Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

CIS - WIN10 - 2.3.17.X (#10275)

Browse Source
This commit is contained in:
RachelElysia
2023-03-02 17:18:02 -05:00
committed by GitHub
parent fdc55aabc4
commit 6b2cebd4f1
10 changed files with 279 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changes/9924-cis-win-10-2.3.17.x
+1
View File
@@ -0,0 +1 @@
- Add Win 10 policies for CIS Benchmark 2.3.17.x
ee/cis/win-10/cis-policy-queries.yml
+158
View File
@@ -931,4 +931,162 @@ spec:
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.10.12
contributors: rachelelysia
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'User Account Control: Admin Approval Mode for the Built-in Administrator account' is set to 'Enabled' (Automated)
platforms: win10
platform: windows
description: |
This policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account.
The recommended state for this setting is: Enabled.
resolution: |
To establish the recommended configuration via GP, set the following UI path to Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Admin Approval Mode for the Built-in Administrator account'
query: |
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\FilterAdministratorToken' AND data == 1);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.17.1
contributors: rachelelysia
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' is set to 'Prompt for consent on the secure desktop' (Automated)
platforms: win10
platform: windows
description: |
This policy setting controls the behavior of the elevation prompt for administrators.
The recommended state for this setting is: Prompt for consent on the secure desktop.
resolution: |
To establish the recommended configuration via GP, set the following UI path to 'Prompt for consent on the secure desktop':
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode'
query: |
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\ConsentPromptBehaviorAdmin' AND data == 2);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.17.2
contributors: rachelelysia
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'User Account Control: Behavior of the elevation prompt for standard users' is set to 'Automatically deny elevation requests' (Automated)
platforms: win10
platform: windows
description: |
This policy setting controls the behavior of the elevation prompt for standard users.
The recommended state for this setting is: Automatically deny elevation requests.
resolution: |
To establish the recommended configuration via GP, set the following UI path to Automatically deny elevation requests:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for standard users'
query: |
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\ConsentPromptBehaviorUser' AND data == 0);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.17.3
contributors: rachelelysia
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'User Account Control: Detect application installations and prompt for elevation' is set to 'Enabled' (Automated)
platforms: win10
platform: windows
description: |
This policy setting controls the behavior of application installation detection for the computer.
The recommended state for this setting is: Enabled.
resolution: |
To establish the recommended configuration via GP, set the following UI path to Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Detect application installations and prompt for elevation'
query: |
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\EnableInstallerDetection' and data == 1);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.17.4
contributors: rachelelysia
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'User Account Control: Only elevate UIAccess applications that are installed in secure locations' is set to 'Enabled' (Automated)
platforms: win10
platform: windows
description: |
This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following:
...\Program Files\, including subfolders
...\Windows\System32\
...\Program Files (x86)\, including subfolders (for 64-bit versions of Windows)
resolution: |
To establish the recommended configuration via GP, set the following UI path to Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Only elevate UIAccess applications that are installed in secure locations'
query: |
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\EnableSecureUIAPaths' and data == '1');
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.17.5
contributors: rachelelysia
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'User Account Control: Run all administrators in Admin Approval Mode' is set to 'Enabled' (Automated)
platforms: win10
platform: windows
description: |
This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer.
The recommended state for this setting is: Enabled.
resolution: |
To establish the recommended configuration via GP, set the following UI path to Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Run all administrators in Admin Approval Mode'
query: |
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\EnableLUA' and data == 1);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.17.6
contributors: rachelelysia
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled' (Automated)
platforms: win10
platform: windows
description: |
This policy setting controls whether the elevation request prompt is displayed on the interactive user's desktop or the secure desktop.
The recommended state for this setting is: Enabled.
resolution: |
To establish the recommended configuration via GP, set the following UI path to Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Switch to the secure desktop when prompting for elevation'
query: |
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\PromptOnSecureDesktop' and data == 1);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.17.7
contributors: rachelelysia
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'User Account Control: Virtualize file and registry write failures to per-user locations' is set to 'Enabled' (Automated)
platforms: win10
platform: windows
description: |
This policy setting controls whether application write failures are redirected to defined registry and file system locations. This policy setting mitigates applications that run as administrator and write run-time application data to:
%ProgramFiles%
%windir%
%windir%\System32
HKEY_LOCAL_MACHINE\SOFTWARE
The recommended state for this setting is: Enabled.
