microsoft / powerstig

STIG Automation

PowerSTIG

PowerStig is a PowerShell module that contains several components to automate different DISA Security Technical Implementation Guides (STIGs) where possible.

Name	Description	Published to PS Gallery
PowerStig.Convert	Extract configuration objects from the xccdf	No
PowerStig.Data	A PowerShell class to access the PowerSTIG "database"	Yes
PowerStig.DSC	Compsite DSC resources to apply and/or audit STIG settings	Yes
PowerStig.Document	An experimental module to create prefilled out checklists	Yes

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Branch	Status	Description
master		Contains the latest release - no contributions are made directly to this branch.
dev		Where contributions should be proposed by contributors as pull requests. This branch is merged into the master branch, and be released to PowerShell Gallery.

Released Module

To see the released PowerStig module, go to the PowerShell Gallery. We recommend that you use PowerShellGet to install PowerStig:

For example:

Install-Module -Name PowerStig -Scope CurrentUser

Once PowerStig is installed, you can view the list of STIGs that are currently available. The Get-Stig function queries the StigData and returns a full list. This will give you an idea of what you can target in your environment.

Import-Module PowerStig
Get-Stig -ListAvailable

To update a previously installed module use this command:

Update-Module -Name PowerStig

PowerStig.Convert

A utility module that we use to generate PowerStig XML to store in PowerStig.Data. The module uses PowerShell classes to extract settings from check-content elements of the xccdf. This nested module is NOT published to the PS Gallery. The extracted settings are converted into a new PowerStig XML schema. The XML file is saved into a processed StigData folder and released to the PS Gallery on a regular cadence.

For detailed information, please see the Convert Wiki

PowerStig.Data

A module with PowerShell classes and a directory of PowerStig XML to provide a way of retrieving StigData and documenting deviations. The PowerStig.Data classes provide methods to:

1. Override a setting defined in a STIG and automatically document the exception to policy
2. Apply settings that have a valid range of values (Organizational Settings)
3. Exclude a rule if it is already defined in another STIG (de-duplication) and automatically document the exception to policy
4. Exclude an entire class of rules (intended for testing and integration) and automatically document the exception to policy

For detailed information, please see the StigData Wiki. For STIG xml file hashes please refer to File Hashes.

PowerStig.DSC

PowerStig.DSC is not really a specific module, but rather a collection of PowerShell Desired State Configuration (DSC) composite resources to manage the configurable items in each STIG. Each composite uses PowerStig.Data classes to retrieve PowerStig XML. This allows the PowerStig.Data classes to manage exceptions, Org settings, and skipped rules uniformly across all composite resources. The standard DSC ResourceID's can then be used by additional automation to automatically generate compliance reports or trigger other automation solutions.

Composite Resources

The list of STIGs that we are currently covering.

Name	Description
Adobe	Provides a mechanism to manage Adobe STIG settings.
Chrome	Provides a mechanism to manage Google Chrome STIG settings.
DotNetFramework	Provides a mechanism to manage .Net Framework STIG settings.
Edge	Provides a mechanism to manage Microsoft Edge STIG settings.
Firefox	Provides a mechanism to manage Firefox STIG settings.
IisServer	Provides a mechanism to manage IIS Server settings.
IisSite	Provides a mechanism to manage IIS Site settings.
InternetExplorer	Provides a mechanism to manage Microsoft Internet Explorer settings.
McAfee	Provides a mechanism to manage McAfee settings.
Office	Provides a mechanism to manage Microsoft Office STIG settings.
OracleJRE	Provides a mechanism to manage Oracle Java Runtime Environment STIG settings.
RHEL	Provides a mechanism to manage RedHat Enterprise Linux STIG settings.
SqlServer	Provides a mechanism to manage SqlServer STIG settings.
Ubuntu	Provides a mechanism to manage Ubuntu Linux STIG settings.
Vsphere	Provides a mechanism to manage VMware Vsphere STIG settings.
WindowsClient	Provides a mechanism to manage Windows Client STIG settings.
WindowsDefender	Provides a mechanism to manage Windows Defender STIG settings.
WindowsDnsServer	Provides a mechanism to manage Windows DNS Server STIG settings.
WindowsFirewall	Provides a mechanism to manage the Windows Firewall STIG settings.
WindowsServer	Provides a mechanism to manage the Windows Server STIG settings.

