WinSecMon Windows security posture, assessed in minutes.
WinSecMon is a read-only, agentless assessment engine that inspects a Windows host against 137 checks across 20 security domains — from Active Directory and ADCS to attack paths, accounts, and host exposure — and produces forensic-grade, tamper-evident reports.
Built for real Windows estates
One pass surfaces the misconfigurations and attack paths that matter — mapped to the techniques adversaries actually use.
Active Directory
Privileged group hygiene, delegation, Kerberos weaknesses, AdminSDHolder and domain-head ACLs.
Certificate Services (ADCS)
ESC1–ESC11 template and enrollment misconfigurations, including HTTP web-enrollment relay (ESC8).
Attack paths
DCSync rights, dangerous ACLs and privilege-escalation chains toward tier-0 assets.
Accounts & policy
Password policy, stale and non-expiring accounts, LAPS, audit policy and account hardening.
Host exposure
Exposed services, legacy protocols (SMBv1, PSv2), firewall posture and remote-access surface.
Forensic evidence
Every report ships with a SHA-256 evidence manifest and tamper-evident integrity verification.
Three steps, no infrastructure
Drop the package on a host, run it elevated, and collect a signed report. No server, database or agent required.
Run
Launch WINSECMON.exe elevated. It self-elevates and runs entirely in memory,
read-only.
Assess
Collectors gather host, AD, ADCS and policy state; 137 checks evaluate posture against known techniques.
Report
Get HTML, CSV and JSON reports with severity, evidence and remediation — plus an integrity manifest.
Download WinSecMon
Try the current pre-release build on a test or lab host and help shape the 2.0 release.
Reading the results, not just collecting them
Full documentation covers requirements, trust setup, profiles, the check catalog, and the forensic evidence model.