diff --git a/changes/10138-cis-win10-9-3-x b/changes/10138-cis-win10-9-3-x new file mode 100644 index 0000000000..dab01ffd1c --- /dev/null +++ b/changes/10138-cis-win10-9-3-x @@ -0,0 +1 @@ +- Document CIS Windows10 Benchmarks 9.3.x to cis policy queries diff --git a/ee/cis/win-10/cis-policy-queries.yml b/ee/cis/win-10/cis-policy-queries.yml index f811ff9f4c..211ec818df 100644 --- a/ee/cis/win-10/cis-policy-queries.yml +++ b/ee/cis/win-10/cis-policy-queries.yml @@ -1409,6 +1409,196 @@ spec: --- apiVersion: v1 kind: policy +spec: + name: > + CIS - Ensure 'Windows Firewall: Public: Firewall state' is set to 'On (recommended)' + platforms: win10 + platform: windows + description: | + Select On (recommended) to have Windows Firewall with Advanced Security use the settings for this profile to filter network traffic. If you select Off, Windows Firewall with Advanced Security will not use any of the firewall rules or connection security rules for this profile. + The recommended state for this setting is: On (recommended). + resolution: | + To establish the recommended configuration via GP, set the following UI path to On (recommended): + 'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Firewall state' + query: | + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\EnableFirewall' and data == 1); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_9.3.1 + contributors: RachelElysia +--- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'Windows Firewall: Public: Inbound connections' is set to 'Block (default)' + platforms: win10 + platform: windows + description: | + This setting determines the behavior for inbound connections that do not match an inbound firewall rule. + The recommended state for this setting is: Block (default). + resolution: | + To establish the recommended configuration via GP, set the following UI path to Block (default): + 'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Inbound connections' + query: | + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\DefaultInboundAction' and data == 1); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_9.3.2 + contributors: RachelElysia +--- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'Windows Firewall: Public: Outbound connections' is set to 'Allow (default)' + platforms: win10 + platform: windows + description: | + This setting determines the behavior for outbound connections that do not match an outbound firewall rule. + The recommended state for this setting is: Allow (default). + resolution: | + To establish the recommended configuration via GP, set the following UI path to Allow (default): + 'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Outbound connections' + query: | + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\DefaultOutboundAction' and data == 0); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_9.3.3 + contributors: RachelElysia +--- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'Windows Firewall: Public: Settings: Display a notification' is set to 'No' + platforms: win10 + platform: windows + description: | + Select this option to have Windows Firewall with Advanced Security display notifications to the user when a program is blocked from receiving inbound connections. + The recommended state for this setting is: No. + resolution: | + To establish the recommended configuration via GP, set the following UI path to 'No': + 'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Settings Customize\Display a notification' + query: | + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\DisableNotifications' and data == 0); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_9.3.4 + contributors: RachelElysia +--- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'Windows Firewall: Public: Settings: Apply local firewall rules' is set to 'No' + platforms: win10 + platform: windows + description: | + This setting controls whether local administrators are allowed to create local firewall rules that apply together with firewall rules configured by Group Policy. + The recommended state for this setting is: No. + resolution: | + To establish the recommended configuration via GP, set the following UI path to No: + 'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Settings Customize\Apply local firewall rules' + query: | + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\AllowLocalPolicyMerge' and data == 0); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_9.3.5 + contributors: RachelElysia +--- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'Windows Firewall: Public: Settings: Apply local connection security rules' is set to 'No' + platforms: win10 + platform: windows + description: | + This setting controls whether local administrators are allowed to create connection security rules that apply together with connection security rules configured by Group Policy. + The recommended state for this setting is: No. + resolution: | + To establish the recommended configuration via GP, set the following UI path to No: + 'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Settings Customize\Apply local connection security rules' + query: | + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\AllowLocalIPsecPolicyMerge' and data == 0); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_9.3.6 + contributors: RachelElysia +--- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'Windows Firewall: Public: Logging: Name' is set to '%SystemRoot%\System32\logfiles\firewall\publicfw.log' + platforms: win10 + platform: windows + description: | + Use this option to specify the path and name of the file in which Windows Firewall will write its log information. + The recommended state for this setting is: %SystemRoot%\System32\logfiles\firewall\publicfw.log. + resolution: | + To establish the recommended configuration via GP, set the following UI path to %SystemRoot%\System32\logfiles\firewall\publicfw.log: + 'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Logging Customize\Name' + query: | + SELECT * FROM registry WHERE (key = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\Logging\LogFilePath' and