For detailed information, please see the Composite Resources Wiki

PowerStig.Document

An Experimental module to create checklists and other types of documentation based on the results of the DSC compliance report. This module generates a checklist, but we are not 100% sure on the workflow, so we wanted to publish the idea and build on it.

For detailed information, please see the Document Wiki

Contributing

We welcome all contributions to the development of PowerStig. There are several different ways you can help. You can create new convert modules, add test automation, improve documentation, fix existing issues, or open new ones. See our contributing guide for more info on how to become a contributor. If you would like to contribute to a Composite Resource, please check out common DSC Resources contributing guidelines.

Thank you to everyone that has reviewed the project and provided feedback through issues. We are especially thankful for those who have contributed pull requests to the code and documentation.

Contributors

• @addavenp1 (Adam Davenport)
• @ALichtenberg (Adam Lichtenberg)
• @athaynes (Adam Haynes)
• @bcwilhite (Brian Wilhite)
• @bgouldman (Brian Gouldman)
• @camusicjunkie (John Steele)
• @chasewilson (Chase Wilson)
• @clcaldwell (Coby Caldwell)
• @davbowman (David Bowman)
• @erjenkin (Eric Jenkins)
• @JakeDean3631 (Jake Dean)
• @japatton (Jason Patton)
• @jcwalker (Jason Walker)
• @jesal858 (Jeff Salas)
• @ldillonel (LaNika Dillon)
• @LLansey (La'Neice Lansey)
• @mcollera (Matthew Collera)
• @nehrua (Nehru Ali)
• @regedit32 (Reggie Gibson)
• @stevehose (Steve Hose)
• @winthrop28 (Drew Taylor)
• @mikedzikowski (Mike Dzikowski)
• @pgc1a (Tony Griffith)
• @hinderjd (James Hinders)
• @ruandersMSFT (Russell Anderson)
• @MrAutomater (Jerry Martin)

powerstig's Issues

Move templates to Modules

The templates in the templates folder should be moved to their respective module folder with a standard name.

Template.*.txt

I will move the current group template and update the module footers to accommodate the updated module contents.

Issues with

Describe the bug
Update to accommodate Sql Server Stigs

To Reproduce
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.

Edge case where registry range only outputs 1 number cause it starts with hex value

Describe the bug
Edge cases in Win10 rule V-63661 and Server2016 rule V-73641 where registry value is a range and starts with a hex value. When the rule was tested for a range it would only output 1 number because it started with a hex value. This causes the organization value to not parse correctly. It was either incomplete or missing.

To Reproduce
Steps to reproduce the behavior:

1. ConvertTo-PowerStigXml -Path '.\PowerStig\StigData\Archive\Windows.Client\U_Windows_10_STIG_V1R10_Manual-xccdf.xml'

Expected behavior
The organization values should parse correctly

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.

Server 2016 PermissionRule errors when running ConvertTo-DscStigXml

All the permission rules with a target path of %SystemRoot%\System32\winevt\Logs error because the Server 2016 stig now wraps the event log in quotes instead of parentheses. This causes $permissionTargetPath to be $null in Get-PermissionTargetPath. Maybe create a separate function that can be used inside Get-PermissionTargetPath to identify the operating system for the stig being run. That function could also be used in Convert.PermissionRule.tests.ps1 to filter stig versions in $permissionRulesToTest.

Server 2016 Rule V-73317 errors when running ConvertTo-DscStigXml

This is an AccountPolicyRule. After Get-SecurityPolicyString is run the value of $result returns multiple matches. This causes Get-TestStringTokenList to error out. Add a separate check in Get-SecurityPolicyString so the value of $result only returns one string.

The PowerStig Technology class no longer exists

From @athaynes on August 7, 2018 8:10

Describe the bug

The following code should be removed now that PowerStig has released with the Technology enumeration.

