Riegel – Windows hardening check for plants, labs and control rooms

Evidence of hardening for the Windows machines nobody manages centrally

Plant PCs, HMIs, lab and control-room machines often sit outside central IT – some without a network, some with software that needs an insecure setting. On such machines, installing software is a change in itself – a Windows hardening assessment there has to work without an installer.

Riegel therefore brings a portable collector that installs nothing, changes no configuration and writes only its export; Windows itself records that a program ran. The evaluation happens on an analysis PC: a result per rule, justified exceptions, a comparison with the approved state and a report to sign.

What the Windows hardening check does

• 153 rules, honest results

  Network, credentials and NTLM, LSA, Defender and ASR, application control, encryption, firewall, audit and PowerShell, RDP, removable media and TLS. A pass needs positive evidence; what could not be read is “not checkable”, never a silent pass.

• Portable collector

  About 130 KB, for Windows 7 SP1 to 11 and Server 2008 R2 to 2025; installs nothing and changes no configuration. Where no foreign program may run, Windows’ built-in commands work; --minimal starts no other program on sensitive HMIs.

• Justified, approved exceptions

  What stays open deliberately gets a justification, the accepted value, an approving role and a change or QMS record – bound to its content, with expiry and history. Tailoring per role and a measures plan sit beside it.

• Comparison with the approved state

  What changed since commissioning or a vendor visit? Riegel compares with the previous run and with the approved state – worse first, then raw-value drift.

• Documents to sign

  Plant report with sign-off, management summary, target configuration, approval sheet and collection record as PDF, plus Excel, CSV and an evidence pack that auditors re-check with verify – also on Linux.

• Remediation as files only

  .reg files with a rollback, GptTmpl.inf and audit.csv for the plant vendor – never applied by Riegel.

• Your own baselines

  Import GPO backups, including those inside downloaded security baselines, or write your own requirements as JSON or CSV.

• Monitoring that alerts on change

  Nagios-style exit codes and an Icinga line for regressions, newly open high findings, expiring exceptions and overdue measures.

Where the security baseline rules come from

Catalogue 2026.10.1 has 153 rules in 17 report categories, with texts written by ICT Baden. Every expected value is backed by the ACSC, Microsoft’s Windows Server documentation, a Microsoft Learn page or a DISA STIG; Microsoft Security Baselines only corroborate. References name MITRE ATT&CK mitigations and Grundschutz++ identifiers. The catalogue contains no CIS and no BSI SiSyPHuS content.

For machine builders there is an “as delivered” report preset with the machine identity and the justified deviations of the machine’s software; Riegel.Cli.exe check also runs in the factory acceptance test (FAT).

For audits: NIS2, ISO 27001, IEC 62443, GMP

Riegel supports evidence for NIS2 and the documentation duty of § 30 BSIG, ISO/IEC 27001:2022 A.8.9, IEC 62443, TISAX, insurer questionnaires and GMP periodic reviews. It makes no compliance claim, is not a validated system, and covers configuration management – not MFA, backups, incident handling or network segmentation.

Switching from benchmark scanners and policy comparison tools: Riegel as an alternative

If you check Windows hardening with a benchmark scanner or a policy comparison tool today, Riegel does the same job: comparing a machine’s security configuration with expected values. Its focus is different:

• Offline and read-only

  A portable collector (about 130 KB) installs nothing, changes no configuration and opens no network connection; the evaluation runs on another PC.

• Justified exceptions

  What stays open deliberately is recorded with a justification, an approving role, a record and an expiry date.

• A report to sign

  Plant report as PDF with sign-off and an evidence pack that auditors re-check with verify.

• Built for plant PCs

  Designed for Windows 7 SP1 to 11 and Server 2008 R2 to 2025, --minimal for sensitive HMIs, Windows’ built-in commands, an “as delivered” report preset for machine builders.

Important if you are looking for an alternative to a benchmark scanner: Riegel contains no content from third-party benchmark catalogues and no BSI SiSyPHuS content. Its own catalogue of 153 rules is backed by ACSC, Microsoft documentation and DISA STIGs, so a Riegel result is no statement about conformance with a particular benchmark. Your own baselines can be imported as GPO backups, including those inside security baselines you downloaded yourself. Rule files and checklists of other hardening tools are not imported in Riegel 0.1 (planned for 0.2). Riegel is free of charge under the MIT licence, needs no licence server, and never applies settings itself.

System requirements

Checked machines

Windows 7 SP1 to 11 and Windows Server 2008 R2 to 2025 via the portable collector (.NET Framework 3.5.1 or 4.x)

Without foreign programs

Windows’ built-in commands (secedit, auditpol, reg) via collect-builtin.cmd

Analysis PC

Windows 10 version 1809 or Windows Server 2019 or later – MSI or Riegel.exe without installation

Linux

command line for x64 and arm64 to evaluate and verify evidence packs

Network

none – Riegel opens no network connection

Language

German, English, Spanish, French, Chinese (the last three machine pre-translated)

Limits, honestly

• Pre-release 0.1 (latest 0.1.2, collector 0.1.0), not code-signed: SmartScreen may warn, and the collector can only be allow-listed by hash. No customer pilot on OT or validated machines before the collector is signed.
• Windows targets only: Linux machines are not checked. Machine settings only, no per-user policies; domain controllers get no score.
• Tested on fixtures and CI runners (Windows Server 2022 and 2025, Windows 11 Arm64) and against a reference snapshot of a Windows 11 workstation; not yet on real Windows 7, 8.1, 2008 R2 or 2012 R2 machines, in a real domain, with third-party antivirus or EDR, or with real AppLocker enforcement. Domain GPO attribution is experimental.
• Without administrator rights, with --minimal or from built-in commands, many rules cannot be decided; the report then says “Incomplete check”.
• No PDF/A, no electronic signatures; the evidence pack is not signed.
• Spanish, French and Chinese are machine pre-translations, marked in every document; rule texts are English there.