top of page

Vulnerability Scanner for Windows 10, 11 and Server

Updated: Jun 29, 2022

The purpose of the script is to check for vulnerabilities and common misconfigurations with Windows and installed applications. These issues can be abused by hackers or disgruntled workers providing privilege escalation routes from user to system and ultimately Domain Admin.

The vulnerability script has been tested on the latest versions of Windows 10, 11 and Server with PowerShell version 5.1 and outputs an HTML page.

Do not make changes to your IT systems based on the output of this report without a backup or testing, some of the suggestions are aimed at Domain joined clients and are likely to prevent Linux or legacy services from connecting to the domain.

#Downloading and Executing the Script

Download Tenaka/SecureReport (, then as an elevated user open with PowerShell_ise, Ctrl, A and then F8. The report will take a while to execute, potentially up to 30 minutes, please be patient.

The report is saved to C:\Securereport\FinishedReport.htm

Before everyone gets critical regarding the script formatting, some are due to how ConvertTo-HTML expects the data, most are to help those that aren’t familiar with scripting. There is a conscious decision not to use aliases or abbreviations and where possible to create variables.

#List of checks and balances:

Host Details, CPU, Bios, Windows Version

Accounts, Groups and Password Policy

Install Applications and installed Windows Updates

Virtualization, UEFI, Secure Boot, DMA, TPM and Bitlocker Settings

LSA, DLL Safe Search Order, Hypervisor Code Integrity

DLL Hijacking

Files not Signed (Authenticode)

Autologon Credentials in the Registry

Unquoted paths

Processes that contain passwords in the command line

Enabled legacy Network protocols

Registry Keys with weak Permissions

System Folders with weak Permissions

Drivers not Signed

Authenticode Hash Mis-Match

Firewall settings and rules

#TPM and Bitlocker

"TPM and Bitlocker protect against offline attack from USB and mounting the local Windows system then accessing the local data. 'TPM and Pin' enhances Bitlocker by preventing LPC Bus (Low Pin Count) bypasses of Bitlocker with TPM.

Further information can be found @

#Secure Boot

Secure Boot is a security standard to ensure only trusted OEM software is allowed at boot. At startup, the UEFI and boot software's digital signatures are validated preventing rootkits

More on Secure Boot can be found @

Virtualization-based security (VBS), isolates core system resources to create secure regions of memory. Enabling VBS allows for Hypervisor-Enforced Code Integrity (HVCI), Device Guard and Credential Guard.

Further information can be found @

#Hypervisor Enforced Code Integrity

Hypervisor Enforced Code Integrity prevents the loading of unsigned kernel-mode drivers and system binaries from being loaded into system memory.

Further information can be found @

#Security Options

Prevent credential relay with Impacket and Man in the Middle by Digitally Signing for SMB and LDAP connections enforcement.

Further information can be found @

Enabling RunAsPPL for LSA Protection allows only digitally signed binaries to load as a protected process preventing credential theft and access by code injection and memory access by processes that aren’t signed.

Further information can be found @

#DLL Safe Search

When applications do not fully qualify the DLL path and instead allow searching the default behaviour if for the ‘Current Working Directory’ called 2nd in the list of directories. This allows an easy route to call malicious DLLs. Setting ‘DLL Safe Search’ mitigates the risk by moving CWD to later in the search order.

Further information can be found @

#DLL Hijacking (Permissions)

DLL Hijacking is when a malicious DLL replaces a legitimate DLL due to a path vulnerability. A program or service makes a call on that DLL gaining the privileges of that program or service. Additionally missing DLL's present a risk where a malicious DLL is dropped into a path where no current DLL exists but the program or service is making a call to that non-existent DLL.

This audit is reliant on programs being launched so that DLLs are loaded. Each process’s loaded DLL's are checked for permissions issues and whether they are signed.

The DLL hijacking audit does not currently check for missing DLL's being called. Process Monitor filtered for ‘NAME NOT FOUND’ and the path ends with ‘DLL’.

#Automatically Elevate User

Auto Elevate User is a setting that elevates users allowing them to install software without being an administrator.

#Password in Files

Searches the following locations:







Searches the following file extensions:

txt, ini, .xml

For the following words:

password, credential

Ignore these files as they contain the word 'Password' by default:







#Password embedded in Processes

Processes that contain credentials to authenticate and access applications. Launching Task Manager, Details and add ‘Command line’ to the view.

Checks "HKLM:\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" for any clear text credentials remaining from a MECM\SCCM\MDT deployment.

The Unquoted Path vulnerability is when a Windows Service's 'Path to Executable' contains spaces and is not wrapped in double-quotes providing a route to System.

Further information can be found @

#Legacy Network Protocols

LLMNR and other legacy network protocols can be used to steal password hashes.

Further information can be found @

#Permissions Weakness in Default System Directories - Write

System default Folders that allow a User the Write permissions. These can be abused by creating content in some of the allowable default locations. Prevent by applying Execution controls eg Applocker.


C:\PerfLogs C:\Program Files C:\Program Files (x86) C:\Windows

Expected folders that a user can Write to:




C:\Windows\System32\Tasks\Microsoft\Windows\RemoteApp and Desktop Connections Update


C:\Windows\SysWOW64\Tasks\Microsoft\Windows\RemoteApp and Desktop Connections Update


Further information can be found @

#Permissions Weakness in Default System Directories - Create Files

System default Folders that allow a User the CreateFile permissions. These can be abused by creating content in some of the allowable default locations. Prevent by applying Execution controls eg Applocker.

Expected folders that a user can CreateFiles to:

















Further information can be found @

#Permissions Weakness in Non-Default Directories

A vulnerability exists when enterprise software has been installed on the root of C:\. The default permissions allow a user to replace approved software binaries with malicious binaries.

Further information can be found @

#Files that are Writeable

System files that allow users to write can be swapped out for malicious software binaries.

Further information can be found @

Firewalls should always block inbound and exceptions should be to a named IP and Port.

Further information can be found @

187 views0 comments

Recent Posts

See All


Obtuvo 0 de 5 estrellas.
Aún no hay calificaciones

Agrega una calificación
bottom of page