main
10
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Sharon Katz
|
4c29a7aebc |
CIS Benchmarks: Update Windows 11 to v5.0.1 (#45173)
Closes #39096 ## Summary Updates the CIS Windows 11 Enterprise benchmark policies from v4.0.0 to v5.0.1. ### Phase 1 -- Title updates: 42 existing policy titles updated to match v5.0.1 ### Phase 2 -- New L1 policies: 17 added New policies added: - 18.5.2 MSS: DisableIPSourceRouting IPv6 - 18.5.3 MSS: DisableIPSourceRouting - 18.6.7.3 Audit insecure guest logon (Lanman Server) - 18.6.7.5 Enable remote mailslots (Lanman Server) - 18.6.7.6 Mandate the minimum version of SMB (Lanman Server) - 18.6.8.1 Audit insecure guest logon (Lanman Workstation) - 18.6.8.5 Enable remote mailslots (Lanman Workstation) - 18.6.8.6 Mandate the minimum version of SMB (Lanman Workstation) - 18.6.21.1 Minimize simultaneous connections - 18.6.21.2 Prohibit non-domain connections - 18.6.23.2.1 Auto-connect to hotspots - 18.7.5 Configure RPC listener settings (auth) - 18.7.7 Configure RPC over TCP port - 18.9.17.1 Enable/disable CLFS logfile authentication - 18.10.73.1 Allow Recall to be enabled - 18.11.1 Disable HTTP proxy features: Disable WPAD - 18.11.2 Disable HTTP proxy features: Disable proxy authentication ### Additional fixes - Fixed 16 policies where resolution text was inconsistent with policy name/query - Fixed YAML colon escaping for policy names containing colons (e.g. "Domain member:", "Microsoft network client:") - Added GP removal behavior note to README - Validated with fleetctl apply (572 policies, no errors) ### Policy count: 572 (was 555) --- ## Testing ### Methodology New policies tested on **Windows 11 Enterprise 24H2** VM (DESKTOP-UUIQ1EM, build 10.0.26100.4349) via SSH + registry-direct testing. Three test cases per policy: - PASS value -> query returns result - FAIL value -> query returns empty - NOT SET (deleted) -> query returns empty ### Results: All new policies pass | # | CIS | Policy | Registry Key | FAIL | PASS | |---|-----|--------|--------------|------|------| | 1 | 18.9.17.1 | CLFS logfile authentication | ClfsAuthenticationChecking=1 | PASS | PASS | | 2 | 18.10.73.1 | Allow Recall to be enabled | AllowRecallEnablement=0 | PASS | PASS | | 3 | 18.11.1 | Disable WPAD | DisableWpad=1 | PASS | PASS | | 4 | 18.11.2 | Disable proxy authentication | DisableProxyAuthenticationSchemes=256or287 | PASS | PASS | ### Import validation fleetctl apply confirms all 572 policies parse and import successfully. Test environment: Windows 11 Enterprise 24H2 (10.0.26100.4349), osqueryd 5.23.0 via fleetd. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Standardized many Windows 11 CIS policy names and UI text: explicit principals (e.g., "No One"), expanded denial/user-right lists, and normalized punctuation and prefixes (e.g., "Domain member:"). Renamed an audit entry and aligned expected outcomes. * **New Features** * Added 30+ Windows CIS policies covering IP source routing protections, SMB/Lanman guest and dialect controls, Network/WLAN hardening, RPC/print mitigations, logfile/auth protections, Recall disablement, and proxy/WPAD restrictions. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45173) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Noah Talerman
|
3c0ba13798 |
CIS Benchmarks: remove version note from policies YAML (#31088)
- @noahtalerman: It was out of date for Windows 11. We show the version in the READMEs. For example, here's the [Windows README](https://github.com/fleetdm/fleet/tree/main/ee/cis/win-11). |