resolution: |
To establish the recommended configuration via GP, set the following UI path to Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Virtualize file and registry write failures to per-user locations'
query: |
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\EnableVirtualization' and data == 1);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.17.8
contributors: rachelelysia
---
ee/cis/win-10/test/instructions/CIS_2.3.17.1.txt
+15
View File
@@ -0,0 +1,15 @@
Expected scenario
==================
1) Open "Edit Group Policy" tool and set the following UI path to Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Admin Approval Mode for the Built-in Administrator account'
2) After running the policy check, it should return 1 indicating that setting was properly set
Failure scenario
==================
1) Open "Edit Group Policy" tool and set the following UI path to a value other than Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Admin Approval Mode for the Built-in Administrator account'
2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value
ee/cis/win-10/test/instructions/CIS_2.3.17.2.txt
+15
View File
@@ -0,0 +1,15 @@
Expected scenario
==================
1) Open "Edit Group Policy" tool and set the following UI path to 'Prompt for consent on the secure desktop':
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode'
2) After running the policy check, it should return 1 indicating that setting was properly set
Failure scenario
==================
1) Open "Edit Group Policy" tool and set the following UI path to a value other than 'Prompt for consent on the secure desktop':
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode'
2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value
ee/cis/win-10/test/instructions/CIS_2.3.17.3.txt
+15
View File
@@ -0,0 +1,15 @@
Expected scenario
==================
1) Open "Edit Group Policy" tool and set the following UI path to 'Automatically deny elevation requests':
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for standard users'
2) After running the policy check, it should return 1 indicating that setting was properly set
Failure scenario
==================
1) Open "Edit Group Policy" tool and set the following UI path to a value other than 'Automatically deny elevation requests':
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for standard users'
2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value
ee/cis/win-10/test/instructions/CIS_2.3.17.4.txt
+15
View File
@@ -0,0 +1,15 @@
Expected scenario
==================
1) Open "Edit Group Policy" tool and set the following UI path to Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Detect application installations and prompt for elevation'
2) After running the policy check, it should return 1 indicating that setting was properly set
Failure scenario
==================
1) Open "Edit Group Policy" tool and set the following UI path to a value other than Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Detect application installations and prompt for elevation'
2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value
ee/cis/win-10/test/instructions/CIS_2.3.17.5.txt
+15
View File
@@ -0,0 +1,15 @@
Expected scenario
==================
1) Open "Edit Group Policy" tool and set the following UI path to Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Only elevate UIAccess applications that are installed in secure locations'
2) After running the policy check, it should return 1 indicating that setting was properly set
Failure scenario
==================
1) Open "Edit Group Policy" tool and set the following UI path to a value other than Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Only elevate UIAccess applications that are installed in secure locations'
2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value
ee/cis/win-10/test/instructions/CIS_2.3.17.6.txt
+15
View File
@@ -0,0 +1,15 @@
Expected scenario
==================
1) Open "Edit Group Policy" tool and set the following UI path to Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Run all administrators in Admin Approval Mode'
2) After running the policy check, it should return 1 indicating that setting was properly set
Failure scenario
==================
1) Open "Edit Group Policy" tool and set the following UI path to a value other than Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Run all administrators in Admin Approval Mode'
2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value
ee/cis/win-10/test/instructions/CIS_2.3.17.7.txt
+15
View File
@@ -0,0 +1,15 @@
Expected scenario
==================
1) Open "Edit Group Policy" tool and set the following UI path to Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Switch to the secure desktop when prompting for elevation'
2) After running the policy check, it should return 1 indicating that setting was properly set
Failure scenario
==================
1) Open "Edit Group Policy" tool and set the following UI path to a value other than Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Switch to the secure desktop when prompting for elevation'
2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value
ee/cis/win-10/test/instructions/CIS_2.3.17.8.txt
+15
View File
@@ -0,0 +1,15 @@
Expected scenario
==================
1) Open "Edit Group Policy" tool and set the following UI path to Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Virtualize file and registry write failures to per-user locations'
2) After running the policy check, it should return 1 indicating that setting was properly set
Failure scenario
==================
1) Open "Edit Group Policy" tool and set the following UI path to a value other than Enabled:
'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Virtualize file and registry write failures to per-user locations'
2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value