Windows 11 Complete Security Check PowerShell Script

As an IT infrastructure manager, you know the drill: endpoints must stay patched, protected, and compliant. Manual checks across Windows Update, Defender, firewalls, BitLocker, and more eat hours. This read-only PowerShell script delivers a one-shot audit of 12 critical security controls on Windows 11—perfect for compliance reporting, team training, or daily health checks.

Run it as admin for full visibility (it warns if not). Color-coded output makes issues pop: Green for good, Red for action needed, Yellow for details.

Why This Script Rocks for SysAdmins

• Zero changes: Purely diagnostic—no installs, no tweaks.
• Comprehensive: Covers patching, AV, encryption, UEFI, and virtualization security.
• Fast: Executes in seconds, outputs to console (easy to pipe to file/email).
• Windows 11 optimized: Leverages modern cmdlets like Get-MpComputerStatus and Confirm-SecureBootUEFI.

Save as SecurityAudit.ps1 and run: .\SecurityAudit.ps1 | Tee-Object -FilePath "C:\Audit-$(Get-Date -Format 'yyyyMMdd-HHmm').txt"

Full Script Code

# Windows 11 Complete Security & Patch Status Check (Read-Only)

# Check if the script is running with administrator privileges
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Warning "Run as Administrator for full functionality."
}

# Windows Update Status (NEW)
Write-Host "`n🔄 Windows Update Status:" -ForegroundColor Cyan
$updateSession = New-Object -ComObject Microsoft.Update.Session
$updateSearcher = $updateSession.CreateUpdateSearcher()
$updates = $updateSearcher.Search("IsInstalled=0 and Type='Software'")
Write-Host "Pending Updates: " -NoNewline
if ($updates.Updates.Count -gt 0) {
    Write-Host "$($updates.Updates.Count) AVAILABLE" -ForegroundColor Red
    foreach ($update in $updates.Updates | Select-Object -First 3) {
        Write-Host "  - $($update.Title)" -ForegroundColor Yellow
    }
    if ($updates.Updates.Count -gt 3) { Write-Host "  ... and $($updates.Updates.Count-3) more" -ForegroundColor Yellow }
} else {
    Write-Host "0 (Fully Patched)" -ForegroundColor Green
}

# Microsoft Defender Status
Write-Host "`n🛡️ Microsoft Defender Status:" -ForegroundColor Cyan
$defenderStatus = Get-MpComputerStatus
Write-Host "Antivirus Enabled: " -NoNewline
if ($defenderStatus.AntivirusEnabled) { Write-Host "Yes" -ForegroundColor Green } else { Write-Host "No" -ForegroundColor Red }
Write-Host "Real-Time Protection: " -NoNewline
if ($defenderStatus.RealTimeProtectionEnabled) { Write-Host "Yes" -ForegroundColor Green } else { Write-Host "No" -ForegroundColor Red }
Write-Host "Tamper Protected: " -NoNewline
if ($defenderStatus.IsTamperProtected) { Write-Host "Yes" -ForegroundColor Green } else { Write-Host "No" -ForegroundColor Red }

# Firewall Status
Write-Host "`n🔥 Firewall Status:" -ForegroundColor Cyan
$firewallStatus = Get-NetFirewallProfile
foreach ($profile in $firewallStatus) {
    Write-Host "$($profile.Name) Profile: " -NoNewline
    if ($profile.Enabled) { Write-Host "Enabled" -ForegroundColor Green } else { Write-Host "Disabled" -ForegroundColor Red }
}

# Secure Boot Status
Write-Host "`n🔒 Secure Boot:" -ForegroundColor Cyan
try {
    $secureBoot = Confirm-SecureBootUEFI
    Write-Host "Status: " -NoNewline
    if ($secureBoot) { Write-Host "Enabled" -ForegroundColor Green } else { Write-Host "Disabled" -ForegroundColor Red }
} catch {
    Write-Host "Status: Not supported or error occurred" -ForegroundColor Yellow
}

# BitLocker Status
Write-Host "`n💾 BitLocker Status:" -ForegroundColor Cyan
$bitLockerStatus = Get-BitLockerVolume
foreach ($volume in $bitLockerStatus) {
    Write-Host "$($volume.MountPoint) Protection: " -NoNewline
    if ($volume.ProtectionStatus -eq "On") { Write-Host "On" -ForegroundColor Green } else { Write-Host "Off" -ForegroundColor Red }
}

# VBS and Credential Guard
Write-Host "`n🎯 VBS and Credential Guard:" -ForegroundColor Cyan
try {
    $deviceGuard = Get-CimInstance -ClassName Win32_DeviceGuard -ErrorAction Stop
    $vbsStatus = if ($deviceGuard.VirtualizationBasedSecurityStatus -eq 2) { "Enabled" } else { "Disabled" }
    $credGuard = if ($deviceGuard.SecurityServicesRunning -contains 1) { "Enabled" } else { "Disabled" }
    Write-Host "VBS: " -NoNewline
    if ($vbsStatus -eq "Enabled") { Write-Host "Enabled" -ForegroundColor Green } else { Write-Host "Disabled" -ForegroundColor Red }
    Write-Host "Credential Guard: " -NoNewline
    if ($credGuard -eq "Enabled") { Write-Host "Enabled" -ForegroundColor Green } else { Write-Host "Disabled" -ForegroundColor Red }
} catch {
    Write-Host "Status not available on this system" -ForegroundColor Yellow
}

# TPM Status
Write-Host "`n🔑 TPM Status:" -ForegroundColor Cyan
$tpmStatus = Get-Tpm
Write-Host "TPM Present: " -NoNewline
if ($tpmStatus.TpmPresent) { Write-Host "Yes" -ForegroundColor Green } else { Write-Host "No" -ForegroundColor Red }
Write-Host "TPM Ready: " -NoNewline
if ($tpmStatus.TpmReady) { Write-Host "Yes" -ForegroundColor Green } else { Write-Host "No" -ForegroundColor Red }

# Summary
Write-Host "`n" + "="*60 -ForegroundColor Cyan
Write-Host "✅ SECURITY & PATCH AUDIT COMPLETE" -ForegroundColor Cyan
Write-Host "📊 Total Items Checked: 12" -ForegroundColor White

Sample Output

🔄 Windows Update Status:
Pending Updates: 0 (Fully Patched)

🛡️ Microsoft Defender Status:
Antivirus Enabled: Yes
Real-Time Protection: Yes
Tamper Protected: Yes

🔥 Firewall Status:
Domain Profile: Enabled
Private Profile: Enabled
Public Profile: Enabled

… [continues with all checks]

============================================================
✅ SECURITY & PATCH AUDIT COMPLETE
📊 Total Items Checked: 12