||
|
|
cbeb311b97 |
4.68.0 doc changes (#29393)
Documentation updates for v4.68.0 --------- Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> Co-authored-by: Scott Gress <scottmgress@gmail.com> Co-authored-by: Ian Littman <iansltx@gmail.com> Co-authored-by: Jahziel Villasana-Espinoza <jahziel@fleetdm.com> Co-authored-by: Eugene <eugene@fleetdm.com> Co-authored-by: dantecatalfamo <dante.catalfamo@gmail.com> Co-authored-by: Konstantin Sykulev <konst@sykulev.com> Co-authored-by: Luke Heath <luke@fleetdm.com> |
||
|
Dante Catalfamo
|
0b6ee9392f |
Windows 11 Enterprise CIS 4.0 (#29191)
#27396 ## Results First Column: - `+` = Added - D = Duplicate - X = Updated/Removed - ? = Unclear/un-actionable Tested Column: - Yes = Works as described - NF = Could not find GP setting, but registry key exists and editing it makes the policy pass - NA = Not available. Could not find GP setting, registry setting doesn't exist | | Tested | Type | Comment | |--- |------- |------ |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | + | NF | ADD | 5 (L2) Ensure 'WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc)' is set to 'Disabled' | | + | Yes | ADD | 18.10.58 (L1) Ensure 'Turn on Basic feed authentication over HTTP' is set to 'Disabled' | | + | Yes | ADD | 2.3.11 (L1) Ensure 'Network security: LDAP client encryption requirements' is set to 'Negotiate sealing' or higher | | + | Yes | ADD | 18.6.4 (L1) Ensure 'Configure multicast DNS (mDNS) protocol' is set to 'Disabled' | | + | Yes | ADD | 18.6.4 (L2) Ensure 'Turn off default IPv6 DNS Servers' is set to 'Enabled' | | + | Yes | ADD | 18.6.7 (L1) Ensure 'Audit client does not support encryption' is set to 'Enabled' | | + | Yes | ADD | 18.6.7 (L1) Ensure 'Audit client does not support signing' is set to 'Enabled' | | + | Yes | ADD | 18.6.7 (L1) Ensure 'Audit insecure guest logon' is set to 'Enabled' | | + | Yes | ADD | 18.6.7 (L1) Ensure 'Enable authentication rate limiter' is set to 'Enabled' | | + | Yes | ADD | 18.6.7 (L1) Ensure 'Enable remote mailslots' is set to 'Disabled' | | + | Yes | ADD | 18.6.7 (L1) Ensure 'Mandate the minimum version of SMB' is set to 'Enabled: 3.1.1' | | + | Yes | ADD | 18.6.7 (L1) Ensure 'Set authentication rate limiter delay (milliseconds)' is set to 'Enabled: 2000' or more | | + | Yes | ADD | 18.6.8 (L1) Ensure 'Audit insecure guest logon' is set to 'Enabled' | | + | Yes | ADD | 18.6.8 (L1) Ensure 'Audit server does not support encryption' is set to 'Enabled' | | + | Yes | ADD | 18.6.8 (L1) Ensure 'Audit server does not support signing' is set to 'Enabled' | | D | -- | ADD | 18.6.8 (L1) Ensure 'Enable remote mailslots' is set to 'Disabled' | | D | -- | ADD | 18.6.8 (L1) Ensure 'Mandate the minimum version of SMB' is set to 'Enabled: 3.1.1' | | + | Yes | ADD | 18.7 (L2) Ensure 'Configure Windows protected print' is set to 'Enabled' | | + | Yes | ADD | 18.9 (L1) Ensure 'Configure the behavior of the sudo command' is set to 'Enabled: Disabled' | | + | Yes | ADD | 18.9.30.1 (L1) Ensure 'Block NetBIOS-based discovery for domain controller location' is set to 'Enabled' | | + | Yes | ADD | 18.9.39 (L1) Ensure 'Configure SAM change password RPC methods policy' is set to 'Enabled: Block all change password RPC methods' | | + | Yes | ADD | 18.10.3 (L2) Ensure 'Turn off API Sampling' is set to 'Enabled' | | + | Yes | ADD | 18.10.3 (L2) Ensure 