GARRY WINDOWS SECURITY CHECK - 2026-09-23

1. Sign into Windows on your own computer. This is not a Linux password bypass.
2. Extract this entire Windows folder to a local folder. Keep all files together.
3. Double-click Run-Security-Check.cmd. Allow about a minute.
4. The private HTML report opens in your browser. Reports are also saved under
   %LOCALAPPDATA%\Garry\SecurityReports as HTML and JSON.

The report first separates Windows account login from possible offline access
to files. It does not claim that booting Garry bypasses a Windows password. No
password-free sign-in has been established by this metadata check. At a suitable
time, the owner can save work, press Win+L and verify that an approved credential
is required. Windows Hello face/fingerprint/PIN is authentication, not a bypass.

The script reads local account names/flags, password/lockout policy, automatic sign-in,
BitLocker protection state, Secure Boot/TPM metadata, firewall, Defender, RDP/NLA,
Windows version, partial installed-update evidence and two restart markers.

The Windows collector does not ask for passwords, try logins, extract hashes or recovery
keys, read disk files/browser credentials, scan a network, upload reports, run
malware scans or change Windows settings. Local account names are included at the
owner's request; full SIDs, computer names and secrets are excluded. HTML/JSON
reports are PRIVATE: never include them in a public download.

The account table covers records registered locally, with enabled state, required
password flag, last-set date/age, expiry metadata and direct local-administrator
membership where readable. Domain-only accounts are not enumerated. Nested group
privileges and Microsoft/Entra password policies may differ. Missing expiry is
not labeled never-expiring. Password age alone does not measure security.

An OPTIONAL collapsed panel checks patterns in a password candidate that you
manually choose to type. It never retrieves or verifies Windows passwords. The
input is masked unless you choose Show. The field is cleared when hidden, closed,
printed or navigated away. It is never added to the saved report/JSON. This is a
limited local heuristic, not a breach database, reuse test or strength guarantee.
No network requests, password storage, export or login attempts are performed.

UNAVAILABLE IS NOT A PASS. Hardware and protection checks may require administrator
rights. If you choose, open Windows PowerShell as administrator yourself and run:
  & 'C:\path\to\this\folder\Start-Security-Check.ps1'
No UAC prompt is triggered by the launcher; no execution policy is changed.
The launcher prefers an existing PowerShell 7 installation (including the owner's
existing Codex-bundled runtime), otherwise uses Windows PowerShell 5.1. It neither
downloads a runtime nor installs anything. Each runtime's existing execution
policy remains in force. Windows PowerShell may default to blocking scripts.

If Windows blocks a downloaded script, verify that you downloaded the original
kit from your GarryHQ site and review its files before trusting it. On an unmanaged
computer, Windows file Properties may offer an Unblock option on the downloaded
ZIP; extract it again only after you choose to trust it. If execution policy or
your organization still blocks the script, ask the computer administrator. This
launcher does not bypass those controls or automatically lower execution policy.

READ THE LIMITS:
- PasswordRequired=False is a flag, not proof of a blank or weak password.
- Local policy does not establish online Microsoft/Entra/domain requirements,
  account MFA, or Windows Hello PIN anti-hammering protection.
- Encryption percentage alone is not proof that BitLocker protection is active.
- A recent hotfix date does not prove that all security updates are installed.
- This is a configuration review, not a penetration test or an unhackable rating.
- No fixes are automatic. Review business impact and recovery access first.

Microsoft documentation is linked from the report and in SOURCES.md.
