Aegis Win11 Enterprise Deployment Toolkit

Deterministic Low-Latency Systems Engineering & Zero-Trust Device Foundation

Aegis Win11 is an automated, unattended provisioning pipeline engineered to replace arbitrary optimization and debloating scripts with verifiable systems engineering. It establishes a defense-in-depth posture while preventing runtime conflicts within high-performance workstations.

Standard OS stripping scripts regularly induce system failures by severing mandatory networking components (such as unbinding IPv6), degrading process boundaries (grouping svchost.exe instances to claim trivial memory reductions), disabling system memory paging mechanisms, or injecting unvalidated storage driver overrides. Aegis Win11 isolates telemetry, minimizes persistence vectors, and enforces Microsoft Defender Application Control (WDAC) driver blocklists while explicitly maintaining hardware abstraction layers, low-latency audio pipelines, and enterprise identity integration.

Every policy within Aegis Win11 is evaluated against four non-negotiable operational workstation targets:

• Digital Audio Workstations (DAWs): Preserves native ASIO hardware driver abstraction layers (Focusrite, Universal Audio, RME, Behringer, MOTU). Disables Audio Processing Objects (APOs) via DisableAllSoundEffects to eliminate DPC latency spikes while keeping DRM protected media pipelines (Widevine, PlayReady) operational. MMCSS Audio task thread priorities are locked to real-time (Priority = 8).
• Computer-Aided Design (CAD) & Rendering Suites: Maintains nested directory depths via NTFS Long Paths (LongPathsEnabled = 1), disables NTFS timestamp write operations (NtfsDisableLastAccessUpdate = 1), disables 8.3 short filename generation (NtfsDisable8dot3NameCreation = 1), and enforces Hardware-Accelerated GPU Scheduling (HAGS) for applications including Autodesk Revit, AutoCAD, Blender, and Adobe Creative Cloud.
• Competitive Gaming & Anti-Cheat Runtimes: Omits strict kernel-mode code integrity policies (CodeIntegrityPolicy = 1) and system-wide Mandatory ASLR, ensuring compatibility with kernel-level anti-cheat platforms (Riot Vanguard, Easy Anti-Cheat, BattlEye) and local gaming clients (Steam, Epic Games).
• Enterprise Suites & Identity Management: Supports both standalone workstation topologies and enterprise domains via Microsoft Entra ID / Local Administrator Password Solution (LAPS) integration toggles, preserving Windows Remote Management (WinRM) and modern Kerberos/NTLMv2 authentication pathways.

Aegis Win11 aligns with technical controls from the Center for Internet Security (CIS) Microsoft Windows 11 Enterprise Benchmark (v3.0.0) and NIST SP 800-53 Rev 5 / NIST SP 800-171 Rev 2.

• CIS Level 1 Profile (Enterprise Baseline): ~24% direct implementation (~60 active configuration directives).
• CIS Level 2 Profile (High Security / Defense-in-Depth): ~11% selective implementation.
• Standalone Implementation (Non-Domain Applicable): 63.0% of CIS Level 1 and 75.9% of NIST SP 800-53 workstation controls.
• Network & Protocol Fortress: 100% compliance across all applicable standalone network boundaries.

To maintain credibility during external audits and peer review, the framework documents intentional deviations from the CIS Level 2 benchmark:

1. Process Mitigation (CIS 18.10.14.2.1): Bottom-Up ASLR, DEP, and SEHOP are enforced system-wide. Mandatory ASLR (MandatoryASLR) is intentionally omitted; enforcing Mandatory ASLR globally causes immediate load termination for binaries and third-party audio/graphics DLLs not compiled with /DYNAMICBASE.
2. PowerShell Constrained Language Mode (CIS 18.10.43.1): Not enforced globally via system policies. Constrained Language Mode completely halts automation scripts, CI/CD runners, and un-cataloged DAW package installation logic.
3. Controlled Folder Access (CIS 18.10.43.4.2): Defaulted to AuditMode. Enforcing CFA in Block mode stops creative software (FL Studio, Ableton, Autodesk) and game runtimes from writing legitimate save states, scratch files, and presets to %USERPROFILE%\Documents.
4. Network Protocol Binding (IPv6): IPv6 adapter bindings remain active. Microsoft core networking identifies IPv6 as a mandatory OS component; disabling IPv6 breaks Teredo gaming discovery, Entra ID hybrid join state sync, and WinRM listeners.
5. SMB3 Payload Encryption (CIS 2.3.8.3): Mandatory SMB payload encryption (EncryptData = 1) is omitted. Packet signing (RequireSecuritySignature = 1) is enforced to stop NTLM relay attacks, but payload encryption is withheld to avoid saturating workstation CPU cores during multi-gigabit media transfers across local NAS devices.

INSTALLER_USB:
└───autounattend.xml
└───sources
    └───$OEM$
        └───$1
            └───Aegis
                └───AegisWin11_Deploy.ps1

# 1. Verify 4KB Allocation Unit Size
Get-Volume -DriveLetter C | Select-Object DriveLetter, AllocationUnitSize, FileSystemLabel

# 2. Verify BitLocker Encryption Status and Algorithm (XtsAes256)
Get-BitLockerVolume -MountPoint "C:" | Select-Object MountPoint, ProtectionStatus, EncryptionMethod, VolumeType

# 3. Verify Attack Surface Reduction Rules (14 Rules in Block Mode)
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

# 4. Verify Exploit Guard System Mitigations
Get-ProcessMitigation -System

# 5. Verify User Rights Assignment for Network Logons
secedit.exe /export /cfg "$env:TEMP\secpol_verify.inf" /areas USER_RIGHTS /quiet
Select-String -Path "$env:TEMP\secpol_verify.inf" -Pattern "SeNetworkLogonRight"
Remove-Item -Path "$env:TEMP\secpol_verify.inf" -Force

• Wiki Documentation: Aegis-Win11 Wiki
• Technical Reference Manual: 44-Item Policy Matrix
• Security Architecture Report: Formal Compliance Audit
• Community Discussions: GitHub Discussions

Released by Moosehead Studio under the MIT License. See LICENSE for details.