'Turn off Application Footprint' is set to 'Enabled' | | + | Yes | ADD | 18.10.3 (L2) Ensure 'Turn off Install Tracing' is set to 'Enabled' | | + | Yes | ADD | 18.10.4 (L1) Ensure 'Not allow per-user unsigned packages to install by default (requires explicitly allow per install)' is set to 'Enabled' | | + | Yes | ADD | 18.10.18 (L1) Ensure 'Enable App Installer Local Archive Malware Scan Override' is set to 'Disabled' | | + | Yes | ADD | 18.10.18 (L1) Ensure 'Enable App Installer Microsoft Store Source Certificate Validation Bypass' is set to 'Disabled' | | + | Yes | ADD | 18.10.18 (L2) Ensure 'Enable Windows Package Manager command line interfaces' is set to 'Disabled' | | + | Yes | ADD | 18.10.29 (L1) Ensure 'Do not apply the Mark of the Web tag to files copied from insecure sources' is set to 'Disabled' | | + | Yes | ADD | 18.10.43 (L1) Ensure 'Control whether exclusions are visible to local users' is set to 'Enabled' | | + | Yes | ADD | 18.10.43.4 (L1) Ensure 'Enable EDR in block mode' is set to 'Enabled' | | + | Yes | ADD | 18.10.43.8 (L2) Ensure 'Convert warn verdict to block' is set to 'Enabled' | | + | Yes | ADD | 18.10.43.10 (L1) Ensure 'Configure real-time protection and Security Intelligence Updates during OOBE' is set to 'Enabled' | | + | Yes | ADD | 18.10.43.11.1.1 (L2) Ensure 'Configure Brute-Force Protection aggressiveness' is set to 'Enabled: Medium' or higher | | + | Yes | ADD | 18.10.43.11.1.1 (L1) Ensure 'Configure Remote Encryption Protection Mode' is set to 'Enabled: Audit' or higher | | + | Yes | ADD | 18.10.43.11.1.2 (L2) Ensure 'Configure how aggressively Remote Encryption Protection blocks threats' is set to 'Enabled: Medium' or higher | | + | Yes | ADD | 18.10.43.13 (L1) Ensure 'Scan excluded files and directories during quick scans' is set to 'Enabled: 1' | | + | Yes | ADD | 18.10.43.13 (L1) Ensure 'Trigger a quick scan after X days without any scans' is set to 'Enabled: 7' | | + | Yes | ADD | 18.10.57.3.3 (L2) Ensure 'Restrict clipboard transfer from server to client' is set to 'Enabled: Disable clipboard transfers from server to client' | | + | NA | ADD | 19.7.40 (L1) Ensure 'Turn off Windows Copilot' is set to 'Enabled' | | + | NF | ADD | 5 (L2) Ensure 'GameInput Service (GameInputSvc)' is set to 'Disabled' | | + | Yes | ADD | 18.6.8 (L1) Ensure 'Require Encryption' is set to 'Enabled' | | + | Yes | ADD | 18.10.91 (L2) Ensure 'Allow mapping folders into Windows Sandbox' is set to 'Disabled' | | X | Yes | MOVE | 18.4.1 (L1) Ensure 'Configure RPC packet level privacy setting for incoming connections' is set to 'Enabled' TO 18.7 | | X | Yes | REMOVE | 18.10.42 Ensure 'Turn off Microsoft Defender AntiVirus' is set to 'Disabled' | | X | Yes | REMOVE | 18.10.15 (L1) Ensure 'Toggle user control over Insider builds' is set to 'Disabled' | | X | Yes | REMOVE | 18.10.66 (L1) Ensure 'Only display the private store within the Microsoft Store' is set to 'Enabled' | | X | Yes | REMOVE | 2.3.1 (L1) Ensure 'Accounts: Block Microsoft accounts' is set to 'Users can't add or log on with Microsoft accounts' | | X | Yes | REMOVE | 18.9.7.1 (BL) Ensure 'Prevent installation of devices that match any of these device IDs: Prevent installation of devices that match any of these device IDs' is set to 'PCI\CC<sub>0C0A</sub>' | | X | Yes | REMOVE | 18.9.7 (BL) Ensure 'Prevent installation of devices that match any of these device IDs: Also apply to matching devices that