diff --git a/changes/9924-cis-win-10-2.3.17.x b/changes/9924-cis-win-10-2.3.17.x new file mode 100644 index 0000000000..0bda4ffd22 --- /dev/null +++ b/changes/9924-cis-win-10-2.3.17.x @@ -0,0 +1 @@ +- Add Win 10 policies for CIS Benchmark 2.3.17.x diff --git a/ee/cis/win-10/cis-policy-queries.yml b/ee/cis/win-10/cis-policy-queries.yml index 7bace9d339..80c4ea1519 100644 --- a/ee/cis/win-10/cis-policy-queries.yml +++ b/ee/cis/win-10/cis-policy-queries.yml @@ -931,4 +931,162 @@ spec: tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.10.12 contributors: rachelelysia --- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'User Account Control: Admin Approval Mode for the Built-in Administrator account' is set to 'Enabled' (Automated) + platforms: win10 + platform: windows + description: | + This policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account. + The recommended state for this setting is: Enabled. + resolution: | + To establish the recommended configuration via GP, set the following UI path to Enabled: + 'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Admin Approval Mode for the Built-in Administrator account' + query: | + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\FilterAdministratorToken' AND data == 1); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.17.1 + contributors: rachelelysia +--- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' is set to 'Prompt for consent on the secure desktop' (Automated) + platforms: win10 + platform: windows + description: | + This policy setting controls the behavior of the elevation prompt for administrators. + The recommended state for this setting is: Prompt for consent on the secure desktop. + resolution: | + To establish the recommended configuration via GP, set the following UI path to 'Prompt for consent on the secure desktop': + 'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' + query: | + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\ConsentPromptBehaviorAdmin' AND data == 2); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.17.2 + contributors: rachelelysia +--- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'User Account Control: Behavior of the elevation prompt for standard users' is set to 'Automatically deny elevation requests' (Automated) + platforms: win10 + platform: windows + description: | + This policy setting controls the behavior of the elevation prompt for standard users. + The recommended state for this setting is: Automatically deny elevation requests. + resolution: | + To establish the recommended configuration via GP, set the following UI path to Automatically deny elevation requests: + 'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for standard users' + query: | + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\ConsentPromptBehaviorUser' AND data == 0); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.17.3 + contributors: rachelelysia +--- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'User Account Control: Detect application installations and prompt for elevation' is set to 'Enabled' (Automated) + platforms: win10 + platform: windows + description: | + This policy setting controls the behavior of application installation detection for the computer. + The recommended state for this setting is: Enabled. + resolution: | + To establish the recommended configuration via GP, set the following UI path to Enabled: + 'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Detect application installations and prompt for elevation' + query: | + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\EnableInstallerDetection' and data == 1); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.17.4 + contributors: rachelelysia +--- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'User Account Control: Only elevate UIAccess applications that are installed in secure locations' is set to 'Enabled' (Automated) + platforms: win10 + platform: windows + description: | + This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following: + ...\Program Files\, including subfolders + ...\Windows\System32\ + ...\Program Files (x86)\, including subfolders (for 64-bit versions of Windows) + resolution: | + To establish the recommended configuration via GP, set the following UI path to Enabled: + 'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Only elevate UIAccess applications that are installed in secure locations' + query: | + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\EnableSecureUIAPaths' and data == '1'); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.17.5 + contributors: rachelelysia +--- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'User Account Control: Run all administrators in Admin Approval Mode' is set to 'Enabled' (Automated) + platforms: win10 + platform: windows + description: | + This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. + The recommended state for this setting is: Enabled. + resolution: | + To establish the recommended configuration via GP, set the following UI path to Enabled: + 'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Run all administrators in Admin Approval Mode' + query: | + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\EnableLUA' and data == 1); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.17.6 + contributors: rachelelysia +--- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled' (Automated) + platforms: win10 + platform: windows + description: | + This policy setting controls whether the elevation request prompt is displayed on the interactive user's desktop or the secure desktop. + The recommended state for this setting is: Enabled. + resolution: | + To establish the recommended configuration via GP, set the following UI path to Enabled: + 'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Switch to the secure desktop when prompting for elevation' + query: | + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\PromptOnSecureDesktop' and data == 1); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.17.7 + contributors: rachelelysia +--- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'User Account Control: Virtualize file and registry write failures to per-user locations' is set to 'Enabled' (Automated) + platforms: win10 + platform: windows + description: | + This policy setting controls whether application write failures are redirected to defined registry and file system locations. This policy setting mitigates applications that run as administrator and write run-time application data to: + %ProgramFiles% + %windir% + %windir%\System32 + HKEY_LOCAL_MACHINE\SOFTWARE + The recommended state for