    # BEGIN: This is a temporary fix until PowerStig has migrated the technolgy class to an enumeration
    if ((New-Object Technology).GetType().BaseType.Name -eq 'Enum')
    {
        # BEGIN: leave this after the temp fix is removed
        $technology = [Technology]::Windows
        # END: leave this after the temp fix is removed
    }
    else
    {
        $technology = [Technology]::New( "Windows" )
    }
    # END: This is a temporary fix until PowerStig has migrated the technolgy class to an enumeration

To Reproduce
none

Expected behavior
The technology enumeration should only be used in all composite resources.

$technology = [Technology]::WindowsServer

Screenshots
none

Additional context
none

Copied from original issue: microsoft/PowerStigDsc#20

V-80477 Parses incorrectly in 2012R2-MS-2.13 and 2012R2-DC-2.13

Describe the bug
V-80477 is a WindowsFeatureRule that fails conversion because the FeatureName is null

To Reproduce
Steps to reproduce the behavior:

1. ConvertTo-PowerStigXml -Path
2. FeatureName will be null

Expected behavior

FeatureName = PowerShell-V2

Screenshots

Additional context

ConvertTo-DscStigXml only accepts absolute path for Destination

If a relative path is specified for Destination then the script errors when trying to save the xml file and will try to save it to c:\windows\system32\.

ConvertTo-PowerStigXml does not add new line to eof

Describe the bug
The ConvertTo-PowerStigXml creates a valid XML document, but the output document should end with a new line to comply with the project standards that are enforced with format tests.

To Reproduce
Steps to reproduce the behavior:

1. convert a STIG file
2. look at the processed file
3. the last line of the file is not blank

Expected behavior
The output file should pass the project formatting tests, by ending in a blank line.

SqlServer README and Examples update

From @chasewilson on July 31, 2018 21:47

Is your feature request related to a problem? Please describe.
Sql Server Composite Stig README is not in compliance with the project format and there are no SQL Server Examples

Describe the solution you'd like
Remove SqlServer README and update Project README. Add SqlServer examples to Project

Describe alternatives you've considered

Additional context

Copied from original issue: microsoft/PowerStigDsc#15

2012R2 V-1151 registry path is incorrect

Describe the bug

V-1151 in the 2012R2 processed Stigs have an incorrect registry path.

To Reproduce

Expected behavior

LanManPrintServices should be LanMan Print Services

Screenshots

    <Rule id="V-1151" severity="low" conversionstatus="pass" title="Secure Print Driver Installation" dscresource="Registry">
      <Ensure>Present</Ensure>
      <IsNullOrEmpty>False</IsNullOrEmpty>
      <Key>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Providers\LanManPrintServices\Servers</Key>
      <OrganizationValueRequired>False</OrganizationValueRequired>
      <OrganizationValueTestString />
      <RawString>If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE 
Registry Path: \System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\

Value Name: AddPrinterDrivers

Value Type: REG_DWORD
Value: 1</RawString>
      <ValueData>1</ValueData>
      <ValueName>AddPrinterDrivers</ValueName>
      <ValueType>Dword</ValueType>
    </Rule>

Additional context

IIS 8.5 Server STIG Rules Parsing Incorrectly

Describe the bug
The following rules are not parsing correctly:
V-76703
V-76723

To Reproduce
Attempt to apply the IISServer STIG sample config

Expected behavior
V-76703 should parse as a manual rule
V-76723.a should supply a value of 'UseCookies' instead of '1'

dscResourceModule is NULL in STIG data

Describe the bug
ConvertTo-PowerStigXml against any STIG. The STIG data xml will have a null value for all dscResourceModule properties

To Reproduce
Steps to reproduce the behavior:

1. download a xccdf that is supported by PowerSTIG
2. Run ConvertTo-PowerStigXml
3. Review output xml for dscResourceModule property

Expected behavior
dscResourceModule would be populated with correct module name

Screenshots
Bad:

Good:

V-46477 in IE STIG is not in the correct format

Describe the bug

In the processed IE browser STIG, V-46477 is proved in hex format. This would not be a problem, but the Browser Composite resource does not toggle the hex flag in the registry resource, so an error is thrown.

