Scripting Endpoint Hardening for MSPs: CIS Benchmarks via PowerShell

Cybersecurity threats are always evolving, so Managed Service Providers (MSPs) and IT administrators must keep their endpoints secure to protect their clients and operations. In response, the Center for Internet Security (CIS) developed the CIS Benchmarks, which set the standards for stronger cybersecurity. However, applying their configuration recommendations can be time-consuming and error-prone.

To make this task of endpoint hardening a lot easier, consider the automated approach. Keep reading to learn how to use PowerShell scripts with supplemental registry edits, CMD scripts, and Group Policy deployments to secure devices across your systems.

How to automate CIS Benchmarks to harden MSP endpoints

For Windows environments, MSPs and IT professionals will have to enforce hundreds of configuration settings to meet industry standards set by CIS Benchmarks, so manually applying each one is not recommended. Here are some examples of how you can use PowerShell to automate these CIS-aligned configurations, including other workarounds for different needs and environments.

📌 Prerequisites:

• Windows 10 or 11 with Pro or Enterprise edition
• Administrator privileges
• Knowledge of CIS Benchmarks (Level 1 or 2)
• Optional: Access to Active Directory, Intune, or NinjaOne

💡Tip: Check Things to look out for before proceeding.

📌 Recommended deployment strategies:

Method 1: Using PowerShell to apply CIS Benchmark settings

PowerShell can directly automate local security policies, services, audit settings, and system configurations via script. Therefore, it can easily enforce hundreds of CIS controls and create repeatable modules for bulk deployment. Below are a few CIS Benchmark PowerShell scripts you can combine into modules or use DSC (Desired State Configuration) for repeatable deployment.

📌 Use Cases:

• Automating hardening for new device onboarding
• Quickly deploying security controls to endpoints in non-domain environments

📌 Prerequisites:

• PowerShell 5.1 or later (Verify Your PowerShell Version)
• Administrator privileges

Sample scripts:

1. Disable legacy SMBv1 protocol (prevent exploitation of legacy SMB vulnerabilities)

Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart

2. Disable guest account (reduce risk of unauthorized access)

Set-LocalUser -Name “Guest” -Enabled $false

3. Enforce password complexity (modify and reapply local security policy)

secedit /export /cfg c:\secpol.cfg (gc c:\secpol.cfg).replace
(“PasswordComplexity = 0″,”PasswordComplexity = 1”) | Set-Content c:\secpol.cfg
secedit /configure /db c:\windows\security\local.sdb /cfg c:\secpol.cfg /areas SECURITYPOLICY

4. Enable audit logging (ensure both successful and failed logon attempts are tracked)

auditpol /set /subcategory:”Logon” /success:enable /failure:enable

Method 2: Using Registry Editor for configuration enforcement

For more precise hardening, you can directly edit the Windows Registry. Many CIS controls map directly to specific registry keys, so automating registry modifications is also viable. Below are registry edits that you can apply via .reg files or PowerShell (Set-ItemProperty), or deploy via NinjaOne or GPO.

📌 Use Cases:

• Applying settings not exposed in Group Policy
• Backstopping GPO-based hardening with local enforcements

📌 Prerequisite: Administrator access to target endpoints

Sample registry modifications:

1. Disable Windows AutoRun (mitigate USB-based malware execution)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Policies\Explorer] “NoDriveTypeAutoRun”=dword:000000ff

2. Restrict anonymous SID enumeration (prevent user account probing)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Lsa] “RestrictAnonymousSAM”=dword:00000001

Method 3: Using CMD for system tweaks and validation

CMD scripting is ideal for legacy systems and quick system changes. It is also useful in validating configurations in older environments that may lack PowerShell or modern tools. Here are some CMD scripts you can chain with taskkill, net stop, or sc config commands to further harden services.

📌 Use Cases:

• Hardening offline systems
• Running quick remediation tasks during support calls or remote sessions

📌 Prerequisite:

• CMD access
• Administrator privileges

Sample commands:

1. Disable remote assistance (reduce remote support attack surface)

reg add “HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance” /v fAllowToGetHelp /t REG_DWORD /d 0 /f

2. Disable NetBIOS over TCP/IP (mitigate lateral movement risks)

wmic nicconfig where “IPEnabled=true” call SetTcpipNetbios 2

3. Export current security configuration for review or backup

secedit /export /cfg C:\cfg.txt

Method 4: Using Group Policy (GPO) to centralize enforcement

MSPs can also use GPO to centralize the configuration of hundreds of CIS settings across domain-joined systems. It’s the most scalable approach in Active Directory environments.