data == '%SystemRoot%\System32\logfiles\firewall\publicfw.log'); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_9.3.7 + contributors: RachelElysia +--- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'Windows Firewall: Public: Logging: Size limit (KB)' is set to '16,384 KB or greater' + platforms: win10 + platform: windows + description: | + Use this option to specify the size limit of the file in which Windows Firewall will write its log information. + The recommended state for this setting is: 16,384 KB or greater. + resolution: | + To establish the recommended configuration via GP, set the following UI path to 16,384 KB or greater: + 'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Logging Customize\Size limit (KB)' + query: | + SELECT * FROM registry WHERE (key = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\Logging\LogFileSize' and data >= 16384 ); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_9.3.8 + contributors: RachelElysia +--- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'Windows Firewall: Public: Firewall state' is set to 'On (recommended)' + platforms: win10 + platform: windows + description: | + Select On (recommended) to have Windows Firewall with Advanced Security use the settings for this profile to filter network traffic. If you select Off, Windows Firewall with Advanced Security will not use any of the firewall rules or connection security rules for this profile. + The recommended state for this setting is: On (recommended). + resolution: | + To establish the recommended configuration via GP, set the following UI path to On (recommended): + 'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Firewall state' + query: | + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\EnableFirewall' and data == 1); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_9.3.9 + contributors: RachelElysia +--- +apiVersion: v1 +kind: policy +spec: + name: > + CIS - Ensure 'Windows Firewall: Public: Logging: Log successful connections' is set to 'Yes' + platforms: win10 + platform: windows + description: | + Use this option to log when Windows Firewall with Advanced Security allows an inbound connection. The log records why and when the connection was formed. Look for entries with the word ALLOW in the action column of the log. + The recommended state for this setting is: Yes. + resolution: | + To establish the recommended configuration via GP, set the following UI path to Yes. + 'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Logging Customize\Log successful connections' + query: | + SELECT 1 FROM registry WHERE (key = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\Logging\LogSuccessfulConnections' and data == 1 ); + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_9.3.10 + contributors: RachelElysia +--- +apiVersion: v1 +kind: policy spec: name: > CIS - Ensure 'Prevent enabling lock screen camera' is set to 'Enabled' diff --git a/ee/cis/win-10/test/instructions/CIS_9.3.1.txt b/ee/cis/win-10/test/instructions/CIS_9.3.1.txt new file mode 100644 index 0000000000..17521d9b23 --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_9.3.1.txt @@ -0,0 +1,15 @@ +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to 'On (recommended)': +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Firewall state' + +2) After running the policy check, it should return 1 indicating that setting was properly set + +Note: Manually check that the registry key (HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile) is present in the Windows machine before running the policy. + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to values different than 'On (recommended)': +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Firewall state' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value diff --git a/ee/cis/win-10/test/instructions/CIS_9.3.10.txt b/ee/cis/win-10/test/instructions/CIS_9.3.10.txt new file mode 100644 index 0000000000..6bce50e583 --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_9.3.10.txt @@ -0,0 +1,14 @@ +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to 'Yes': +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Logging Customize\Log successful connections' +2) After running the policy check, it should return 1 indicating that setting was properly set + +Note: Manually check that the registry key (HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile) is present in the Windows machine before running the policy. + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to values different than 'Yes': +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Logging Customize\Log successful connections' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file diff --git a/ee/cis/win-10/test/instructions/CIS_9.3.2.txt b/ee/cis/win-10/test/instructions/CIS_9.3.2.txt new file mode 100644 index 0000000000..b187453571 --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_9.3.2.txt @@ -0,0 +1,15 @@ +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to 'Block (default)': +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Inbound connections' + +2) After running the policy check, it should return 1 indicating that setting was properly set + +Note: Manually check that the registry key (HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile) is present in the Windows machine before running the policy. + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to values different than 'Block (default)': + 'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Inbound connections' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file diff --git a/ee/cis/win-10/test/instructions/CIS_9.3.3.txt b/ee/cis/win-10/test/instructions/CIS_9.3.3.txt new file mode 100644 index 0000000000..549041ddb1 --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_9.3.3.txt @@ -0,0 +1,14 @@ +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to 'Allow (default)': + 'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Outbound connections' +2) After running the policy check, it should return 1 indicating that setting was properly set + +Note: Manually check