A Cyber Essentials checklist for Windows PCs (with the PowerShell to check each setting)

Twelve settings on a Windows computer can be checked against the Cyber Essentials requirements, and each takes one PowerShell command to read. This checklist gives the command to check each setting, the value that passes and the command to fix it.

Run them in PowerShell as an administrator. They work on Windows 10, Windows 11 and Windows Server 2016 or later. The rules are from version 3.3 of the requirements (April 2026), published through the National Cyber Security Centre's Cyber Essentials pages. If you would rather have every machine checked each day, see Cyber Essentials readiness in Helios.

Firewalls

1. The firewall is on for every profile

The rule: use a software firewall on devices used on untrusted networks.

Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction

Passes when: Enabled is True for Domain, Private and Public.

Set-NetFirewallProfile -All -Enabled True

2. Incoming connections are blocked by default

The rule: "block unauthenticated inbound connections by default". Use the same read command as above.

Passes when: DefaultInboundAction is Block or NotConfigured. Not configured means the Windows default, which is to block. It fails on Allow.

Set-NetFirewallProfile -All -DefaultInboundAction Block

Existing allow rules keep working. Only traffic that no rule covers is blocked.

Secure configuration

3. The Guest account is off

The rule: remove and disable unnecessary accounts, "such as guest accounts". The Guest account is found by its identifier, so this works in any language.

Get-LocalUser | Where-Object { $_.SID.Value -like 'S-1-5-21-*-501' } |
  Select-Object Name, Enabled

Passes when: Enabled is False.

Get-LocalUser | Where-Object { $_.SID.Value -like 'S-1-5-21-*-501' } | Disable-LocalUser

4. No account is switched on that nobody uses

Get-LocalUser | Where-Object Enabled |
  Select-Object Name, LastLogon, PasswordRequired

Passes when: every account listed belongs to someone who still needs it. The requirements set no number of days. We treat an account unused for 90 days, or never used, as one to question.

Disable-LocalUser -Name 'the-account-name' 

Check with the client before disabling an account. A service or a scheduled task may depend on it.

5. Auto-run is off

The rule: "disable any auto-run feature which allows file execution without user authorisation".

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' `
  -Name NoDriveTypeAutoRun -ErrorAction SilentlyContinue

Passes when: NoDriveTypeAutoRun is 255, which is off for every kind of drive. Nothing returned means the Windows default, which leaves it on.

$k = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer'
if (-not (Test-Path $k)) { New-Item -Path $k -Force | Out-Null }
New-ItemProperty -Path $k -Name NoDriveTypeAutoRun -Value 255 -PropertyType DWord -Force | Out-Null
New-ItemProperty -Path $k -Name NoAutorun -Value 1 -PropertyType DWord -Force | Out-Null

It applies the next time someone signs in.

6. Nobody gets in without signing in

The rule: a credential "must be in place before a user can gain access". Two things break it: automatic sign-in at start-up, and an account that needs no password.

(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon').AutoAdminLogon
Get-LocalUser | Where-Object { $_.Enabled -and -not $_.PasswordRequired } | Select-Object Name

Passes when: the first line returns 0 or nothing, and the second returns no accounts.

$w = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'
Set-ItemProperty -Path $w -Name AutoAdminLogon -Value '0'
Remove-ItemProperty -Path $w -Name DefaultPassword -ErrorAction SilentlyContinue
net user the-account-name /passwordreq:yes

Turning off automatic sign-in means someone must know the password at the next start. Agree that with the client first.

7. It locks after 10 wrong guesses or fewer

The rule: "locking devices after no more than 10 unsuccessful attempts".

net accounts

Passes when: "Lockout threshold" is between 1 and 10. "Never" fails.

net accounts /lockoutthreshold:10
net accounts /lockoutwindow:10
net accounts /lockoutduration:10

On a machine joined to a domain, the domain's policy sets this. Change it there.

Security update management

8. The operating system is still supported

Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber

Passes when: Microsoft still issues security updates for that version. Windows 10 reached the end of support on 14 October 2025, unless the machine is enrolled for Extended Security Updates. Each Windows 11 release has its own end date, so check the build against Microsoft's lifecycle pages.

To fix: upgrade the machine, replace it, or take it out of scope on a network with no route to the internet.

9. No important update has waited more than 14 days

The rule: updates that fix critical or high risk vulnerabilities must be installed "within 14 days of release". Updates with no stated severity count as well.

$searcher = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher()
$searcher.Search('IsInstalled=0 and IsHidden=0').Updates |
  Select-Object Title, MsrcSeverity, LastDeploymentChangeTime

Passes when: nothing listed as Critical or Important, or with no severity, has a date more than 14 days old. LastDeploymentChangeTime is when Microsoft last published the update.

To fix: install the waiting updates from Windows Update or your patching tool, and restart if asked. This command sees Microsoft updates only. Browsers, PDF readers and other applications fall under the same 14-day rule and need their own check.

10. Updates install without anyone asking

The rule: "have automatic updates enabled where possible".

Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' `
  -ErrorAction SilentlyContinue | Select-Object NoAutoUpdate, AUOptions

Passes when: nothing is returned, which is the Windows default of automatic, or NoAutoUpdate is 0. A value of 1 means a policy has turned automatic updates off.

That value is also what a patching tool sets when it takes over updates. If your tool installs updates on a schedule, the control is met by the tool. If nothing else installs them, remove the policy.

User access control

11. The day-to-day account is not an administrator

The rule: use "separate accounts to perform administrative activities only".

Get-LocalGroupMember -SID 'S-1-5-32-544' | Select-Object Name, ObjectClass, PrincipalSource
whoami /groups | findstr S-1-5-32-544

Passes when: the person who uses the machine every day is not in the first list. The second line, run as that person, returns nothing when they are a standard user.

If the first command errors, the group holds an account that no longer exists. net localgroup Administrators lists the members instead, on an English-language machine.

Remove-LocalGroupMember -SID 'S-1-5-32-544' -Member 'the-account-name' 

Create a separate administrator account first, and agree the change with the person. Some older applications will not run without administrator rights.

Malware protection

12. Antivirus is running and up to date

The rule: anti-malware software must be active, kept up to date, and prevent malware from running.

Get-MpComputerStatus |
  Select-Object AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureAge
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct |
  Select-Object displayName

Passes when: an antivirus product is running with real-time protection on, and its definitions are current. For Microsoft Defender that is both values True and a signature age of a few days at most. The second command lists third-party products. It does not exist on Windows Server.

Set-MpPreference -DisableRealtimeMonitoring $false
Update-MpSignature

The whole checklist on one page

These twelve cover the computer. For the routers, cloud services and account questions, and the order to tackle them in, see Cyber Essentials for MSPs, control by control. For what is new this year, see what changed in v3.3.

Where this fits with Helios

Running twelve commands on one machine takes a few minutes. Running them on every machine, every time something might have changed, is the real job. Helios reads the same settings on every Windows machine each day and shows which machines fail which check.

Most of the fixes above are one press in Helios: the firewall, the inbound block, the Guest account, auto-run, the lockout count, overdue updates and antivirus. Unused accounts and automatic sign-in are one press after a confirmation. Linux machines report the same settings where they exist on Linux: firewall, accounts, automatic updates, remote sign-in and waiting security updates. On Linux, Fix it covers the firewall, unused accounts and automatic updates. Macs are checked for a supported operating system, overdue updates and antivirus only.

It is a readiness check, not a certificate, and it is included in every plan. More detail is on the Cyber Essentials readiness in Helios page.