this setting is: Enabled. + resolution: | + To establish the recommended configuration via GP, set the following UI path to Enabled: + 'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Virtualize file and registry write failures to per-user locations' + query: | + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\EnableVirtualization' and data == 1); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.17.8 + contributors: rachelelysia +--- diff --git a/ee/cis/win-10/test/instructions/CIS_2.3.17.1.txt b/ee/cis/win-10/test/instructions/CIS_2.3.17.1.txt new file mode 100644 index 0000000000..590d2e2495 --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_2.3.17.1.txt @@ -0,0 +1,15 @@ +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to Enabled: +'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Admin Approval Mode for the Built-in Administrator account' + +2) After running the policy check, it should return 1 indicating that setting was properly set + + + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to a value other than Enabled: +'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Admin Approval Mode for the Built-in Administrator account' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file diff --git a/ee/cis/win-10/test/instructions/CIS_2.3.17.2.txt b/ee/cis/win-10/test/instructions/CIS_2.3.17.2.txt new file mode 100644 index 0000000000..f3c8bf7964 --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_2.3.17.2.txt @@ -0,0 +1,15 @@ +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to 'Prompt for consent on the secure desktop': +'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' + +2) After running the policy check, it should return 1 indicating that setting was properly set + + + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to a value other than 'Prompt for consent on the secure desktop': +'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file diff --git a/ee/cis/win-10/test/instructions/CIS_2.3.17.3.txt b/ee/cis/win-10/test/instructions/CIS_2.3.17.3.txt new file mode 100644 index 0000000000..753f88d32c --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_2.3.17.3.txt @@ -0,0 +1,15 @@ +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to 'Automatically deny elevation requests': +'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for standard users' + +2) After running the policy check, it should return 1 indicating that setting was properly set + + + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to a value other than 'Automatically deny elevation requests': +'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for standard users' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file diff --git a/ee/cis/win-10/test/instructions/CIS_2.3.17.4.txt b/ee/cis/win-10/test/instructions/CIS_2.3.17.4.txt new file mode 100644 index 0000000000..41cd6ea780 --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_2.3.17.4.txt @@ -0,0 +1,15 @@ +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to Enabled: +'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Detect application installations and prompt for elevation' + +2) After running the policy check, it should return 1 indicating that setting was properly set + + + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to a value other than Enabled: +'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Detect application installations and prompt for elevation' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file diff --git a/ee/cis/win-10/test/instructions/CIS_2.3.17.5.txt b/ee/cis/win-10/test/instructions/CIS_2.3.17.5.txt new file mode 100644 index 0000000000..d7263e9dbc --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_2.3.17.5.txt @@ -0,0 +1,15 @@ +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to Enabled: +'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Only elevate UIAccess applications that are installed in secure locations' + +2) After running the policy check, it should return 1 indicating that setting was properly set + + + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to a value other than Enabled: +'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Only elevate UIAccess applications that are installed in secure locations' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file diff --git a/ee/cis/win-10/test/instructions/CIS_2.3.17.6.txt b/ee/cis/win-10/test/instructions/CIS_2.3.17.6.txt new file mode 100644 index 0000000000..bce6e9a9f9 --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_2.3.17.6.txt @@ -0,0 +1,15 @@ +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to Enabled: +'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Run all administrators in Admin Approval Mode' + +2) After running the policy check, it should return 1 indicating that setting was properly set + + + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to a value other than Enabled: +'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Run all administrators in Admin Approval Mode' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file diff --git a/ee/cis/win-10/test/instructions/CIS_2.3.17.7.txt b/ee/cis/win-10/test/instructions/CIS_2.3.17.7.txt new file mode 100644 index 0000000000..3404ffbe7b --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_2.3.17.7.txt @@ -0,0 +1,15 @@ +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to Enabled: +'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Switch to the secure desktop when prompting for elevation' + +2) After running the policy check, it should return 1 indicating that setting was properly set + + + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to a value other than Enabled: +'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Switch to the secure desktop when prompting for elevation' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file diff --git a/ee/cis/win-10/test/instructions/CIS_2.3.17.8.txt b/ee/cis/win-10/test/instructions/CIS_2.3.17.8.txt new file mode 100644 index 0000000000..68d727a505 --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_2.3.17.8.txt @@ -0,0 +1,15 @@ +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to Enabled: +'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Virtualize file and registry write failures to per-user locations' + +2) After running the policy check, it should return 1 indicating that setting was properly set + + + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to a value other than Enabled: +'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Virtualize file and registry write failures to per-user locations' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file