Windows 11 Security Book

Executive Summary: Modernizing Endpoint Defense with Windows 11

With the release of Windows 11, Microsoft established a new baseline for enterprise endpoint security, mandating hardware-rooted security features such as Trusted Platform Module (TPM 2.0), UEFI Secure Boot, and Virtualization-Based Security (VBS). However, default out-of-the-box configurations leave critical gaps that attackers exploit using pass-the-hash, ransomware, and memory injection techniques.

Windows 11 Security Book is the definitive 63-page technical hardening manual for Systems Administrators, Security Engineers, IT Infrastructure Leads, and Enterprise Consultants. Spanning 8 comprehensive modules, this book provides step-by-step PowerShell scripts, Group Policy Objects (GPOs), Intune CSP configurations, and registry keys for enforcing HVCI Code Integrity, isolating LSASS memory via Credential Guard (`RunAsPPL`), deploying Windows Defender Application Control (WDAC), and managing BitLocker 256-bit encryption.

Deep Dive: Core Windows 11 Hardening Mechanisms

The handbook provides ready-to-execute PowerShell scripts, Intune policy templates, and GPO XML exports across five core Windows 11 security subsystems:

1. Virtualization-Based Security (VBS) & HVCI Memory Integrity

Isolating kernel code execution in a secure hypervisor enclave:

• HVCI Mechanics: Hypervisor-Protected Code Integrity utilizes the Windows Hypervisor to restrict unsigned kernel-mode drivers from executing in memory, mitigating driver-level exploit vectors.

2. Credential Guard & LSA Protection (`RunAsPPL`)

Neutralizing Mimikatz LSASS password hash dumping:

• Protected Process Light (PPL): Enforcing `RunAsPPL = 1` prevents non-system processes (even running as local Administrator) from injecting code or reading memory inside `lsass.exe`.

3. Windows Defender Application Control (WDAC)

Next-generation AppLocker replacing executable whitelisting:

• WDAC Policy XML: Defining code integrity rules that restrict execution strictly to Microsoft-signed or trusted enterprise PKI binaries.

Field Engineering: PowerShell Windows 11 Hardening Script

Chapter 3 of the handbook provides practical PowerShell commands for enforcing LSA Protection and BitLocker XTS-AES 256 encryption:

# 1. Enforce LSA Protection (LSASS RunAsPPL)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL" -Value 1 -Type DWord
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPLBoot" -Value 1 -Type DWord

# 2. Enable Hypervisor-Protected Code Integrity (HVCI)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" -Name "Enabled" -Value 1 -Type DWord

# 3. Disable Legacy SMBv1 & LLMNR Resolution
Disable-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol" -NoRestart
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Name "EnableMulticast" -Value 0 -Type DWord

# 4. Enable BitLocker XTS-AES 256 Drive Encryption
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector
Write-Host "[+] Windows 11 Hardening Rules Applied! Reboot System to Finalize." -ForegroundColor Green

# Generate Standard Windows Defender Application Control (WDAC) Policy
New-CIPolicy -FilePath "C:\WDAC\EnterprisePolicy.xml" -Level Publisher -Fallback Hash
Set-RuleOption -FilePath "C:\WDAC\EnterprisePolicy.xml" -Option 3 # Enable Audit Mode
ConvertFrom-CIPolicy "C:\WDAC\EnterprisePolicy.xml" "C:\Windows\System32\CodeIntegrity\CIPolicies\Active\{PolicyID}.cip"

Complete Table of Contents & Module Syllabus

• Module 01 Windows 11 Architecture & Hardware Root of Trust

  Pages 1–8
  TPM 2.0 requirement, UEFI Secure Boot, Measured Boot, and Pluton security processor integration.
• Module 02 Virtualization-Based Security (VBS) & HVCI Code Integrity

  Pages 9–16
  Hypervisor-Protected Code Integrity, memory isolation, kernel DMA protection, and disabling legacy vulnerable drivers.
• Module 03 Credential Guard, LSA Protection & Anti-Mimikatz Hardening

  Pages 17–24
  LSASS process isolation (`RunAsPPL`), Credential Guard architecture, blocking pass-the-hash attacks, and disabling WDigest.
• Module 04 BitLocker XTS-AES 256 & Storage Encryption Architecture

  Pages 25–32
  Configuring XTS-AES 256-bit encryption, TPM + PIN protectors, Active Directory key escrow, and BitLocker To Go.
• Module 05 Windows Defender Application Control (WDAC) & AppLocker

  Pages 33–40
  Generating WDAC XML policies, audit mode testing, binary publisher rules, Smart App Control, and AppLocker rules.
• Module 06 Identity Security: Windows Hello for Business & FIDO2 Passkeys

  Pages 41–48
  Deploying FIDO2 passwordless authentication, Windows Hello biometric encryption, cloud trust, and Entra ID integration.
• Module 07 Attack Surface Reduction (ASR) & Defender Antivirus Tuning

  Pages 49–56
  Configuring 16 Attack Surface Reduction rules, blocking Office macro execution, network protection, and Microsoft Defender EDR integration.
• Module 08 Intune CSP & Group Policy Hardening Benchmarks

  Pages 57–63
  Deploying CIS/DISA Security Baselines via Microsoft Intune and GPOs, audit logging configuration, and endpoint compliance tracking.

Who Should Read This Handbook?

This handbook is designed for Windows system administrators and enterprise security teams:

Verified Systems Admin & Security Engineer Reviews

Frequently Asked Questions