Téléverser les fichiers vers "/"

README.md

@@ -1,2 +1,26 @@
-# comi-hardening-windows
+# Com itari Windows hardening safe v1 (WAPT source)
 
+SOURCE ONLY: must build and sign with the organization's WAPT tooling. Not yet Windows/WAPT-tested.
+
+## Scope
+Five HKLM registry settings: disable AutoRun and AutoPlay (including non-volume devices), disable lock-screen camera and slideshows. No account / password / LAPS change. No WAPT, firewall, network, SMB, BitLocker, Microsoft Defender, antivirus, remote desktop, printing or power settings change.
+
+## Safeguards
+- Initial values saved once in `%ProgramData%\Comitari\HardeningSafe\original-values.json` before any modifications.
+- Reinstallation idempotent; uninstall conditional: restores only values still equal to package target, leaving externally modified values unchanged.
+- No reboot forced. Audit implemented.
+- State persists after uninstall intentionally, so repeated uninstall does not overwrite third-party edits.
+- Policy owner can override package; audit then reports WARNING.
+
+## Deployment
+1. Inspect `setup.py` and `hardening.ps1` in an isolated preproduction repository.
+2. Validate registry settings and resulting behavior on a Windows 11 25H2 representative workstation, especially AutoPlay workflow.
+3. Build/sign WAPT package with organization's key. Do not distribute unsigned sources as a ready-to-deploy binary.
+4. Deploy to 1 test PC, verify WAPT agent/check-in, LapsByWAPT password rotation and recovery, business apps, USB workflows.
+5. Expand to 3-5 devices for 48h and later to waves. Remove machine dependency before `wapt-get remove`; see WAPT docs on remove vs uninstall.
+6. Verify rollback in pilot via `wapt-get uninstall comitari-hardening-safe` (function call) and validate state.
+
+IMPORTANT: `wapt-get remove` is NOT assured to execute a custom uninstall() function. Follow your WAPT version's verified removal workflow and audit this before promotion.
+
+## Deliberately deferred
+Windows LAPS controls 10701-10703 (LapsByWAPT alternative); firewall enforcement; VBS/HVCI/Credential Guard; ASR; NTLM/SMB guest/signing; SMBv1 removal; BitLocker; print drivers; user rights; audit logging and command-line collection; remote admin; LLMNR and NetBIOS. These require separate pilot checks.