Quick start

Quick start

This guide walks you from download to a careful first Apply. The product site Download page uses the same path after the zip lands. For full installation detail, see the repository README. For the full ordered checklist (prerequisites, section defaults honesty, verify after Apply, when something breaks), see Hardening workflow.

If you need help while you work, open the site Help page on this PC or on another device (phone, tablet, or second computer). The Recovery cookbook covers common side effects after Apply. For email or GitHub bugs, use Support.

1. Download the right build

Use an official source only:

1. Recommended: open https://www.operationlockedin.com/bastion/download (the site resolves the same GitHub Latest zip), or open https://github.com/jjames06/bastion-hardening/releases/latest
2. Download bastion-hardening-v*.zip (the current Latest build is also noted in Discussions #17)
3. Unblock the zip (Mark-of-the-Web): right-click the zip -> Properties -> check Unblock if shown -> OK. Skipping this often causes running scripts is disabled on this system.
4. Extract the zip to a location you control (for example C:\Tools\). Official zips expand to one folder such as bastion-hardening-v16.0\ with the bootstrap, src\ modules, and docs already together.
5. Open that folder and confirm: Bastion-Hardening.bat, Bastion-Hardening.ps1, and src\ (optional: Bastion-Banner.utf8.txt, docs\)

Current releases are modular: the bootstrap is thin, and implementation lives as plain-text modules under src\ so the product is easier to review than the older single large script. You do not assemble modules yourself; the zip already contains them. Optional reading: Modular source layout.

Always use Bastion-Hardening.bat. Never double-click Bastion-Hardening.ps1 alone under Windows Restricted ExecutionPolicy - the host blocks the script before Bastion runs. The bat unblocks the product tree and starts PowerShell with Process-scope Bypass.

2. Run elevated

1. Right-click Bastion-Hardening.bat (the only supported launcher)
2. Choose Run as administrator
3. Accept the UAC prompt

On first elevated launch, Bastion creates a data directory (the path appears on the main menu) for logs and preferences. It does not invent Apply history until you actually Apply. For more detail, see docs/DATA-DIRECTORY.md.

3. Safety net

From the main menu, choose 13 or R to create a named System Restore Point.

A restore point is your strongest full rollback if something goes wrong. If restore points or Recovery are new to you, read Help and the Recovery cookbook first (including from a phone or second device), then create the restore point before you Apply. You do not have to rush: Dry Run never changes the system.

4. Preview, then harden

Step	Menu	Why
Dry Run	1	Shows Would change vs Already OK without making system changes
Security audit	2	Optional posture sample
Sections	4	Enable only what you understand; leave risky options off until you are ready
DNS (optional)	D	Saves preference only until A (Apply DNS now) or main 8; Apply snapshots prior DNS (DPAPI) and enables DoH Encrypted for known resolvers
RDP host lock (optional)	Section RdpHostLock	Off by default; denies this PC as an RDP host (separate from firewall group lock)
LAN hygiene (optional)	Section LanHygiene	Off by default; workstation leaks/NIC power-save only. Does not assume an ISP modem. LAN hygiene
Browsers (optional)	6	Applies only to installed Firefox, Chrome, or Brave; ECH is never enabled by default
Quick Harden or Apply	7 or 8	Restore-point gate, then type YES to confirm

5. After Apply

• Reboot if LSA Protection or optional features require it.
• Run Dry Run again and look for calm Already OK lines.
• If something broke: use Bastion Recovery (main menu 9) when the app still starts, and follow the Recovery cookbook. The site Help page works from another device while you repair this machine. Use Recovery hubs rather than one-off PowerShell so Bastion status and reverse paths stay accurate.

Honest expectations

• Bastion makes real system changes (firewall, services, registry, Defender, optional AppX, and more).
• Print Spooler, discovery, RDP/WinRM, Xbox, Widgets, OneDrive, and some games can be affected.
• Bastion is not for work, school, domain-joined, or MDM-managed devices.
• Bastion is not an antivirus.
• License: GNU GPLv3 (LICENSE and NOTICE in the zip). Bastion is free software; if you distribute a modified Bastion, it must remain GPLv3 with source. See the FAQ.

Continue reading: Hardening workflow · Recovery cookbook · Games and StrictHandle · FAQ · site Help