📌 Use Cases:

• Maintaining a secure baseline across client networks
• Enforcing high-security CIS Level 2 controls
• Managing hybrid environments alongside Intune/NinjaOne

📌 Prerequisites:

• Group Policy Management Console (GPMC) access
• An Active Directory environment
• Administrative privileges

Steps:

1. Open the Group Policy Management Console (GPMC) on a domain controller or management system. Press Windows key + R, type “gpmc.msc,” and press Enter.
2. Create or edit a GPO targeting your security baseline.
3. Configure the policies under: Computer Configuration > Windows Settings > Security Settings
4. Some CIS-relevant policies to configure:
   • Password Policy (under Account Policies): Enforce complexity, expiration, and history
   • User Rights Assignment (under Local Policies): Restrict “Log on locally” and deny access
   • Security Options: Disable LM responses and anonymous access
   • Audit policies: Enable advanced logging
   • Windows Defender & firewall settings: Standardize protection
5. Run gpupdate /force in an elevated Command Prompt on client machines to apply the policy.
6. Optional: Use Microsoft Security Compliance Toolkit or CIS GPO import files to jump-start configuration.

⚠️ Things to look out for

What is a CIS benchmark?

CIS Benchmarks are a set of prescriptive best practices for securing IT systems and data. They offer guidance on reducing vulnerabilities and hardening system configurations. Additionally, these standards are:

• Developed by experts, from cybersecurity professionals to vendors and subject matter experts
• Applicable to a wide range of systems, including Windows, Linux, macOS, network devices, browsers, and cloud platforms
• Listed as detailed configuration settings with recommended values, rationales, and remediation steps
• Commonly addresses:
  1. User rights and audit policy
  2. Account lockout and password policies
  3. SMB, RDP, and remote access controls
  4. Service and feature disabling
  5. Windows Defender and firewall hardening
• Divided into two levels:
  1. Level 1: Basic security suitable for general-purpose systems and focuses on minimal user impact.
  2. Level 2: Advanced hardening for high-security environments, which may impact usability or functionality
• Aligned with standards like HIPAA, NIST, PCI-DSS, and ISO 27001
• Regularly revised to reflect current threats, vulnerabilities, and platform updates
• Publicly accessible at www.cisecurity.org/cis-benchmarks

Adopting these recommendations can help to set security baselines, minimize risk, and demonstrate due diligence to all parties involved.

Additional considerations for MSPs when implementing CIS Benchmarks

CIS Benchmark automation goes beyond simply running scripts or applying GPOs. If MSPs and IT teams want to successfully harden endpoint security, they must consider a few environment, compliance, and operational factors to prevent issues.

• Testing before deployment: CIS Benchmarks can significantly alter system behavior. Untested scripts may disable needed services or restrict valid user activity, so always test them in non-production environments.
• Benchmark level selection: Understand that Level 1 focuses on essential hardening without affecting usability, so it’s suitable for most business environments. On the other hand, Level 2 is intended for high-security systems. As such, stricter enforcement may impair user experience or app functionality.
• Baseline templates: Microsoft provides security baseline GPOs that may overlap with CIS Benchmarks. While they may be helpful, these templates are not full substitutes. Always opt for CIS as the primary standard when strict compliance is required.
• Audit trail: Logging all changes ensures traceability and compliance when auditors or security teams request evidence of applied scripts and modified registry entries.

Troubleshooting issues

PowerShell script failures

The execution policy may be too restrictive, or scripts may be blocked by system or antivirus settings. Check your current execution policy with this command:

Get-ExecutionPolicy -List

If needed, set it to RemoteSigned using this command:

Set-ExecutionPolicy RemoteSigned -Scope LocalMachine

This will allow local scripts while requiring signatures for remote ones. You should also check for AV or endpoint protection solutions that can block script execution, such as Defender or CrowdStrike.

GPO settings not applying

This may happen if the endpoint is not part of the correct Organizational Unit (OU), or WMI or security filters prevent policy application. Confirm that the setting applies to the device’s OU placement in Active Directory Users and Computers. You should also validate WMI filters on the GPO to ensure the system qualifies.

Conflicting settings

Group Policy may overwrite local settings enforced via PowerShell or registry on the next refresh cycle. Make sure to define your configuration hierarchy. Use PowerShell or the registry for first-time deployment, then switch to GPO for persistent enforcement.

Security log errors

Audit log settings may flood logs if they are too verbose. You can fine-tune logs to focus on critical categories, such as logon events, privilege use, system integrity, and account management. It may also be beneficial to set retention and size limits.

NinjaOne services that can help strengthen CIS Benchmark enforcement

NinjaOne can enhance the scalability and effectiveness of CIS Benchmark implementation by giving MSPs powerful automation, monitoring, and reporting capabilities.

Simplifying hardening via smart automation

Implementing CIS Benchmarks can be a lengthy process for MSPs and IT professionals when done manually. Therefore, automation using PowerShell scripting, registry modifications, command-line tools, and Group Policy should help ensure enforcement consistency. These should improve endpoint security while reducing misconfiguration risks.

Related topics:

• Complete Guide to Systems Hardening [Checklist]
• 9 Essential Steps of a Server Hardening Process
• Why Organizations Should Invest in Endpoint Hardening and Automation
• What Is Endpoint Security and How Does It Work?
• Start with endpoint security fundamentals and build from there