```powershell
<#
.SYNOPSIS
    Validates a Windows 10 hardened security baseline on a local endpoint.

.DESCRIPTION
    This script performs read-only checks against common Windows 10 hardening areas,
    including identity protection, firewall posture, BitLocker readiness, UAC, script
    execution policy, audit policy signals, and a few other operationally useful controls.

    The script is intentionally non-destructive. It does not change any settings.
    Use it during pilot validation, rollout verification, or drift spot-checking.

.NOTES
    - Run in an elevated PowerShell session for the most complete results.
    - Some checks may return "Unknown" or "Not applicable" depending on edition,
      role, device management state, or available modules.
    - This script is vendor-neutral and avoids environment-specific endpoints.

.EXAMPLE
    .\Validate-Windows10Baseline.ps1

.EXAMPLE
    .\Validate-Windows10Baseline.ps1 -OutputPath .\baseline-validation-report.json -IncludeRawDetails
#>

[CmdletBinding()]
param(
    [string]$OutputPath,

    [switch]$IncludeRawDetails,

    [switch]$PassThru
)

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

function New-CheckResult {
    param(
        [Parameter(Mandatory)]
        [string]$Name,

        [Parameter(Mandatory)]
        [ValidateSet('Pass','Warn','Fail','Unknown','NotApplicable')]
        [string]$Status,

        [Parameter(Mandatory)]
        [string]$Details,

        [object]$Raw
    )

    $obj = [ordered]@{
        Name    = $Name
        Status  = $Status
        Details = $Details
    }

    if ($IncludeRawDetails) {
        $obj.Raw = $Raw
    }

    [pscustomobject]$obj
}

function Test-RegistryValue {
    param(
        [Parameter(Mandatory)]
        [string]$Path,

        [Parameter(Mandatory)]
        [string]$Name,

        [object]$ExpectedValue
    )

    try {
        $item = Get-ItemProperty -Path $Path -Name $Name -ErrorAction Stop
        $actual = $item.$Name
        if ($null -eq $ExpectedValue) {
            return @{ Exists = $true; Actual = $actual; Match = $true }
        }

        return @{ Exists = $true; Actual = $actual; Match = ($actual -eq $ExpectedValue) }
    }
    catch {
        return @{ Exists = $false; Actual = $null; Match = $false }
    }
}

function Get-ProductInfo {
    try {
        return Get-CimInstance -ClassName Win32_OperatingSystem
    }
    catch {
        return $null
    }
}

$results = New-Object System.Collections.Generic.List[object]
$os = Get-ProductInfo

# OS checks
if ($os) {
    $caption = [string]$os.Caption
    $build = [int]$os.BuildNumber
    $results.Add((New-CheckResult -Name 'Operating system' -Status 'Pass' -Details "$caption (build $build)" -Raw $os))
}
else {
    $results.Add((New-CheckResult -Name 'Operating system' -Status 'Unknown' -Details 'Unable to query operating system details.' -Raw $null))
}

# UAC
$uac = Test-RegistryValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'EnableLUA' -ExpectedValue 1
if ($uac.Exists -and $uac.Match) {
    $results.Add((New-CheckResult -Name 'User Account Control' -Status 'Pass' -Details 'UAC is enabled.' -Raw $uac))
}
elseif ($uac.Exists) {
    $results.Add((New-CheckResult -Name 'User Account Control' -Status 'Fail' -Details "UAC is not enabled. Current value: $($uac.Actual)" -Raw $uac))
}
else {
    $results.Add((New-CheckResult -Name 'User Account Control' -Status 'Unknown' -Details 'UAC setting could not be read.' -Raw $uac))
}

# Local account admin rename indicator
$adminNameCheck = Test-RegistryValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name 'DefaultUserName' -ExpectedValue $null
$results.Add((New-CheckResult -Name 'Local account management' -Status 'Unknown' -Details 'Local admin naming and membership should be reviewed with directory or endpoint management tooling; not validated by this script.' -Raw $adminNameCheck))

# Firewall profile status
try {
    $profiles = Get-NetFirewallProfile -ErrorAction Stop
    foreach ($profile in $profiles) {
        $status = if ($profile.Enabled) { 'Pass' } else { 'Fail' }
        $details = if ($profile.Enabled) {
            "$($profile.Name) firewall is enabled."
        }
        else {
            "$($profile.Name) firewall is disabled."
        }
        $results.Add((New-CheckResult -Name "Firewall: $($profile.Name)" -Status $status -Details $details -Raw $profile))
    }
}
catch {
    $results.Add((New-CheckResult -Name 'Firewall posture' -Status 'Unknown' -Details 'Unable to query Windows Firewall profiles.' -Raw $_.Exception.Message))
}

# BitLocker status
try {
    $volumes = Get-BitLockerVolume -ErrorAction Stop
    foreach ($vol in $volumes) {
        $status = switch ($vol.VolumeStatus) {
            'FullyEncrypted' { 'Pass' }
            'EncryptionInProgress' { 'Warn' }
            'DecryptionInProgress' { 'Warn' }
            default { 'Fail' }
        }
        $details = "Drive $($vol.MountPoint): VolumeStatus=$($vol.VolumeStatus); ProtectionStatus=$($vol.ProtectionStatus)"
        $results.Add((New-CheckResult -Name "BitLocker: $($vol.MountPoint)" -Status $status -Details $details -Raw $vol))
    }
}
catch {
    $results.Add((New-CheckResult -Name 'BitLocker' -Status 'Unknown' -Details 'BitLocker module or access is unavailable. Run elevated or install required components.' -Raw $_.Exception.Message))
}

# Secure Boot
try {
    $secureBoot = Confirm-SecureBootUEFI -ErrorAction Stop
    if ($secureBoot) {
