Comitari Windows hardening safe v1 (WAPT source)

SOURCE ONLY: must build and sign with the organization's WAPT tooling. Not yet Windows/WAPT-tested.

Scope

Five HKLM registry settings: disable AutoRun and AutoPlay (including non-volume devices), disable lock-screen camera and slideshows. No account / password / LAPS change. No WAPT, firewall, network, SMB, BitLocker, Microsoft Defender, antivirus, remote desktop, printing or power settings change.

Implementation

• setup.py now contains the complete install, audit and conditional rollback logic.
• Registry reads and writes use WAPT 2.6 setuphelpers (reg_key_exists, reg_value_exists, reg_openkey_noredir, reg_getvalue, registry_set, and reg_delvalue). No PowerShell process or external command is launched.
• The approved setting table is centralized in SETTINGS. A future update_package.py can validate operator-selected settings and serialize them as package data; this refactor keeps the current five-setting policy fixed.
• If a future package configuration changes a setting’s target, its update flow must migrate the saved uninstall target while preserving the original pre-install value. That migration is not part of this refactor.
• The WAPT package source currently has no WAPT/control or update_package.py; it is code-only and is not yet a complete buildable WAPT package.

Safeguards

• Initial values are saved once in %ProgramData%\Comitari\HardeningSafe\original-values.json before any modifications. The JSON layout remains compatible with the prior PowerShell package.
• If the baseline is absent, malformed or incomplete, uninstall refuses to make registry changes.
• Reinstallation idempotent; uninstall conditional: restores only values still equal to package target, leaving externally modified values unchanged.
• No reboot forced. Audit implemented.
• State persists after uninstall intentionally, so repeated uninstall does not overwrite third-party edits.
• Audit is read-only. A non-compliant or unreadable setting returns WARNING; successful collection with all five values at target returns OK.

Deployment

1. Inspect setup.py and the five SETTINGS entries in an isolated preproduction repository.
2. Validate registry settings and resulting behavior on a Windows 11 25H2 representative workstation, especially AutoPlay workflow.
3. Build/sign WAPT package with organization's key. Do not distribute unsigned sources as a ready-to-deploy binary.
4. Deploy to 1 test PC, verify WAPT agent/check-in, LapsByWAPT password rotation and recovery, business apps, USB workflows.
5. Expand to 3-5 devices for 48h and later to waves. Remove machine dependency before wapt-get remove; see WAPT docs on remove vs uninstall.
6. Verify rollback in pilot via wapt-get uninstall comitari-hardening-safe (function call) and validate state.

IMPORTANT: wapt-get remove is NOT assured to execute a custom uninstall() function. Follow your WAPT version's verified removal workflow and audit this before promotion.

Deliberately deferred

Windows LAPS controls 10701-10703 (LapsByWAPT alternative); firewall enforcement; VBS/HVCI/Credential Guard; ASR; NTLM/SMB guest/signing; SMBv1 removal; BitLocker; print drivers; user rights; audit logging and command-line collection; remote admin; LLMNR and NetBIOS. These require separate pilot checks.