are already installed.' is set to 'True' (checked) | | X | Yes | REMOVE | 18.9.7 (BL) Ensure 'Prevent installation of devices that match any of these device IDs' is set to 'Enabled' | | X | Yes | REMOVE | 5 (L2) Ensure 'Peer Name Resolution Protocol (PNRPsvc)' is set to 'Disabled' | | X | Yes | REMOVE | 5 (L2) Ensure 'Peer Networking Grouping (p2psvc)' is set to 'Disabled' | | X | Yes | REMOVE | 5 (L2) Ensure 'Peer Networking Identity Manager (p2pimsvc)' is set to 'Disabled' | | X | Yes | REMOVE | 5 (L2) Ensure 'PNRP Machine Name Publication Service (PNRPAutoReg)' is set to 'Disabled' | | X | Yes | REMOVE | 18.6.4 (L1) Ensure ‘Configure DNS over HTTPS (DoH) name resolution' is set to 'Enabled: Allow DoH' or higher | | X | Yes | RENAME | 2.2 (L1) Configure 'Create symbolic links' TO (L1) Ensure 'Create symbolic links' is set to 'Administrators'23528 | | X | Yes | RENAME | 2.2 (L2) Configure 'Log on as a service' TO (L2) Ensure 'Log on as a service' is configured | | + | Yes | RENAME | 18.10.82.1 (L1) Ensure 'Enable MPR notifications for the system' TO 'Configure the transmission of the user's password in the content of MPR notifications sent by winlogon.' | | X | Yes | UPDATE | 18.10.17 (L1 -> L2) Ensure 'Enable App Installer' is set to 'Disabled' | | X | Yes | UPDATE | 18.4 (L1) Ensure 'Enable Certificate Padding' TO Allow REG<sub>DWORD</sub> or REG<sub>SZ</sub> | | X | NA | UPDATE | 18.9.26 Ensure 'Configures LSASS to run as a protected process' is set to 'Enabled: Enabled with UEFI Lock' | | ? | Unknown | UPDATE | Section 17 Auditpol commands to use Policy GUIDs | | ? | Unknown | UPDATE | 18.4 (L1) Ensure 'Enable Certificate Padding' is set to 'Enabled' | | ? | Unknown | UPDATE | Section changes from Windows 11 Release 23H2 v2.0 Administrative Templates | | ? | Unknown | UPDATE | Section changes from Windows 11 Release 24H2 Administrative Templates | | ? | Unknown | UPDATE | User Overview (Section 19) | | ? | Unknown | UPDATE | Profile Names | | ? | Unknown | UPDATE | General Overview and Intended Audience Section | | ? | Unknown | UPDATE | BitLocker Operating System Drive Section | | ? | Unknown | UPDATE | 18.10.93.4 (L1) Ensure 'Enable optional updates' is set to 'Disabled' | |
||
|
Rachael Shaw
|
0c95e92b5a |
Revert changes to batch-run script docs
Merged into wrong branch; for 4.68 |
||
|
|
13b9b885c1 |
Bulk script doc spruce up (#28471)
Move around some parameters and mark `script_id` required --------- Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> Co-authored-by: Scott Gress <scottmgress@gmail.com> Co-authored-by: Ian Littman <iansltx@gmail.com> Co-authored-by: Jahziel Villasana-Espinoza <jahziel@fleetdm.com> |
||
|
Marko Lisica
|
089d9e5fd0 |
Docs changes: Update Windows 11 CIS benchmark (#19722)
- #17659 |
||
|
|
6d633427d8 |
Feature/win11 cis v3 (#18862)
Changelog ADD: ADD - 18.10.75.1 (L1) Ensure 'Automatic Data Collection' is set to 'Enabled' ADD - 18.10.92.2 (L1) Ensure 'Enable features introduced via servicing that are off by default' is set to 'Disabled' ADD - 18.10.92.4 (L1) Ensure 'Enable optional updates' is set to 'Disabled' ADD - 18.8 (L2) Ensure 'Remove Personalized Website Recommendations from the Recommended section in the Start Menu' is set to 'Enabled' ADD - 18.9.19 (L1) 'Configure security policy processing: Do not apply during periodic background processing' is set to 'False' ADD - 18.9.19 (L1) 'Configure security policy processing: Process