Windows configuration management · CMMC Level 2 support
A baseline script can configure an endpoint. It cannot certify an organization.
The Kythos AI Windows baseline audits, plans, applies, and rolls back a bounded group of ASR, Defender, Firewall, registry-policy, and advanced-audit settings. It produces evidence for review and leaves organization-specific controls to the system owner.
Default mode: Audit. No changes occur unless an administrator explicitly chooses Apply.
What it handles
Bounded technical settings with evidence and rollback.
Audit and configuration evidence
CSV and JSON findings map each tested setting to relevant NIST SP 800-171 Rev. 2 / CMMC Level 2 requirement identifiers, with expected state, observed state, source, and review notes.
Windows Firewall
Checks all profiles; Apply enables Domain, Private, and Public profiles, blocks inbound by default, and turns on allowed and blocked connection logging without forcing outbound deny.
Registry-backed policies
Checks and can set UAC, secure desktop, WDigest credential retention, AutoRun, elevated installer policy, process command-line audit, PowerShell logging, RDP NLA, WinRM encryption/authentication, and SmartScreen.
Defender and ASR
Checks real-time, behavior, IOAV, archive, and PUA protection; applies a core ASR set in Audit, Warn, or Block. Audit is the default. Cloud submission choices are left unchanged.
Advanced audit policy
Uses stable audit subcategory GUIDs for system integrity, logon, account lockout, special logon, process creation, policy change, account management, and credential validation.
Rollback
Apply first saves registry values, Defender/ASR preferences, Firewall policy, service state, and audit policy. Rollback validates that the backup belongs to the same computer before restoration.
What it intentionally does not do
Some controls cannot be chosen safely by a generic script.
No compliance claim
CMMC assessment covers the defined assessment scope, 110 Level 2 requirements, applicable assessment objectives, implementation evidence, and continuing affirmation. A registry value is only one possible technical implementation detail.
No generic encryption escrow
The script reports BitLocker state but does not enable encryption or decide where recovery material belongs. That decision depends on identity, escrow, CUI boundary, recovery, and separation-of-duty design.
No forced application blocking
It reports effective AppLocker state but does not deploy a generic WDAC or AppLocker deny policy. Application control needs inventory, signer strategy, audit telemetry, exception ownership, staged rollout, and offline recovery.
No identity or MFA fiction
A local script cannot prove least privilege, MFA coverage, lifecycle controls, service-account governance, remote-access authorization, or the integrity of break-glass paths.
No silent cloud egress
It does not change automatic sample submission or choose cloud-delivered protection policy. Organizations handling controlled data must make those decisions deliberately.
No GPO/MDM override
Domain, MDM, security baseline, and endpoint-management policy may replace local settings. Resultant policy after refresh and reboot—not the script’s exit code—is the operational truth.
Safe use
Move through evidence, approval, pilot, and verification.
Audit
Run without elevation where possible. Review failed and manual findings, endpoint role, management authority, data boundary, existing EDR, and application dependencies.
Plan
Generate the planned changes. Resolve conflicts with domain GPO, MDM, security baselines, vendor guidance, and the organization’s approved configuration standard.
Pilot Apply
Use an elevated session on a representative non-production endpoint. Keep ASR in Audit. Validate applications, remote management, update, authentication, logging, and recovery.
Verify and stage
Refresh central policy, reboot where required, rerun Audit, review telemetry, approve exceptions, promote in rings, and retain the rollback directory with the change record.
Package integrity
Review the source before execution.
- PowerShell 5.1 source with Audit, Plan, Apply, and Rollback modes
- README with workflow, limits, examples, and primary references
- SHA-256 manifest for the source and README
- ZIP package checksum published below after deployment
- No obfuscation, download cradle, remote code execution, credential collection, or automatic upload
Version: 1.0.0 · Published: September 21, 2026 · Signature: unsigned source; validate the hash and approve through your change process.
Current CMMC context
Use the current rule and contract language—not a stale slide deck.
32 CFR Part 170 states that CMMC Level 2 uses the 110 requirements from NIST SP 800-171 Revision 2 and assessment objectives from NIST SP 800-171A. The CMMC program is implemented through contract requirements and defined assessment scope. As of September 2026, the DoD CMMC site states that Phase I self-assessment requirements remain in place and that the planned Phase II requirements were suspended on July 13, 2026 pending review. That program status can change; confirm the current solicitation, contract clauses, official CMMC site, eCFR, and Acquisition.gov before making a compliance decision.
Independent status
Public references are not endorsements.
Kythos AI is not a C3PAO and does not claim that this script is approved, certified, or endorsed by the Department of Defense, CISA, NIST, MITRE, Microsoft, or any assessment organization. The cited standards, control identifiers, product names, and public resources identify the engineering context only.