To Reproduce

Compile a mof with the browser STIG and see error.

Expected behavior

The registry value should either be provided as an int32 or the hex flag should be toggled when a hex value is presented to the registry resource.

Screenshots

This event indicates that a non-terminating error was thrown when DSCEngine was executing Test-TargetResource on MSFT_RegistryResource DSC resource. FullyQualifiedErrorId is FormatException. Error Message is Exception calling "Parse" with "1" argument(s): "Input string was not in a correct format.".

I pulled up the mof and the resource ID that errored out was this: 

ModuleVersion = "1.1";

ConfigurationName = "Configuration";

};
instance of MSFT_RegistryResource as $MSFT_RegistryResource3ref
{
ResourceID = "[Registry][V-46477][low][DTBI018-IE11-Publishers Certificate Revocation]::[Browser]IEBaseLine";
ValueName = "State";
Key = "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing";
Ensure = "Present";
SourceInfo = "C:\\Program Files\\WindowsPowerShell\\Modules\\PowerSTIG\\2.0.0.0\\DSCResources\\Resources\\windows.Registry.ps1::10::5::Registry";
ValueType = "Dword";
ModuleName = "PSDesiredStateConfiguration";
ValueData = {
    "23C00"
};

Additional context

HKCU registry settings fail in Composite resources

Describe the bug

HKCU registry paths are only valid when PsDscRunAsCredential is present to run as an actual user. If a run as credential is not provided, the DSC test methods fail.

To Reproduce

If PsDscRunAsCredential is not provided, the HKCU settings should be filtered out of the results.

Screenshots

Additional context

2012R2 V-36681 registry path is incorrect

Describe the bug

V-36681 in the 2012R2 processed Stigs have an incorrect registry path.

To Reproduce

Expected behavior

ControlPanel should be 'Control Panel'
Screenshots

    <Rule id="V-36681" severity="medium" conversionstatus="pass" title="WINCC-000048" dscresource="Registry">
      <Ensure>Present</Ensure>
      <IsNullOrEmpty>False</IsNullOrEmpty>
      <Key>HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\ControlPanel\International</Key>
      <OrganizationValueRequired>False</OrganizationValueRequired>
      <OrganizationValueTestString />
      <RawString>If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \Software\Policies\Microsoft\Control Panel\International\

Value Name: BlockUserInputMethodsForSignIn

Type: REG_DWORD
Value: 1</RawString>
      <ValueData>1</ValueData>
      <ValueName>BlockUserInputMethodsForSignIn</ValueName>
      <ValueType>Dword</ValueType>
    </Rule>

Additional context

Some Server 2016 registry rules fail to update org settings in stig xml and org xml.

These rules don't output an error but they don't update the comment in the org.xml file. These rules are also not completely updated in the stig xml file. The OrganizationValueRequired value is set to true but OrganizationValueTestString and ValueData are blank.

Below is the Check Content from rule V-73561. This is the format for all the registry rules that don't update properly.

Check Content:  
The default behavior is for Data Execution Prevention to be turned on for File Explorer.

If the registry value name below does not exist, this is not a finding.

If it exists and is configured with a value of "0", this is not a finding.

If it exists and is configured with a value of "1", this is a finding.

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\

Value Name: NoDataExecutionPrevention

Value Type: REG_DWORD
Value: 0x00000000 (0) (or if the Value Name does not exist)

The offending rules in the 2016 MS stig are:
V-73561
V-73563
V-73565
V-73579
V-73587
V-73727

New Stigs need to be added to the Archive

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

No

Describe the solution you'd like
A clear and concise description of what you want to happen.

Need to add the updated STIGs to the archive

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.
None
Additional context
Add any other context or screenshots about the feature request here.

An error is thrown if no rules are supplied to a resource.

Describe the bug

When a resource configuration is dot sourced with no rules, an error is thrown

To Reproduce

Should not throw if there are no rules to automate

Screenshots

Additional context

Migrating PowerStigDsc into PowerStig

From @athaynes on August 8, 2018 20:43

I wanted to open an issue to communicate that we are planning to collapse PowerStigDsc into PowerStig. There are a few maintenance issues pushing this.

