Windows security baseline checker
Paste a secedit export to check password policy, audit settings and registry security values against known baseline recommendations.
Runs in your browser · nothing is sentActive DirectoryNew
Everything runs in your browser. Nothing is sent anywhere, including account names and the security identifiers (SIDs) in your export.
Raises the severity of findings that matter more on a domain controller, such as anonymous enumeration.
How to use
- Open an elevated PowerShell or Command Prompt on the computer you want to check.
- Run "secedit /export /cfg C:\baseline.cfg".
- Open the file and paste its content into the tool.
- Review the findings, then export the report if needed.
Common scenarios
Export the local security policy right after setup to confirm the password policy, audit settings and LAN Manager authentication level meet baseline recommendations before the server goes into production.
Export secedit on an affected machine to see the policy as it actually applies, not just as configured in the GPO, since conflicting or unlinked policies can produce a different effective result.
About this tool
Run "secedit /export /cfg C:\baseline.cfg" as Administrator on the computer you want to check (local policy, or the effective policy after Group Policy has applied), and paste the file content here. The tool checks password and lockout policy, audit settings, a set of security-relevant registry values (LAN Manager authentication level, anonymous access, UAC, automatic logon) and user rights assignments (who can log on over the network, who holds the debug privilege) against known, documented baseline recommendations from Microsoft's security guidance. Everything runs locally; the export never leaves your browser.
🔒 Your input stays in your browser and is never sent anywhere.
Frequently asked questions
Does this connect to my domain or computer?
No. There are no credentials and no network connections. You run "secedit /export" yourself and paste the resulting text file here.
Why secedit instead of a GPO report?
secedit's INI-style export is a simple, stable, officially documented format for the effective security policy. A full GPO Report (XML) covers every Group Policy setting, but its schema is far more complex and varies by policy area, which makes it a much larger and riskier thing to parse correctly.
Does this check the baseline for a specific Windows version?
No. Each finding is based on a documented Microsoft recommendation (for example the LAN Manager authentication level, or the recommended minimum password length) rather than one specific baseline release, so it applies broadly rather than matching one exact CIS or Microsoft baseline version.
What does "domain controller" change in the results?
A few findings, such as allowing anonymous enumeration, are flagged more severely on a domain controller, since a compromise there affects the whole domain rather than one machine.
What to do next
Found a problem or have a suggestion? Tell us