid-privacy.git
cd noid-privacy
.\Start-NoIDPrivacy.bat

The 7 Modules

Module Settings Description
SecurityBaseline 425 Microsoft Security Baseline for Windows 11 v25H2 (335 Registry + 67 Security Template + 23 Audit)
ASR 19 Defender Attack Surface Reduction rules (17 Block + 2 Configurable)
DNS 5 DNS-over-HTTPS with Quad9 / Cloudflare / AdGuard
Privacy 78 Telemetry, app permissions, OneDrive, bloatware (3 modes: MSRecommended / Strict / Paranoid)
AntiAI 32 Disables 15 Windows AI features via official Microsoft policies (Recall, Copilot, Paint AI, Notepad AI, Click to Do, Settings Agent, etc.)
EdgeHardening 24 Microsoft Edge Security Baseline (SmartScreen, Site Isolation, SSL/TLS)
AdvancedSecurity 50 Beyond MS Baseline — RDP NLA, WDigest, Legacy TLS, WPAD, PowerShell v2, SRP .lnk (CVE-2025-9491), Wireless Display, Discovery Protocols, optional IPv6 disable (mitm6 mitigation), Firewall Shields Up

Total: 633 settings (Paranoid mode, Defender as primary engine).
With a third-party endpoint product as primary engine, ASR is not
applicable (Defender-specific API) — the other 6 modules apply normally
for a total of 614 settings.

BAVR Pattern

Every applied setting follows Backup → Apply → Verify → Restore:

  • Backup — registry keys, services, firewall rules, scheduled tasks,
    GPO snapshots, audit policies, Pre-Framework ASR snapshot, JSON
    fallbacks for protected keys
  • Apply — native PowerShell only (no LGPO.exe, no DLLs, no external
    binaries), with structured logging at every step
  • Verify — Tools\Verify-Complete-Hardening.ps1 re-reads each
    applied setting and reports what is configured (also generates an HTML
    compliance report)
  • Restore — .\Core\Rollback.ps1 -RestoreLatest reverts registry /
    services / scheduled tasks / firewall / DNS / AI features. Some
    bloatware on certain Windows editions is intentionally not
    auto-reinstallable via winget and requires manual reinstall from the
    Microsoft Store

Third-Party Endpoint Products

NoID detects whichever AV / endpoint product is present and adapts. ASR
is a Defender-specific API and cannot be configured by NoID when
Defender is not the primary engine. The other 6 modules apply normally.

NoID does not make claims about whether a third-party product
provides equivalent attack-surface-reduction features — modern AV and
EDR/XDR products typically include behavioural analysis, exploit
prevention, ML/AI-based detection, reputation systems, cloud
sandboxing, and more, but NoID cannot read those vendor-specific
configurations. Consult your vendor's documentation or management
console to confirm what is enabled.

Zero-Day Mitigations

  • CVE-2025-9491 (Windows LNK RCE) — SRP rules block .lnk execution
    from %LOCALAPPDATA%\Temp\*.lnk and %USERPROFILE%\Downloads\*.lnk
  • ClickFix malware (finger.exe abuse) — outbound TCP port 79
    blocked by firewall
  • mitm6 / DHCPv6 spoofing — optional IPv6 disable in Maximum profile

Verification

.\Tools\Verify-Complete-Hardening.ps1

Generates a console summary and a standalone HTML compliance report in
Reports/. Each module reports the count of settings verified,
not-verified, and any deltas. When a third-party endpoint product is
detected, ASR is reported as not-applicable rather than counted as
verified.

Profiles (AdvancedSecurity)

  • Balanced — safe defaults for home users
  • Enterprise — domain-aware checks
  • Maximum — additional opt-in hardening (full RDP disable, full
    Wireless Display disable, Discovery Protocols disable, IPv6 disable,
    Firewall Shields Up)

Requirements

  • Windows 11 24H2 or newer (25H2 fully tested)
  • PowerShell 5.1+ (PowerShell 7+ also supported)
  • Administrator rights
  • TPM 2.0 (required for BitLocker, Credential Guard, VBS)
  • 8 GB RAM minimum, 16 GB recommended for VBS

What This Tool Does NOT Do

  • Install third-party antivirus (uses Microsoft Defender by default)
  • Configure domain-specific policies (use Intune/AD for that)
  • Modify BIOS/UEFI settings
  • Prevent re-enabling features

Documentation

License

GPL-3.0 (open source) with optional commercial licensing for
closed-source / proprietary use. See LICENSE.

Sister Projects

Use at your own risk. Always create a system backup or VM snapshot
before running on a system you care about.

Assets 2
Loading