Right now we don’t have the using statements calling a fully qualified module (no version number).
We did that so that we could update PowerStig and not have to update PowerStigDsc., but this causes 2 issues.

1. You can only have one version of PowerStig on your system.
2. We have a validate set version on the STIG numbers that need to be updated with PowerStig, so they are tied together anyway.

We have a third project that helps mange the dependencies, but we can collapse most of that back into PowerStig as well. These were all originally broken into different modules to keep the module size down and the scope narrow, but after writing some documentation and talking with different people that are evaluating the project, having multiple modules adds to user complexity, so we want to eliminate as much complexity for everyone by consolidating the projects into a single module to do all things PowerStig related.

I will archive this repo and move all of the PowerStigDsc code and supporting code over to PowerStig this weekend.

Copied from original issue: microsoft/PowerStigDsc#24

PR #23 didn't address Server 2016 stig benchmark id missing technology role

#23 Since the server 2016 stig benchmark id doesn't contain MS or DC should the output file name be generated from the stig file name? Where in the stack would Split-StigXccdf have to be run to get a proper output file name?

SQL Instance Stig Permission rule types Query does not work

Describe the bug

The SetScript query value does not work and needs to be updated

To Reproduce

Expected behavior

When the get query finds a user with specified permissions, the SetScriptQuery should remove that users permissions.

Screenshots

Additional context

Server 2012R2 - V-15713 - Organizational default value fails SCAP scan.

Describe the bug
Within version 2.13 of the Server 2012R2 STIG; a dword Value of "3" is applied to HKLM:\Software\Polices\Microsoft\Windows Defender\Spynet which leads to failed SCAP scans. The setting needs to be set to "0" by default. This setting is applied by the default organizational default XML.

To Reproduce
Apply version 2.13 of the Server 2012R2 STIG and execute a scap scan on the Server it's being applied to.

Expected behavior
Receiving 100% compliance on SCAP scan.

V-73379 parses incorrectly

V-73379 parses as a registry rule but should parse as a manual or share rule.

This applies to domain controllers. It is NA for other systems.

Run "Regedit".

Navigate to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters".

Note the directory locations in the values for "DSA Database file".

Open "Command Prompt".

Enter "net share".

Note the logical drive(s) or file system partition for any organization-created data shares.

Ignore system shares (e.g., NETLOGON, SYSVOL, and administrative shares ending in $). User shares that are hidden (ending with $) should not be ignored.

If user shares are located on the same logical partition as the directory server data files, this is a finding.

Update to include converted data for Oracle JRE STIG

Need to automate Oracle JRE STIG

A data file for the Oracle JRE is included in the project

Describe alternatives you've considered

Additional context

Update Composite to apply the FireFox STIG

Is your feature request related to a problem? Please describe.

Update Composite so the FireFox can be applied
Describe the solution you'd like

Update Composite so the FireFox can be applied

Define project scope

There is no published scope of work for this project.

Will this be used for non-MSFT STIGs as well for products that support Powershell directly (VMWare)? What about other third party OS STIGS, which might be able to be managed with PS 6.0, like RedHat?
How about other third party OS STIGs, which are not supported by PS, such as Cisco?

PowerSTIG.Convert needs to be updated with a FileContentRule so STIGs that leverage a config file and be incorporated

Is your feature request related to a problem? Please describe.
PowerSTIG.Convert needs to be updated with a FileContentRule so STIGs that leverage a config file and be incorporated such as the FireFox STIG and the Oracle JRE STIG

Windows 10 STIG data file is created without a role in the file name

Describe the bug
A clear and concise description of what the bug is.
Windows 10 STIG data file is created without a role in the file name

To Reproduce
Steps to reproduce the behavior:

1. Run ConvertTo-PowerStigXml -Path "U_Windows_10_V1R13_Manual_STIG\U_Windows_10_STIG_V1R13_Manual-xccdf.xml"

2. Converted Output: D:\Source\PowerStig\StigData\Processed\Windows-10--1.13.xml

The file name is missing the role.

Expected behavior
Should return:
Converted Output: D:\Source\PowerStig\StigData\Processed\Windows-10-Client-1.13.xml

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.