even if the Group Policy objects have not changed' is set to 'True' ADD - 18.9.25 (L1) Ensure 'Configure password backup directory' is set to 'Enabled: Active Directory' or 'Enabled: Azure Active Directory' ADD - 18.9.25 (L1) Ensure 'Enable password encryption' is set to 'Enabled' ADD - 18.9.25 (L1) Ensure 'Post-authentication actions: Actions' is set to 'Enabled: Reset the password and logoff the managed account' or higher ADD - 18.9.25 (L1) Ensure 'Post-authentication actions: Grace period (hours)' is set to 'Enabled: 8 or fewer hours, but not 0' ADD - 19.7.38 (L1) Ensure 'Turn off Windows Copilot' is set to 'Enabled' ADD - 2.3.11 (L1) Ensure 'Network security: Restrict NTLM: Audit Incoming NTLM Traffic' is set to 'Enable auditing for all accounts' ADD - 2.3.11 (L1) Ensure 'Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers' is set to 'Audit all' or higher REMOVE: REMOVE - 18.10.76.3 (L1) Ensure 'Prevent bypassing Windows Defender SmartScreen prompts for sites' is set to 'Enabled' REMOVE - 5 (L1) Ensure 'Internet Connection Sharing (ICS) (SharedAccess)' is set to 'Disabled' REMOVE - 9.1 (L1) Ensure 'Windows Firewall: Domain: Outbound connections' is set to 'Allow (default)' REMOVE - 9.2 (L1) Ensure 'Windows Firewall: Private: Outbound connections' is set to 'Allow (default)' REMOVE - 9.3 (L1) Ensure 'Windows Firewall: Public: Outbound connections' is set to 'Allow (default)' UPDATE: UPDATE - 18.10.42.7 (L2 -> L1) Ensure 'Enable file hash computation feature' is set to 'Enabled' UPDATE - 18.10.86 (L1 -> L2) Ensure 'Turn on PowerShell Script Block Logging' is set to 'Enabled' UPDATE - 18.10.86 (L1 -> L2) Ensure 'Turn on PowerShell Transcription' is set to 'Enabled' UPDATE - 18.5 'MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)' TO 'MSS: (AutoAdminLogon) Enable Automatic Logon' UPDATE - 18.5 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)' TO 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level' UPDATE - 18.5 'MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)' TO 'MSS: (DisableIPSourceRouting) IP source routing protection level' UPDATE - 18.5 'MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)' TO 'MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses' UPDATE - 18.5 'MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)' TO 'MSS: (SafeDllSearchMode) Enable Safe DLL search mode' UPDATE - 18.5 'MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)' TO 'MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires' UPDATE - 18.5 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes (recommended)' TO 'Enabled: 300,000 or 5 minutes' UPDATE - 18.9.50.1 (L2 -> L1) Ensure 'Enable Windows NTP Client' is set to 'Enabled' UPDATE - 18.9.50.1 (L2 -> L1) Ensure 'Enable Windows NTP Server' is set to 'Disabled' --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com> Co-authored-by: Sharon Katz <sharon@fleetdm.com> |
||
|
Rachael ShawandNoah Talerman
|
44c3ba83e5 |
Reduce CIS benchmark documentation page contents (#17108)
+ Move specific CIS benchmark details into READMEs + Reduce content in Using Fleet > CIS Benchmarks --------- Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> |
||
|
Josh Brower
|
717eb76715 |
Initial support for CIS Win11 Enterprise (#15425)
Closes https://github.com/fleetdm/fleet/issues/14907 Changelog details are here: https://docs.google.com/spreadsheets/d/1HZn7e4zpd5nfxY0MhSdX8MkGpdpxyLdSZjk0Auo1WaQ/edit#gid=312045512 |
