engineering-workstation-hardening-auditlisted

## When to Use - Periodic hardening review of the EWS estate. - Investigating EWS compromise indicators, such as unexpected engineering software installs. - Before connecting a new EWS to the OT network. - After a vendor engineer worked on a station. ## Prerequisites - Local Administrator or WinRM remote access to each EWS. - PowerShell 5.1 or newer on the targets. - The site EWS inventory with hostnames and owners. - Engineering software list: TIA Portal, Studio 5000, RSLogix, Wonderware, iFIX, others per site. - Credentials: local admin on each station, or a delegated account with remote audit rights. - Authorization: EWS owner sign-off. Remote collection is active and gated. - Upstream skills: `passive-ot-network-discovery` to locate the stations. ### Safety This skill is active. Collection touches live workstations and is gated in the Workflow section. - Active. Reads live OS state over WinRM. No configuration changes. Requires change control approval. ## Workflow 1. Verify reachability without touching the target: `Test-NetConnection <ews-host> -Port 5985` A failed WinRM test means the station must be audited locally at the console. 2. Collect locally on the station: `powershell -ExecutionPolicy Bypass -File ews_harden_check.ps1 -Out ews-audit-<host>.json` 3. Or collect remotely from the audit host: > STOP: Confirm change control approval before executing this step. If approval is missing, halt and report. `powershell -Command "Invoke-Command -Comp