        $results.Add((New-CheckResult -Name 'Secure Boot' -Status 'Pass' -Details 'Secure Boot is enabled.' -Raw $secureBoot))
    }
    else {
        $results.Add((New-CheckResult -Name 'Secure Boot' -Status 'Fail' -Details 'Secure Boot is disabled.' -Raw $secureBoot))
    }
}
catch {
    $results.Add((New-CheckResult -Name 'Secure Boot' -Status 'Unknown' -Details 'Secure Boot status could not be queried on this system.' -Raw $_.Exception.Message))
}

# PowerShell execution policy
try {
    $machinePolicy = Get-ExecutionPolicy -Scope LocalMachine
    $currentPolicy = Get-ExecutionPolicy -Scope CurrentUser
    $processPolicy = Get-ExecutionPolicy -Scope Process
    $summary = "Machine=$machinePolicy; User=$currentPolicy; Process=$processPolicy"

    if ($machinePolicy -in @('AllSigned','RemoteSigned','Restricted')) {
        $results.Add((New-CheckResult -Name 'PowerShell execution policy' -Status 'Pass' -Details $summary -Raw @{ MachinePolicy = $machinePolicy; CurrentUser = $currentPolicy; Process = $processPolicy }))
    }
    else {
        $results.Add((New-CheckResult -Name 'PowerShell execution policy' -Status 'Warn' -Details $summary -Raw @{ MachinePolicy = $machinePolicy; CurrentUser = $currentPolicy; Process = $processPolicy }))
    }
}
catch {
    $results.Add((New-CheckResult -Name 'PowerShell execution policy' -Status 'Unknown' -Details 'Unable to query execution policy.' -Raw $_.Exception.Message))
}

# Defender realtime protection signal
try {
    $mp = Get-MpComputerStatus -ErrorAction Stop
    $status = if ($mp.AMServiceEnabled -and $mp.RealTimeProtectionEnabled) { 'Pass' } else { 'Warn' }
    $details = "AMServiceEnabled=$($mp.AMServiceEnabled); RealTimeProtectionEnabled=$($mp.RealTimeProtectionEnabled)"
    $results.Add((New-CheckResult -Name 'Microsoft Defender status' -Status $status -Details $details -Raw $mp))
}
catch {
    $results.Add((New-CheckResult -Name 'Microsoft Defender status' -Status 'Unknown' -Details 'Defender status could not be queried.' -Raw $_.Exception.Message))
}

# Audit policy signal
try {
    $auditOut = & auditpol.exe /get /category:* 2>$null
    if ($auditOut) {
        $results.Add((New-CheckResult -Name 'Audit policy' -Status 'Pass' -Details 'Audit policy output collected successfully. Review the result for required categories.' -Raw $auditOut))
    }
    else {
        $results.Add((New-CheckResult -Name 'Audit policy' -Status 'Unknown' -Details 'No audit policy output returned.' -Raw $null))
    }
}
catch {
    $results.Add((New-CheckResult -Name 'Audit policy' -Status 'Unknown' -Details 'Unable to query audit policy.' -Raw $_.Exception.Message))
}

# Local administrator group membership warning signal
try {
    $admins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction Stop
    $count = @($admins).Count
    $results.Add((New-CheckResult -Name 'Administrators group size' -Status 'Warn' -Details "Administrators group contains $count members. Review for least-privilege alignment." -Raw $admins))
}
catch {
    $results.Add((New-CheckResult -Name 'Administrators group size' -Status 'Unknown' -Details 'Unable to query local Administrators group membership.' -Raw $_.Exception.Message))
}

# Summarize
$summary = [ordered]@{
    ComputerName = $env:COMPUTERNAME
    TimestampUtc = (Get-Date).ToUniversalTime().ToString('o')
    Passed = @($results | Where-Object Status -eq 'Pass').Count
    Warnings = @($results | Where-Object Status -eq 'Warn').Count
    Failed = @($results | Where-Object Status -eq 'Fail').Count
    Unknown = @($results | Where-Object Status -eq 'Unknown').Count
    NotApplicable = @($results | Where-Object Status -eq 'NotApplicable').Count
    Results = $results
}

if ($OutputPath) {
    $dir = Split-Path -Path $OutputPath -Parent
    if ($dir -and -not (Test-Path -Path $dir)) {
        New-Item -Path $dir -ItemType Directory -Force | Out-Null
    }
    $summary | ConvertTo-Json -Depth 6 | Set-Content -Path $OutputPath -Encoding UTF8
}

# Console output
$summary.Results | Sort-Object Status, Name | Format-Table -AutoSize
Write-Host ""
Write-Host "Summary: Passed=$($summary.Passed) Warnings=$($summary.Warnings) Failed=$($summary.Failed) Unknown=$($summary.Unknown) NotApplicable=$($summary.NotApplicable)"

if ($PassThru) {
    [pscustomobject]$summary
}
```

## Usage notes
- Run the script in an elevated PowerShell session for the most complete results.
- Treat warnings as review items, not automatic failures.
- Use the JSON output option when you want to archive validation results for rollout records.
- Compare results from pilot, pre-production, and production devices to spot drift or role-specific exceptions.

## What to review after running it
- Any failed firewall profile
- BitLocker state on all fixed disks
- Secure Boot status on hardware that supports it
- UAC and execution policy alignment with your baseline
- Defender and audit policy signals
- Local Administrators group growth or unexpected membership

## Operational guidance
This script is intended to support a hardened baseline process, not replace policy management or compliance tooling. Use it as a quick validation aid before broader deployment, after policy changes, or during incident response when you need to confirm endpoint posture without making changes.

For a full baseline program, pair validation with a pilot plan, exception register, and rollback criteria for settings that affect authentication, boot, recovery, or remote administration.