Home

Awesome

Windows 11 Secure Group Policy

A local group policy intended for standalone Windows 11 devices. It aims to improve privacy, security, and performance, in that order.

All settings are maintained in a single PolicyRules file that is applied with LGPO. Security features that send data to Microsoft, such as SmartScreen, are disabled, deviating from Microsoft's Security Baseline. Some settings are only effective on the Enterprise edition.

The target Feature Update version is Windows 11 23H2. This prevents automatic updates to the next release before the policy is updated with new settings.

Installation

Run install.cmd as an Administrator and restart the computer.

Saving local policy

Run savelocal.cmd <out-file> <policy-name> or savewin11.cmd (creates Win11-Local.PolicyRules) as an Administrator to save the local group policy as a PolicyRules file.

Warning: This will overwrite the contents of C:\GPO.

Comparing policies

Download and use the Policy Analyzer to compare PolicyRules files. Make sure you configure it to use the repository's PolicyDefinitions directory rather than C:\Windows\PolicyDefinitions.

Updating policy

When LGPO.exe and GPO2PolicyRules.exe export the local policy, they include many default settings that shouldn't be overwritten when applying the resulting PolicyRules file. There is also a bug in handling (Default) registry values. These are annoyances that prevent a clean install/save roundtrip and add noise when comparing against Microsoft's Security Baseline. Default settings were manually removed from Win11.PolicyRules by doing a three-way comparison between it, MSFT-Win11.PolicyRules, and Win11-CleanInstall.PolicyRules. To avoid reverting these edits, any updates to the policy must be merged in manually:

  1. Use gpedit.msc to modify the local policy.
  2. Run savewin11.cmd to create Win11-Local.PolicyRules file (not version-controlled).
  3. Diff and copy the relevant settings to Win11.PolicyRules.

To update the policy for a new Windows feature release:

  1. Download and install the new ISO in a Hyper-V VM.
  2. Configure VM enhanced session settings to redirect the host drive that contains this repository.
  3. Run cmd.exe as an Administrator in the VM.
  4. Map host drive for easier access: net use Z: \\tsclient\<drive>\<path-to-repo>
  5. Update and copy over the templates as described in the next section. Update this file with new version information.
  6. Save an updated Win11-CleanInstall.PolicyRules file.
  7. Install the current policy and restart.
  8. Follow the steps above to update the policy, comparing it against the new security baselines.

Templates

Templates contained in the PolicyDefinitions directory:

  1. Windows 11 Enterprise 23H2 ISO (22621.2428)
  2. Windows 11 v23H2 Security Baseline
  3. Windows Restricted Traffic Limited Functionality Baseline - Windows 11 23H2
  4. Microsoft Edge (119.0.2151.72)
  5. Mozilla Firefox (5.4)

Before editing the policy with gpedit.msc, copy the templates to C:\Windows\PolicyDefinitions. Overwriting existing files is not recommended because it requires ownership changes, which makes SFC unhappy, which may break Windows Update. In general, it's better to start with a VM running a matching version of Windows. For each new release, the PolicyDefinitions directory should be rebuilt from scratch by copying the templates over in the listed order to ensure removal of outdated templates.

To extract PolicyDefinitions from a Windows ISO:

  1. Mount the ISO file.
  2. Open sources\install.wim with 7-Zip.
  3. Check [1].xml for the appropriate image index and build version.
  4. Extract \<N>\Windows\PolicyDefinitions.

Notes

Settings without a template

The following registry entries do not have an associated template and are treated as preference-type settings that are not removed automatically when no longer applied by the policy: