Installation

What's New

You can now cache the authentication tokens locally by enabling the "Cache Tokens Locally" option Microsoft Graph button so that you won't have to manually authenticate again after you close and reopen the app. The authentication tokens are encrypted on disk and removed when the app is uninstalled. The token cache can only be read by the current user on the same system. If it was exfiltrated, the tokens would be useless to an attacker as they are encrypted and tied to the current user and system.
You can clear the local authentication token cache via the provided button.
When navigating to different pages that utilize the Microsoft Graph button, the correct account based on the authentication context is automatically selected, improving the user experience. It was suggested on GitHub discussion by community members.

The filter origin column now displays friendly names of the custom rules responsible for generating the blocked event. Previously, if a custom rule was responsible for blocking an event, the filter origin column would display the GUID of the rule. This change helps you easily identify which custom rule is responsible for blocking a packet/connection.
The "Scan Logs" and "Start Live Monitor" buttons are now mutually exclusive and only one of them can be used at a time which is the expected behavior.
For the Log scanning area, added an option under the Actions menu called "Resolve Destination Addresses". If on (off by default), it will attempt to resolve the destination IP addresses to host names. This can help you identify the destination of blocked events more easily. However, it may increase the time it takes to scan logs, especially if there are many unique destination IP addresses. It alternates between Cloudflare and Google's DNS over HTTPS servers via their IP addresses. This provides 2 benefits:
1. It will work even if system DNS in unavailable.
2. It is secure and private as it does not leak DNS queries to third parties. Local or loopback IP addresses are automatically detected and not resolved.
The close animations around the profile areas have been improved so that they now follow the same path as opening animations, improving visual consistency.
Improved the UI localizations.

Note

The update should be available on the Microsoft Store on Monday, March 2nd 2026

How to verify the MSIXBundle's authenticity:

gh attestation verify "Path To MSIXBundle" --repo HotCakeX/Harden-Windows-Security --format json

winget install --id GitHub.cli