Windows 11 DefCon Hardening v1.2.5

Fixes Restore-HardeningBackup having no error handling across its restore loop: a single control throwing during a real rollback previously aborted every remaining control silently, with no indication of what did or didn't make it back -- the same class of gap PR #10/#11 fixed on the apply-side backup-snapshot loop, now applied to the restore loop itself. Restore-HardeningControlState returns an explicit Restored/Skipped outcome for every control instead of a bare return, and Restore-HardeningBackup wraps each control's restore in try/catch, building a per-control Id/Title/Status/Message result instead of running as a void loop. Restore-Windows11Hardening's report now includes that full Results array plus EndpointProtectionBefore/EndpointProtectionAfter, and derives RestoredControl from the actual count of restored controls instead of the raw backup file's entry count. Found during this project's first live, non-mocked, end-to-end apply-then-restore validation against a real 131-control Conference profile run on a disposable VM, which is also the first time Restore-Windows11Hardening has been exercised against real state changes rather than only unit-tested with mocks.

Full quality gate passed for this tag: unit, functional, integration, Windows PowerShell 5.1 compatibility, static analysis, and code coverage at or above the enforced 99.5% floor. This validates the release build only; the destructive disposable-VM system suite and physical-hardware checks in docs/Testing.md must still be rehearsed separately before deploying to a travel laptop.

What's Changed

• fix: make restore resilient to per-control failures and report results by @scweeks in #17
• chore: bump ModuleVersion to 1.2.5 and update release notes for #17 by @scweeks in #18

Full Changelog: v1.2.4...v1.2.5

Windows 11 DefCon Hardening v1.2.4

Fixes Get-Windows11HardeningAssessment reporting 24 raw Error results out of 131 controls on a Conference laptop running third-party antivirus/firewall -- this project's own recommended setup. The audit path never shared Invoke-Windows11Hardening's existing skip-with-reason logic for Defender/ASR and Firewall controls when a healthy third-party product is present, so it called Get-MpPreference directly and surfaced a raw CimException instead of an honest skip; the decision is now a shared Get-HardeningControlSkipReason helper so audit and apply agree. Fixes inconsistent error handling on elevation-sensitive assessment reads: Get-Tpm can return a plain diagnostic string instead of throwing when the session is not elevated, which previously surfaced as a confusing "property cannot be found" error instead of a clean, actionable message; the TPM and BitLocker state reads now match the already-correct SecureBoot pattern. Fixes Invoke-Windows11Hardening -WhatIf silently truncating the control catalog from 131 controls to the 6 defined directly in the root Controls.psd1, with no error or warning -- PowerShell's ambient $WhatIfPreference was suppressing a ForEach-Object bareword-member call used to discover the five category-specific control files; confirmed live on real hardware both before and after the fix. Fixes the control catalog export writing a byte-order mark on Windows PowerShell 5.1 but not PowerShell 7+, which caused every quality-gate run on 5.1 to spuriously modify docs/Control-Catalog.csv; the export now writes through .NET directly with an explicit no-BOM encoding, which is edition-independent. All four fixes were found and confirmed through live, non-destructive validation against a real, previously-unhardened Windows 11 Home travel laptop -- no control's applied behavior changed, only audit-path correctness and error-message quality.

Full quality gate passed for this tag: unit, functional, integration, Windows PowerShell 5.1 compatibility, static analysis, and code coverage at or above the enforced 99.5% floor. This validates the release build only; the destructive disposable-VM system suite and physical-hardware checks in docs/Testing.md must still be rehearsed separately before deploying to a travel laptop.

What's Changed

• Codex/defcon34 hardening framework by @scweeks in #1
• Preserve Windows Hello, fix effective firewall auditing, and stabilize test/rollback reliability by @scweeks in #2
• docs: fix broken code fence and clarify README onboarding by @scweeks in #3
• feat: add tag-triggered release workflow and status badges by @scweeks in #4
• docs: replace placeholder SECURITY.md, add CONTRIBUTING and CODE_OF_CONDUCT by @scweeks in #5
• docs: add AGENTS.md, CLAUDE.md/CODEX.md pointers, and a PR template by @scweeks in #6
• fix: repo is private, so replace shields.io badges with self-hosted SVGs by @scweeks in #7
• feat: make Get-Windows11SystemInfo public and surface it in every report by @scweeks in #8
• fix: derive IsWindows11 from build number, not the ProductName string by @scweeks in #9
• fix: report which control failed instead of a blanket assertion by @scweeks in #10
• fix: don't crash the whole apply run on a transient state-read error by @scweeks in #11
• fix: verify Public firewall local-rule flags against localhost, not ActiveStore by @scweeks in #12
• fix: skip Defender/firewall audit checks and stop raw provider errors on elevation-sensitive reads by @scweeks in #13
• fix: stop -WhatIf from silently truncating the control catalog to 6 controls by @scweeks in #14
• fix: write the control catalog export with an edition-independent no-BOM encoding by @scweeks in #15
• chore: bump ModuleVersion to 1.2.4 and update release notes for #13-#15 by @scweeks in #16

New Contributors

• @scweeks made their first contribution in #1

Full Changelog: https://github.com/scweeks/Win11-Hardening/commits/v1.2.4