Output file names from Split-StigXccdf aren't consistent with ConvertTo-PowerStigXml

After running Split-StigXccdf against any 2016 stig Manual-xccdf.xml is stripped from the filename. Because of this the filename after running ConvertTo-PowerStigXml ends in xml.xml and xml.org.xml if an org file was generated. Change output of Split-StigXccdf to keep filenames consistent.

Data.ps1 isn't being loaded in to Functions.PowerStigXml.ps1

When ConvertTo-PowerStigXml gets to line 67 it starts outputting errors because the variables from the Convert.Stig\Data.ps1 are never loaded. All the variables end up being $null.

Below is one of the many errors that get generated:

PSMessageDetails      :
Exception             : System.Management.Automation.MethodInvocationException: Exception calling "SetAttribute" with "2"
                        argument(s): "The attribute local name cannot be empty." ---> System.ArgumentException: The attribute local
                        name cannot be empty.
                           at System.Xml.XmlAttribute..ctor(XmlName name, XmlDocument doc)
                           at System.Xml.XmlDocument.CreateAttribute(String prefix, String localName, String namespaceURI)
                           at System.Xml.XmlDocument.CreateAttribute(String name)
                           at System.Xml.XmlElement.SetAttribute(String name, String value)
                           at SetAttribute(Object , Object[] )
                           at System.Management.Automation.DotNetAdapter.AuxiliaryMethodInvoke(Object target, Object[] arguments,
                        MethodInformation methodInformation, Object[] originalArguments)
                           --- End of inner exception stack trace ---
                           at System.Management.Automation.DotNetAdapter.AuxiliaryMethodInvoke(Object target, Object[] arguments,
                        MethodInformation methodInformation, Object[] originalArguments)
                           at System.Management.Automation.DotNetAdapter.MethodInvokeDotNet(String methodName, Object target,
                        MethodInformation[] methodInformation, PSMethodInvocationConstraints invocationConstraints, Object[]
                        arguments)
                           at System.Management.Automation.DotNetAdapter.MethodInvoke(PSMethod method, PSMethodInvocationConstraints
                        invocationConstraints, Object[] arguments)
                           at System.Management.Automation.Adapter.BaseMethodInvoke(PSMethod method, PSMethodInvocationConstraints
                        invocationConstraints, Object[] arguments)
                           at lambda_method(Closure , Object[] , StrongBox`1[] , InterpretedFrame )
TargetObject          :
CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
FullyQualifiedErrorId : DotNetMethodException
ErrorDetails          :
InvocationInfo        : System.Management.Automation.InvocationInfo
ScriptStackTrace      : at ConvertTo-PowerStigXml<Process>, C:\Program
                        Files\WindowsPowerShell\Modules\powerstig\Module\Convert.Main\Functions.PowerStigXml.ps1: line 125
                        at <ScriptBlock>, <No file>: line 1
PipelineIterationInfo : {}

ActiveDirectoryAuditRuleEntry is missing.

From @athaynes on June 19, 2018 17:52

In common/windows.AccessControl.ps1 there is a switch to select the AccessEntry type, but ActiveDirectoryAuditRuleEntry is missing from the switch.

These rules are not being added to the output mof.

The WindowsServer.integration.tests.ps1 has been updated to filter out ActiveDirectoryAuditRuleEntry rules. Once this issue is updated, the Permissions Context should be updated to remove the liter.

Copied from original issue: microsoft/PowerStigDsc#1

Binary Registry bug within PSDesiredStateConfiguration "Registry" Resource

From @JakeDean3631 on July 26, 2018 15:47

Describe the bug
Attempting to set a binary registry key to 0 will result in the key being set to "zero-length binary value" due to a bug with the registry resource parsing the value of 0 into a binary format.

