From bed64e68825f9b4b532fd3eb56f874e3eb0c88ed Mon Sep 17 00:00:00 2001 From: spydisec <9101327+spydisec@users.noreply.github.com> Date: Tue, 1 Sep 2026 09:25:20 +1000 Subject: [PATCH 1/2] Wording: PowerShell 7 is a first-class shell, 5.1 is the floor The docs read as "use Windows PowerShell 5.1" in places. Reworded README quick start, Commands, Getting Started requirements and CONTRIBUTING so both engines are explicitly supported (CI tests both, no 5.1-only cmdlets anywhere): PowerShell 7 where installed, with 5.1 as the compatibility floor because it ships with Windows and is what Intune runs the remediation packs under. Getting Started links Microsoft's 5.1 -> 7 migration guide. Script headers already said "5.1+" and are unchanged. Co-Authored-By: Claude Fable 5 --- CONTRIBUTING.md | 6 ++++-- README.md | 8 +++++--- docs/commands.md | 3 ++- docs/getting-started.md | 7 +++++-- 4 files changed, 16 insertions(+), 8 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 3489056..57e19a0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -26,8 +26,10 @@ is what tunes the presets. Open an issue with the *Field report* template. anywhere else. - **Windows PowerShell 5.1 compatible, no external modules, no agents.** The design intent is a kit that runs on a bare server with nothing - installed. CI tests every change on Windows PowerShell 5.1 and - PowerShell 7; 5.1 is the minimum supported engine. + installed. PowerShell 7 is fully supported (CI tests every change on + both engines), but 5.1 stays the compatibility floor: it is what ships + with Windows and what Intune remediations execute under, so nothing + 5.1-incompatible can be merged. - **The never-do list is non-negotiable**: nothing that reboots, restarts services, shrinks logs, enables `CrashOnAuditFail`, sets "do not overwrite" retention, or applies blanket SACLs diff --git a/README.md b/README.md index c47de00..86ceaea 100644 --- a/README.md +++ b/README.md @@ -10,8 +10,9 @@ baselines with native PowerShell.** Enable the right event channels, advanced audit policy subcategories and registry settings; verify them repeatably; and get an independent second opinion from -[WELA](https://github.com/Yamato-Security/WELA) - all with plain Windows -PowerShell 5.1, no modules, no agents, no Sysmon. +[WELA](https://github.com/Yamato-Security/WELA) - all with plain +PowerShell: PowerShell 7 or the built-in Windows PowerShell 5.1, no +modules, no agents, no Sysmon. Targets **Windows Server 2019 / 2022 / 2025 and Windows 10 / 11**, standalone or domain joined. Version-specific items (Server 2025 / Win11 24H2 SMB @@ -70,7 +71,8 @@ own risk. ## Quick start -All commands from an elevated Windows PowerShell 5.1 prompt in the kit folder +All commands from an elevated PowerShell prompt in the kit folder - +PowerShell 7 or the built-in Windows PowerShell 5.1 both work (`New-LoggingBaseline.ps1` alone needs no elevation). If scripts are blocked, `Set-ExecutionPolicy -Scope Process RemoteSigned` unblocks the current window without persisting anything diff --git a/docs/commands.md b/docs/commands.md index 65203da..6e277c9 100644 --- a/docs/commands.md +++ b/docs/commands.md @@ -4,7 +4,8 @@ Every script, what it does, and the flags you'll actually use. They all read the same settings table (`LoggingBaseline.Settings.ps1`), so - given the same selection, and regenerating artefacts after any settings change - what you apply, what you verify and what you deploy can't disagree. -All scripts run on stock Windows PowerShell 5.1. +All scripts run on PowerShell 7 and on stock Windows PowerShell 5.1 - +use whichever your host has. ## Enable-LoggingBaseline.ps1 diff --git a/docs/getting-started.md b/docs/getting-started.md index a5ed445..d9bd62d 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -26,8 +26,11 @@ and [MITRE ATT&CK](https://attack.mitre.org/).* ## Requirements - Windows Server 2019 / 2022 / 2025, or Windows 10 / 11 -- Windows PowerShell 5.1 (stock; the kit targets 5.1 - CI additionally - parses everything and runs the builders/generators under PowerShell 7) +- PowerShell: [PowerShell 7](https://learn.microsoft.com/powershell/scripting/whats-new/migrating-from-windows-powershell-51-to-powershell-7) + where installed, or the stock Windows PowerShell 5.1 that ships with + every supported Windows version - both work, and CI tests both. 5.1 is + the compatibility floor because it is always present (and it is what + Intune runs the remediation packs under), not a requirement to use it. - Local Administrator for applying and verifying (the builders and generators need no elevation) - No modules, no agents, no internet access required From 2f1513de3b2420794c9e23b7d5a7fea1da6e1a42 Mon Sep 17 00:00:00 2001 From: spydisec <9101327+spydisec@users.noreply.github.com> Date: Tue, 1 Sep 2026 09:32:43 +1000 Subject: [PATCH 2/2] Address CodeRabbit: source the Intune claim, scope 'all scripts' to the kit Getting Started links Microsoft's remediations doc for the Windows-PowerShell execution context; Commands clarifies the engine statement covers the kit's own scripts, with WELA having its own requirements. Co-Authored-By: Claude Fable 5 --- docs/commands.md | 5 +++-- docs/getting-started.md | 6 ++++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/docs/commands.md b/docs/commands.md index 6e277c9..dae6de0 100644 --- a/docs/commands.md +++ b/docs/commands.md @@ -4,8 +4,9 @@ Every script, what it does, and the flags you'll actually use. They all read the same settings table (`LoggingBaseline.Settings.ps1`), so - given the same selection, and regenerating artefacts after any settings change - what you apply, what you verify and what you deploy can't disagree. -All scripts run on PowerShell 7 and on stock Windows PowerShell 5.1 - -use whichever your host has. +All of the kit's scripts run on PowerShell 7 and on stock Windows +PowerShell 5.1 - use whichever your host has. (WELA is Yamato's tool +with its own requirements; `Invoke-WELACheck.ps1` drives it either way.) ## Enable-LoggingBaseline.ps1 diff --git a/docs/getting-started.md b/docs/getting-started.md index d9bd62d..10869be 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -29,8 +29,10 @@ and [MITRE ATT&CK](https://attack.mitre.org/).* - PowerShell: [PowerShell 7](https://learn.microsoft.com/powershell/scripting/whats-new/migrating-from-windows-powershell-51-to-powershell-7) where installed, or the stock Windows PowerShell 5.1 that ships with every supported Windows version - both work, and CI tests both. 5.1 is - the compatibility floor because it is always present (and it is what - Intune runs the remediation packs under), not a requirement to use it. + the compatibility floor because it is always present (and + [Intune remediations run under Windows PowerShell](https://learn.microsoft.com/intune/intune-service/fundamentals/remediations), + so the generated packs must stay 5.1-clean), not a requirement to use + it. - Local Administrator for applying and verifying (the builders and generators need no elevation) - No modules, no agents, no internet access required