diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 3489056..57e19a0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -26,8 +26,10 @@ is what tunes the presets. Open an issue with the *Field report* template. anywhere else. - **Windows PowerShell 5.1 compatible, no external modules, no agents.** The design intent is a kit that runs on a bare server with nothing - installed. CI tests every change on Windows PowerShell 5.1 and - PowerShell 7; 5.1 is the minimum supported engine. + installed. PowerShell 7 is fully supported (CI tests every change on + both engines), but 5.1 stays the compatibility floor: it is what ships + with Windows and what Intune remediations execute under, so nothing + 5.1-incompatible can be merged. - **The never-do list is non-negotiable**: nothing that reboots, restarts services, shrinks logs, enables `CrashOnAuditFail`, sets "do not overwrite" retention, or applies blanket SACLs diff --git a/README.md b/README.md index c47de00..86ceaea 100644 --- a/README.md +++ b/README.md @@ -10,8 +10,9 @@ baselines with native PowerShell.** Enable the right event channels, advanced audit policy subcategories and registry settings; verify them repeatably; and get an independent second opinion from -[WELA](https://github.com/Yamato-Security/WELA) - all with plain Windows -PowerShell 5.1, no modules, no agents, no Sysmon. +[WELA](https://github.com/Yamato-Security/WELA) - all with plain +PowerShell: PowerShell 7 or the built-in Windows PowerShell 5.1, no +modules, no agents, no Sysmon. Targets **Windows Server 2019 / 2022 / 2025 and Windows 10 / 11**, standalone or domain joined. Version-specific items (Server 2025 / Win11 24H2 SMB @@ -70,7 +71,8 @@ own risk. ## Quick start -All commands from an elevated Windows PowerShell 5.1 prompt in the kit folder +All commands from an elevated PowerShell prompt in the kit folder - +PowerShell 7 or the built-in Windows PowerShell 5.1 both work (`New-LoggingBaseline.ps1` alone needs no elevation). If scripts are blocked, `Set-ExecutionPolicy -Scope Process RemoteSigned` unblocks the current window without persisting anything diff --git a/docs/commands.md b/docs/commands.md index 65203da..dae6de0 100644 --- a/docs/commands.md +++ b/docs/commands.md @@ -4,7 +4,9 @@ Every script, what it does, and the flags you'll actually use. They all read the same settings table (`LoggingBaseline.Settings.ps1`), so - given the same selection, and regenerating artefacts after any settings change - what you apply, what you verify and what you deploy can't disagree. -All scripts run on stock Windows PowerShell 5.1. +All of the kit's scripts run on PowerShell 7 and on stock Windows +PowerShell 5.1 - use whichever your host has. (WELA is Yamato's tool +with its own requirements; `Invoke-WELACheck.ps1` drives it either way.) ## Enable-LoggingBaseline.ps1 diff --git a/docs/getting-started.md b/docs/getting-started.md index a5ed445..10869be 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -26,8 +26,13 @@ and [MITRE ATT&CK](https://attack.mitre.org/).* ## Requirements - Windows Server 2019 / 2022 / 2025, or Windows 10 / 11 -- Windows PowerShell 5.1 (stock; the kit targets 5.1 - CI additionally - parses everything and runs the builders/generators under PowerShell 7) +- PowerShell: [PowerShell 7](https://learn.microsoft.com/powershell/scripting/whats-new/migrating-from-windows-powershell-51-to-powershell-7) + where installed, or the stock Windows PowerShell 5.1 that ships with + every supported Windows version - both work, and CI tests both. 5.1 is + the compatibility floor because it is always present (and + [Intune remediations run under Windows PowerShell](https://learn.microsoft.com/intune/intune-service/fundamentals/remediations), + so the generated packs must stay 5.1-clean), not a requirement to use + it. - Local Administrator for applying and verifying (the builders and generators need no elevation) - No modules, no agents, no internet access required