-
Notifications
You must be signed in to change notification settings - Fork 28
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fixes to clear warnings from win11-23h2 (#267)
* Fixes for Win11_23H2 * static corrections + validations for Win11_23H2\ * clean up range validations * Add command for testing one test * Add new tests for static corrections * Add tests for translating registry key (HKLM) * Add test for building pattern string * add missing account policy setting to dictionary * .gitignore updates * rename generate_resource * removed NetIDs from examples * updated CHANGELOG.md * add win11 to dscresourcestoexport --------- Co-authored-by: Ashley Valentijn <[email protected]> Co-authored-by: Mark Wenneborg <[email protected]> Co-authored-by: Tamara Buch <[email protected]> Co-authored-by: David Riddle <[email protected]> Co-authored-by: Michelle Pitcel <[email protected]> Co-authored-by: Tyler Turner <[email protected]> Co-authored-by: Zach Carrington <[email protected]>
- Loading branch information
8 people
authored
Feb 12, 2024
1 parent
279a85a
commit 58930c3
Showing
17 changed files
with
239 additions
and
32 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
|
|
||
| deps: | ||
| pwsh ./tools/install_dependencies.ps1 | ||
|
|
||
| # TODO: May need apt-get -y update | ||
| linux_deps: | ||
| echo "This command requires sudo" | ||
| apt-get install -y --no-install-recommends libgdiplus libc6-dev | ||
|
|
||
| # TODO: depends on 'deps' | ||
| resource_changes: | ||
| pwsh ./tools/generate_resources_changes.ps1 | ||
|
|
||
| test_pester: | ||
| pwsh -CommandWithArgs "Invoke-Pester" | ||
| test_debug: | ||
| invoke-pester -TagFilter Debug -Output Diagnostic |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| "Recommendation","HasParameter" | ||
| "1.1.1","0" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| "Recommendation","ValidationString" | ||
| "1.1.2","[ValidateRange(1,60)]" | ||
| "1.1.3","[ValidateRange(1,998)]" | ||
| "1.1.4","[ValidateRange(14,128)]" | ||
| "1.2.1","[ValidateRange(15,99999)]" | ||
| "1.2.2","[ValidateRange(10,999)]" | ||
| "1.2.4","[ValidateRange(15,99999)]" | ||
| "18.3.5","[ValidateRange(15,64)]" | ||
| "18.3.6","[ValidateRange(30,365)]" | ||
| "18.5.10","[ValidateSet('0','1','2','3','4','5')]" | ||
| "18.5.13","[ValidateRange(0,90)]" | ||
| "18.10.26.1.2","[ValidateRange(32768,2147483647)]" | ||
| "18.10.26.2.2","[ValidateRange(196608,2147483647)]" | ||
| "18.10.26.3.2","[ValidateRange(32768,2147483647)]" | ||
| "18.10.26.4.2","[ValidateRange(32768,2147483647)]" | ||
| "18.10.57.3.10.1","[ValidateRange(60000,900000)]" | ||
| "18.10.93.4.2","[ValidateRange(180,365)]" | ||
| "2.3.1.4","[ValidateLength(1,256)]" | ||
| "2.3.1.5","[ValidateLength(1,256)]" | ||
| "2.3.6.5","[ValidateRange(1,30)]" | ||
| "2.3.7.3","[ValidateRange(1,10)]" | ||
| "2.3.7.4","[ValidateRange(1,900)]" | ||
| "2.3.7.5","[ValidateLength(1,2048)]" | ||
| "2.3.7.6","[ValidateLength(1,512)]" | ||
| "2.3.7.7","[ValidateSet('0','1','2','3','4')]" | ||
| "2.3.7.8","[ValidateLength(5,14)]" | ||
| "2.3.9.1","[ValidateLength(1,15)]" | ||
| "9.1.6","[ValidateRange(16384,2147483647)]" | ||
| "9.2.6","[ValidateRange(16384,2147483647)]" | ||
| "9.3.8","[ValidateRange(16384,2147483647)]" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| "Key","Recommendation","Reason","CISTicket" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:FDVNoBitLockerToGoReader","18.10.9.1.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE:FDVEnforcePassphrase","18.10.9.1.11","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE:FDVPassphraseComplexity","18.10.9.1.11","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE:FDVPassphraseLength","18.10.9.1.11","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:FDVAllowedHardwareEncryptionAlgorithms","18.10.9.1.10","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:FDVRestrictHardwareEncryptionAlgorithms","18.10.9.1.10","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:FDVAllowSoftwareEncryptionFailover","18.10.9.2.11","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:OSAllowSoftwareEncryptionFailover","18.10.9.2.11","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:OSRestrictHardwareEncryptionAlgorithms","18.10.9.2.11","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:OSAllowedHardwareEncryptionAlgorithms","18.10.9.2.11","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:OSPassphraseASCIIOnly","18.10.9.2.12","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:OSPassphraseLength","18.10.9.2.12","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:OSPassphraseComplexity","18.10.9.2.12","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:RDVAllowSoftwareEncryptionFailover","18.10.9.2.13","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:RDVAllowedHardwareEncryptionAlgorithms","18.10.9.2.13","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:UseTPMKey","18.10.9.2.13","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:RDVRestrictHardwareEncryptionAlgorithms","18.10.9.2.13","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:UseTPMKeyPIN","18.10.9.2.13","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:UseTPM","18.10.9.2.13","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:UseTPMPIN","18.10.9.2.13","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:RDVNoBitLockerToGoReader","18.10.9.3.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:RDVEnforcePassphrase","18.10.9.3.11","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:RDVPassphraseComplexity","18.10.9.3.11","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE:RDVPassphraseLength","18.10.9.3.11","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses:1","18.9.7.1.5","key is in a related recommendation 18.9.7.1.5","" | ||
