Five HKLM registry settings: disable AutoRun and AutoPlay (including non-volume devices), disable lock-screen camera and slideshows. No account / password / LAPS change. No WAPT, firewall, network, SMB, BitLocker, Microsoft Defender, antivirus, remote desktop, printing or power settings change.

Safeguards

Initial values saved once in %ProgramData%\Comitari\HardeningSafe\original-values.json before any modifications.
Reinstallation idempotent; uninstall conditional: restores only values still equal to package target, leaving externally modified values unchanged.
No reboot forced. Audit implemented.
State persists after uninstall intentionally, so repeated uninstall does not overwrite third-party edits.
Policy owner can override package; audit then reports WARNING.

Deployment

Inspect setup.py and hardening.ps1 in an isolated preproduction repository.
Validate registry settings and resulting behavior on a Windows 11 25H2 representative workstation, especially AutoPlay workflow.
Build/sign WAPT package with organization's key. Do not distribute unsigned sources as a ready-to-deploy binary.
Deploy to 1 test PC, verify WAPT agent/check-in, LapsByWAPT password rotation and recovery, business apps, USB workflows.
Expand to 3-5 devices for 48h and later to waves. Remove machine dependency before wapt-get remove; see WAPT docs on remove vs uninstall.
Verify rollback in pilot via wapt-get uninstall comitari-hardening-safe (function call) and validate state.

IMPORTANT: wapt-get remove is NOT assured to execute a custom uninstall() function. Follow your WAPT version's verified removal workflow and audit this before promotion.

Deliberately deferred

Windows LAPS controls 10701-10703 (LapsByWAPT alternative); firewall enforcement; VBS/HVCI/Credential Guard; ASR; NTLM/SMB guest/signing; SMBv1 removal; BitLocker; print drivers; user rights; audit logging and command-line collection; remote admin; LLMNR and NetBIOS. These require separate pilot checks.