Open security standard for Windows
Windows lets every program reach the network. EDEP decides who may.
EDEP describes what a Windows computer must technically enforce: outbound traffic only for allowed programs, telemetry at the edition's minimum, every block logged locally. Every claim is backed by a source, every known limit is stated.
The problem, in Microsoft's own words
Windows Firewall blocks inbound connections, but not outbound ones by default. Microsoft explicitly recommends it that way:
“It's recommended to allow outbound by default for most deployments for the sake of simplification with app deployments, unless the organization prefers tight security controls over ease-of-use.”
Microsoft Learn, Windows Firewall Rules, section “Outbound rules considerations”
The consequence
Whatever runs on the computer may send: malware, a compromised extension, a script launched from a macro. Antivirus catches a lot, but not everything. Whatever goes undetected can send data out unhindered.
The alternative
Microsoft itself names outbound blocking an option “for certain highly secure environments”. EDEP turns it into a verifiable standard instead of leaving it to every administrator.
The price
Every program needs a permission. That is effort, and EDEP does not hide it. The audit first shows where a computer stands today.
Free audit: how open is your Windows?
One minute, no installation, no change to the system. Result: a score from 0 to 100 and, for every open item, a reason with a concrete recommendation.
# In PowerShell (run as administrator for the complete result)
git clone https://github.com/AndreZ1971/EDEP
cd EDEP\baseline\L1
.\Invoke-EdepAudit.ps1 -Open
Without Git:
download the ZIP, extract it and run
Set-ExecutionPolicy -Scope Process Bypass first.
The scripts are not signed yet; that is on the
roadmap. Anyone can read the code beforehand, it is short.
- Changes nothing. Read-only queries. Verifiable by comparing the firewall configuration before and after.
- Runs without admin rights. Whatever cannot be checked then is labelled as such and not scored.
- 24 checks in six categories: outbound and inbound traffic, program control, telemetry, logging, attack surface.
- English and German, following the Windows display language.
- Sends nothing. The report is a local HTML file.
Don't believe it, verify it
A security standard is only as good as its evidence. These numbers are checked against the repository automatically every time this page is published; if one differs, the page is not published.
Open means: not yet measured, not reproduced, or (Rust agent) not yet built. The evidence register gives the verification path for each open item. The detailed documentation is currently in German.
Three levels
A level is reached when all of its mandatory requirements pass their tests. Partial compliance is not conformance.
L1 Baseline available
Windows built-ins only: firewall with default outbound block, App Control, telemetry policies, logging. Apply, check (15 automated checks) and fully roll back by script.
L2 Enforced in development
Network permissions bound to a program's cryptographic identity (signature or hash), persistent and boot-time filters, tamper detection. No own kernel driver.
L3 Isolated planned
Deterministic emergency isolation on canary-file access, volume threshold or tampering. A local model may only advise, never block.
What EDEP cannot do
These limits are part of the standard. An implementation must not claim to overcome them unless a test proves it.
Out of scope
Attackers with administrator or kernel rights · content of encrypted connections (TLS is deliberately not intercepted) · compromised signed software · physical access.
Known bypasses, for example
BITS jobs: any user can download and upload files through the Windows BITS service (MITRE ATT&CK T1197). EDEP L1 can only log this, not prevent it.
DNS tunnels and abuse of allowed programs are documented as well, each with a test.
Deliberate deviations from Microsoft
| Topic | Microsoft recommends | EDEP requires | Price |
|---|---|---|---|
| Outbound traffic | allow (for most environments) | block, permission per program | Every application needs a permission |
| Diagnostic data | at least “Required” when relying on Windows Update | lowest level of the edition | No update failure data to Microsoft (Enterprise/Education/Server) |
Telemetry endpoint settings-win |
do not block | block the telemetry service completely | Settings can no longer be controlled remotely |
Reasoning: design decisions, DD-12 (German).
Get involved
Repeat the VM run
Full L1 runs exist for Windows 11 Enterprise, Pro and Home (each in a VM) and found defects that are documented openly. Wanted: a repeat by third parties, also on real hardware. The guide lists every command and every expected result; how to report a repeat (German).
Found a hole?
Please report it privately: report a vulnerability. Confirmed findings are recorded in the errata with credit.
Source misquoted?
Every source is linked. If an attribution is wrong, that is a bug in EDEP: open an issue.