| "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses:2","18.9.7.1.5","key is in a related recommendation 18.9.7.1.5","" | ||
| "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses:3","18.9.7.1.5","key is in a related recommendation 18.9.7.1.5","" | ||
| "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses:4","18.9.7.1.5","key is in a related recommendation 18.9.7.1.5","" | ||
| "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses:","ignore","group policy seems to need this for 18.9.7.1.5 but its n/a for DSC","" | ||
| "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs:","ignore","group policy seems to need this for 18.9.7.1.5 but its n/a for DSC","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\AppHVSI:AppHVSIClipboardFileType","18.10.44.5","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging:EnableScriptBlockInvocationLogging","18.10.87.1","Outdated key in benchmark, https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScriptBlockLogging","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription:OutputDirectory","18.10.87.2","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription:EnableInvocationHeader","18.10.87.2","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate:PauseFeatureUpdatesStartTime","18.10.93.4.2","these keys have changed in 1703+ and the documentation is outdated. https://docs.microsoft.com/en-us/windows/deployment/update/waas-configure-wufb","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate:PauseQualityUpdatesStartTime","18.10.93.4.3","these keys have changed in 1703+ and the documentation is outdated. https://docs.microsoft.com/en-us/windows/deployment/update/waas-configure-wufb","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU:AllowMUUpdateService","18.10.93.2.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU:ScheduledInstallEveryWeek","18.10.93.2.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU:ScheduledInstallSecondWeek","18.10.93.2.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU:ScheduledInstallTime","18.10.93.2.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU:AutomaticMaintenanceEnabled","18.10.93.2.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU:AUOptions","18.10.93.2.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU:ScheduledInstallThirdWeek","18.10.93.2.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU:ScheduledInstallFourthWeek","18.10.93.2.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU:ScheduledInstallFirstWeek","18.10.93.2.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services:MaxTicketExpiryUnits","18.9.34.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\RAUnsolicit:","18.9.34.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services:fAllowFullControl","18.9.34.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services:fAllowUnsolicitedFullControl","18.9.34.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services:fUseMailto","18.9.34.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services:MaxTicketExpiry","18.9.34.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall:PolicyVersion","ignore","there is no documentation for what this key does and CIS has no idea what its in the remediation kit but its an unmentioned change with some firewall recommendation","" | ||
| "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars:HigherPrecedenceRegistrar","18.6.20.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service:IPv4Filter","18.10.89.2.2","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service:IPv6Filter","18.10.89.2.2","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard:ConfigureKernelShadowStacksLaunch","18.9.5.7","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate:ManagePreviewBuilds","18.10.93.4.1","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint:RestrictDriverInstallationToAdministrators","18.7.8","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint:Restricted","Ignore","This is not present in the benchmark","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint:TrustedServers","Ignore","This is not present in the benchmark","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint:ServerList","Ignore","This is not present in the benchmark","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint:InForest","Ignore","This is not present in the benchmark","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate:BranchReadinessLevel","18.10.93.4.2","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa:RunAsPPL","18.9.25.2","These are unmentioned keys impacted by the remediation steps","" | ||
| "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main:NotifyDisableIEOptions","Ignore","This is not present in the benchmark","" | ||
| "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars:MaxWCNDeviceNumber","18.6.20.1","These are unmentioned keys impacted by the remediation steps","" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
10 changes: 10 additions & 0 deletions
10
src/CISDSCResourceGeneration/functions/private/Get-RegKeyExpandHKLM.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| function Get-RegKeyExpandHKLM { | ||
| param ( | ||
| [Parameter(Mandatory = $true)] | ||
| [string]$KeyName, | ||
| [string]$ValueName | ||
|
|
||
| ) | ||
|
|
||
| return "$($KeyName -replace 'HKLM:','HKEY_LOCAL_MACHINE'):$($ValueName)" | ||
| } |
9 changes: 9 additions & 0 deletions
9
src/CISDSCResourceGeneration/functions/private/Get-RegPatternString.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| function Get-RegPatternString { | ||
| param( | ||
| [Parameter(Mandatory = $true)] | ||
| [string]$CorrectionKey | ||
| ) | ||
|
|
||
| [string]$patternString = "(?i)^($($CorrectionKey))$".replace("\","\\").Replace('*','[*]') | ||
| return $patternString | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.