> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/system-hardening/how-do-i-increase-security-for-automatic-system-hardening-on-windows-hosts-in-enginsight.md).

# How do I increase security for automatic system hardening on Windows hosts in Enginsight?

[Automatic system hardening](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/compliance/automatic-system-hardening-checklists) in Enginsight helps you meet technical specifications and legal compliance requirements. It includes security-relevant technical checks of your hosts that are performed automatically. If required, the corresponding system hardening is automatically rolled out to the assigned hosts.

To increase security when automatic system hardening is executed on Windows hosts, you can store an Enginsight-issued certificate on the relevant hosts.

***

## Importing the Enginsight Certificate

Follow these steps to import the Enginsight certificate on a Windows host:

{% stepper %}
{% step %}

1. On a Windows host with Pulsar installed, navigate to the following directory:

```
C:\Program Files\Enginsight\Pulsar\
```

2. Right-click the file `ngs-pulsar-amd64.exe` to open the context menu
3. Click **Properties**.
   {% endstep %}

{% step %}
The **ngs-pulsar-amd64 Properties** window opens.

1. Navigate to the **Digital Signatures** tab. 
2. Select the signature with the digest algorithm **sha256**.
3. Click **Details**.
   {% endstep %}

{% step %}
The **Digital Signature Details** window opens. Click **View Certificate**.
{% endstep %}

{% step %}
The **Certificate** window opens. Click **Install Certificate**.
{% endstep %}

{% step %}
The **Certificate Import Wizard** opens.

1. Select **Local Machine** as the **Store Location** and click **Next**.
2. Confirm the **User Account Control** prompt with **Yes**.
   {% endstep %}

{% step %}

1. In the **Certificate Store** step, select **Place all certificates in the following store**. 
2. Click **Browse**.
   {% endstep %}

{% step %}
The **Select Certificate Store** window opens.

1. Select the **Trusted Publishers** folder. 
2. Click **OK**.
   {% endstep %}

{% step %}
Review your settings and click **Next**.
{% endstep %}

{% step %}

1. In the **Completing the Certificate Import Wizard** step, review all settings one final time and make sure that **Trusted Publishers** is selected as the certificate store.
2. Click **Finish** to import the certificate.
3. Confirm the message stating that the import was successful by clicking **OK**.
   {% endstep %}

{% step %}
Now use Windows Certificate Manager to check whether the certificate was imported successfully.

1. Press the **Windows** key + **R** and enter **certlm.msc** in the search field. Confirm your entry with the **Enter** key.
2. Confirm the **User Account Control** prompt with **Yes**.
3. The **Windows Certificate Manager** opens. Navigate to **Trusted Publishers** → **Certificates**. Enginsight GmbH must now appear here as a trusted publisher.
   {% endstep %}
   {% endstepper %}

***

## Creating a Windows Group Policy

Because scripts for automatic system hardening on Windows are executed in a PowerShell session, the execution of signed PowerShell scripts must be enforced using a Windows Group Policy.

The following section explains how to configure a corresponding Local Group Policy.

{% hint style="danger" %}
**Please note:** If you enable the **Allow only signed scripts** execution policy as a Local Group Policy, signatures will be required for **all PowerShell scripts**. This also affects, for example, custom Enginsight plugins and other PowerShell scripts that are unrelated to the Enginsight platform.
{% endhint %}

{% stepper %}
{% step %}
Open the Local Group Policy Editor as an administrator.

1. Press the **Windows** key + **R** and enter **certlm.msc** in the search field. Confirm your entry with the **Enter** key.
2. Confirm the **User Account Control** prompt with **Yes**.
3. The **Local Group Policy Editor** opens.
   {% endstep %}

{% step %}

1. Navigate to **Computer Configuration** → **Administrative Templates** → **Windows Components** → **Windows PowerShell**.
2. Under **Settings**, click **Turn on Script Execution**.
   {% endstep %}

{% step %}
The **Turn on Script Execution** window opens.

1. For **Execution Policy**, select **Allow only signed scripts**. 
2. Click **OK** to apply the Local Group Policy.
   {% endstep %}
   {% endstepper %}

***