# How to Enable and Configure Windows-Specific Security Packs in dcg

> Learn to enable and configure Windows-specific security packs in dcg. Discover automatic, manual, and CLI methods to enhance your system security effectively.

- Repository: [Jeff Emanuel/destructive_command_guard](https://github.com/Dicklesworthstone/destructive_command_guard)
- Tags: how-to-guide
- Published: 2026-07-14

---

**You can enable Windows-specific security packs in dcg either automatically on Windows hosts via `cfg(windows)`, manually in `~/.config/dcg/config.toml` by adding `"windows"` to the `enabled` list, or through the CLI with `dcg packs enable windows`.**

The `dcg` (Destructive Command Guard) repository provides native protection against dangerous commands across platforms. When working with Windows environments, you can leverage **Windows-specific security packs in dcg** to block destructive PowerShell cmdlets, CMD verbs, and system utilities before they execute.

## Understanding Windows Security Packs

The Windows-specific security packs are organized into four distinct categories that target different attack vectors:

- **`windows.filesystem`**: Blocks destructive file-system verbs such as `del`, `erase`, and `rm`
- **`windows.system`**: Prevents execution of system-level utilities including `diskpart` and `vssadmin`
- **`windows.powershell`**: Protects against PowerShell cmdlets that delete or format data
- **`windows.misc`**: Covers miscellaneous dangerous patterns like `robocopy` misuse

By default, these packs are registered on every platform but only auto-enabled when the binary is built for Windows (`cfg(windows)`). This design ensures immediate protection on fresh Windows installations while maintaining performance on Unix systems.

## Enabling Windows Security Packs

### Automatic Enablement on Windows

When `dcg` runs on Windows, the packs activate automatically. The `PacksConfig::enabled_pack_ids` logic in [`src/packs/windows/mod.rs`](https://github.com/Dicklesworthstone/destructive_command_guard/blob/main/src/packs/windows/mod.rs) (lines 29-35) includes these packs under the `cfg(windows)` conditional compilation flag. No manual configuration is required on Windows hosts.

### Opt-In on Non-Windows Platforms

To protect Windows scripts while running on Linux or macOS—such as when scanning `.ps1` or `.cmd` files in CI pipelines—add the desired pack IDs to the **`enabled`** list in your configuration file.

The default configuration location is `~/.config/dcg/config.toml`:

```toml
[packs]

# Enable all Windows packs

enabled = ["windows"]

# Or enable specific packs only:

# enabled = ["windows.filesystem", "windows.powershell"]

```

You can also use the **`disabled`** list to selectively turn off specific packs while keeping the category enabled:

```toml
[packs]
enabled = ["windows"]
disabled = ["windows.system"]

```

### Command-Line Configuration

`dcg` provides experimental CLI shortcuts to toggle packs without editing the configuration file directly:

```bash

# Enable the entire Windows category

dcg packs enable windows

# Enable only the filesystem pack

dcg packs enable windows.filesystem

```

These commands internally write the same entries to your configuration file.

## How Windows Packs Work

The Windows-specific security packs implement several optimization strategies to maintain performance while ensuring comprehensive protection.

### Case-Insensitive Pattern Matching

Each regex pattern is prefixed with `(?i)` to match Windows' case-insensitive command verbs. For example, `DEL` matches `del`, `Del`, and `dEl` identically. This implementation appears in [`src/packs/windows/filesystem.rs`](https://github.com/Dicklesworthstone/destructive_command_guard/blob/main/src/packs/windows/filesystem.rs) at line 119.

### Keyword Quick-Reject Filter

To keep the hot-path allocation-free, the packs use a case-sensitive Aho-Corasick filter that enumerates realistic casings. The helper function `windows_keyword_casings` generates lists covering lowercase and UPPERCASE for CMD verbs, plus PascalCase and lowercase for PowerShell cmdlets. This ensures the pack isn't bypassed before the regex engine processes the command.

### Pack Registration

All Windows packs are created in [`src/packs/mod.rs`](https://github.com/Dicklesworthstone/destructive_command_guard/blob/main/src/packs/mod.rs) under the `windows` module and hooked into the evaluation engine via `create_pack` functions. The configuration logic in [`src/config.rs`](https://github.com/Dicklesworthstone/destructive_command_guard/blob/main/src/config.rs) (lines 1402-1409) handles the `enabled` and `disabled` lists, including platform-specific logic for Windows builds.

## Configuration Examples

### Cross-Platform CI Scanning

When scanning PowerShell scripts on a Linux CI runner, enable the PowerShell-specific pack:

```toml

# ~/.config/dcg/config.toml

[packs]
enabled = ["windows.powershell"]

```

Running `dcg scan ./scripts` now flags dangerous commands like:

```powershell
Remove-Item -Recurse -Force C:\Windows\System32

```

The denial output includes the rule ID `windows.powershell:remove-item-recursive`.

### Selective Pack Disabling

To disable only the system-level pack while keeping filesystem and PowerShell protection:

```toml
[packs]
enabled = ["windows"]
disabled = ["windows.system"]

```

This configuration allows `diskpart` commands to execute while blocking `del` and `Remove-Item`.

### Verifying Pack Activation

Check which packs are currently active using:

```bash
dcg packs list --verbose

```

On Windows, you will see:

```

✓ windows.filesystem   (enabled)
✓ windows.system       (enabled)
✓ windows.powershell   (enabled)
✓ windows.misc         (enabled)

```

On non-Windows hosts, these appear as **disabled** unless you have explicitly enabled them in your configuration.

## Summary

- **Windows-specific security packs in dcg** include four categories: `windows.filesystem`, `windows.system`, `windows.powershell`, and `windows.misc`
- Packs auto-enable on Windows via `cfg(windows)` logic in [`src/packs/windows/mod.rs`](https://github.com/Dicklesworthstone/destructive_command_guard/blob/main/src/packs/windows/mod.rs)
- Non-Windows users can opt-in by adding `"windows"` to the `enabled` list in `~/.config/dcg/config.toml`
- The CLI provides `dcg packs enable windows` for quick toggling
- Case-insensitive regex patterns with `(?i)` prefixes match Windows command verb behavior
- Configuration logic resides in [`src/config.rs`](https://github.com/Dicklesworthstone/destructive_command_guard/blob/main/src/config.rs) (lines 1402-1409)

## Frequently Asked Questions

### How do I enable Windows packs on Linux for CI scanning?

Add `"windows"` or specific pack IDs like `"windows.powershell"` to the `enabled` array in your `~/.config/dcg/config.toml` file under the `[packs]` section. This allows you to scan Windows scripts (`.ps1`, `.cmd`) for destructive commands even when running on Linux or macOS build agents.

### Why are Windows packs disabled by default on non-Windows systems?

The packs are registered on all platforms but only auto-enabled under `cfg(windows)` to optimize performance on Unix systems. This prevents unnecessary regex evaluations for Windows-specific patterns when you are not working with Windows command syntax, while allowing manual opt-in when needed for cross-platform script analysis.

### Can I disable specific Windows packs while keeping others active?

Yes. Add the parent category `"windows"` to your `enabled` list, then add specific pack IDs (such as `"windows.system"`) to the `disabled` list. This configuration keeps filesystem and PowerShell protection active while allowing system utilities like `diskpart` to execute.

### Where does dcg store the Windows pack configuration?

Configuration is stored in `~/.config/dcg/config.toml` by default. The `enabled` and `disabled` arrays under the `[packs]` section control which Windows packs are active. The CLI commands `dcg packs enable` and `dcg packs disable` modify this file directly.