Why it exists
Most Windows hardening scripts are written for administrators who can read them. Most people who own a Windows 11 PC cannot, and the scripts they find online change dozens of settings at once with no record of what was there before. I wanted a tool a non-expert could run safely, and that I would be comfortable giving to family.
What it does
A single window with six tabs: a dashboard with a full scan, a security audit with tiered fixes, debloat, a compromise check written for non-experts, startup management and a restore and log view. It runs from Start.bat on the PowerShell 5.1 that ships with Windows. There is nothing to install and no unsigned binary for SmartScreen to quarantine.
The design rules
Scans are read-only. Nothing changes without a tick and a confirmation. Before the first change the tool creates a System Restore point. Every change writes its before-state to a JSON backup, appends an undo step to a rollback script and is re-read afterwards to confirm it applied.
The rollback script runs elevated, so where it lives matters. When the tool runs as administrator it writes backups and the rollback script to a folder under %ProgramData% that only Administrators and SYSTEM can write to. A rollback script in a user-writable folder would be a privilege escalation path waiting for a non-admin process to edit it.
Third-party DFIR tools are opt-in and never bundled. Hayabusa and Chainsaw download from their official GitHub releases only after a consent screen, and only if the archive matches a pinned SHA-256. If no trusted hash is available the download is refused.
Where it stands
Public on GitHub under the MIT licence and under active development. The design write-up goes deeper on the trade-offs.