that the registry key (HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile) is present in the Windows machine before running the policy. + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to values different than 'Allow (default)': + 'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Outbound connections' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file diff --git a/ee/cis/win-10/test/instructions/CIS_9.3.4.txt b/ee/cis/win-10/test/instructions/CIS_9.3.4.txt new file mode 100644 index 0000000000..1b6accfe4a --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_9.3.4.txt @@ -0,0 +1,15 @@ +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to 'No': +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Private Profile\Settings Customize\Display a notification' + +2) After running the policy check, it should return 1 indicating that setting was properly set + +Note: Manually check that the registry key (HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile) is present in the Windows machine before running the policy. + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to values different than 'No': +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Private Profile\Settings Customize\Display a notification' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file diff --git a/ee/cis/win-10/test/instructions/CIS_9.3.5.txt b/ee/cis/win-10/test/instructions/CIS_9.3.5.txt new file mode 100644 index 0000000000..543aebf4b2 --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_9.3.5.txt @@ -0,0 +1,15 @@ +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to 'No': +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Settings Customize\Apply local firewall rules' + +2) After running the policy check, it should return 1 indicating that setting was properly set + +Note: Manually check that the registry key (HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile) is present in the Windows machine before running the policy. + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to values different than 'No': +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Settings Customize\Apply local firewall rules' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file diff --git a/ee/cis/win-10/test/instructions/CIS_9.3.6.txt b/ee/cis/win-10/test/instructions/CIS_9.3.6.txt new file mode 100644 index 0000000000..6275ca3048 --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_9.3.6.txt @@ -0,0 +1,15 @@ +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to 'No': +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Settings Customize\Apply local connection security rules' + +2) After running the policy check, it should return 1 indicating that setting was properly set + +Note: Manually check that the registry key (HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile) is present in the Windows machine before running the policy. + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to values different than 'No': +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Settings Customize\Apply local connection security rules' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file diff --git a/ee/cis/win-10/test/instructions/CIS_9.3.7.txt b/ee/cis/win-10/test/instructions/CIS_9.3.7.txt new file mode 100644 index 0000000000..dbf3ff27d5 --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_9.3.7.txt @@ -0,0 +1,14 @@ +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to '%SystemRoot%\System32\logfiles\firewall\publicfw.log': +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Logging Customize\Name' +2) After running the policy check, it should return 1 indicating that setting was properly set + +Note: Manually check that the registry key (HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile) is present in the Windows machine before running the policy. + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to values different than '%SystemRoot%\System32\logfiles\firewall\publicfw.log': +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Logging Customize\Name' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file diff --git a/ee/cis/win-10/test/instructions/CIS_9.3.8.txt b/ee/cis/win-10/test/instructions/CIS_9.3.8.txt new file mode 100644 index 0000000000..9c009090f2 --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_9.3.8.txt @@ -0,0 +1,15 @@ + +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to 16384 or greater: +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Logging Customize\Size limit (KB)' +2) After running the policy check, it should return 1 indicating that setting was properly set + +Note: Manually check that the registry key (HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile) is present in the Windows machine before running the policy. + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to values less than 16,384 KB: +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Logging Customize\Size limit (KB)' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file diff --git a/ee/cis/win-10/test/instructions/CIS_9.3.9.txt b/ee/cis/win-10/test/instructions/CIS_9.3.9.txt new file mode 100644 index 0000000000..caa5f44550 --- /dev/null +++ b/ee/cis/win-10/test/instructions/CIS_9.3.9.txt @@ -0,0 +1,15 @@ + +Expected scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to 'Yes': +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Logging Customize\Log dropped packets' +2) After running the policy check, it should return 1 indicating that setting was properly set + +Note: Manually check that the registry key (HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile) is present in the Windows machine before running the policy. + +Failure scenario +================== +1) Open "Edit Group Policy" tool and set the following UI path to values different than 'Yes': +'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Windows Defender Firewall Properties\Public Profile\Logging Customize\Log dropped packets' + +2) After running the policy check, it should return nothing, indicating that setting was set to a non-compliant value \ No newline at end of file