To Reproduce
Steps to reproduce the behavior:

1. Create a test configuration containing the following:

Configuration TestConfig {

 Import-DSCResource -ModuleName 'PSDesiredStateConfiguration'
 
 Nodename $Nodename 
 {
       Registry 'Registry(INF): HKLM:\System\CurrentControlSet\Control\Lsa\FullPrivilegeAuditing'
      {
       ValueName = 'FullPrivilegeAuditing'
       ValueType = 'Binary'
       Key = 'HKLM:\System\CurrentControlSet\Control\Lsa'
           ValueData = 0
           Ensure = "Present"
           Force = $True
        }
 }

}

2. Generate a MOF and push the configuration.
3. Check the HKLM:\System\CurrentControlSet\Control\Lsa registry key, it will be set to "Zero-Length Binary Value."
4. Set the valuedata to 1, and it will parse correctly, resulting in the key being set to "01"
5. Regardless of how you attempt to set the "00" value, it will result in the "Zero-Length Binary Value

Expected behavior
HKLM:\System\CurrentControlSet\Control\Lsa registry key should be set to "00"

Screenshots

Additional context
Work-around is importing the xPSDesiredStateConfiguration module and using the xRegistry resource, which will parse the value of "0" into a binary key of "00"

Example:

Configuration TestConfig {

 Import-DSCResource -ModuleName 'xPSDesiredStateConfiguration'
 
 Nodename $Nodename 
 {
       xRegistry 'Registry(INF): HKLM:\System\CurrentControlSet\Control\Lsa\FullPrivilegeAuditing'
      {
       ValueName = 'FullPrivilegeAuditing'
       ValueType = 'Binary'
       Key = 'HKLM:\System\CurrentControlSet\Control\Lsa'
           ValueData = 0
           Ensure = "Present"
           Force = $True
        }
 }

}

Link to the original bug: PowerShell/DscResources#203

Copied from original issue: microsoft/PowerStigDsc#14

IE rule V-46477 errors when running ConvertTo-PowerStigXml

This is a RegistryRule in all the Internet Explorer stigs. The Software Publishing Criteria key doesn't exist in that rule. The stig info is misleading on the DISA site. The full key path should read HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing

Inconsistent var/constant/parameter names in Convert.PermissionRule/Methods.ps1

/Microsoft/PowerStig/Module/Convert.PermissionRule/Methods.ps1

'inheritance' and 'inheritence' are used interchangeably in the code, such as here:

$Inheritance = $script:inheritenceConstant[[string]$inheritance.trim()]

This will make it very difficult to modify these methods in the future.

Fix: All instances of 'inheritence' should be changed to 'inheritance'

Adding STIG data for newly released DISA STIGs

Is your feature request related to a problem? Please describe.
StigData is needed for the newest versions of the following STIGs:
Windows-Server-2012R2-MS-2.13
Windows-Server-2012R2-DC-2.13
Windows-2012-DNS-1.10
Windows-All-Domain-2.10
Windows-All-Forest-2.8
Windows-All-IE11-1.16

Describe the solution you'd like
StigData added for the newest versions of the following STIGs:
Windows-Server-2012R2-MS-2.13
Windows-Server-2012R2-DC-2.13
Windows-2012-DNS-1.10
Windows-All-Domain-2.10
Windows-All-Forest-2.8
Windows-All-IE11-1.16

Describe alternatives you've considered
n/a

Additional context
n/a

Registry change modified by IE11 xml isn't persistent after logon

Rule id V-46477 is the rule affected in the Windows-All-IE11-1.15.xml file. This isn't necessarily a problem with this module but I'm hoping someone here has some insight on this.

After logon the value of State changes from 23C00 back to its default of 23E00. Not using RDP for us right now isn't really an option so that's out.

I've found an old Microsoft article that talks about this exact problem but it references Server 2008/2008 R2. It says that if you use Group Policy to update the 'Check for signatures on downloaded programs' setting then it directly conflicts with the registry fix applied by this rule.

Has anyone seen this or know of a more current hotfix? Without that the changes made by this rule essentially do nothing.

Update PowerSTIG to support the Windows 10 Client Stig

Is your feature request related to a problem? Please describe.
Update PowerSTIG to support the most recent Windows 10 Client Stig

Describe the solution you'd like
Update PowerSTIG to support the most recent Windows 10 Client Stig

Include converted data for the .NET Framework 4.0 STIG resolved by PR #48

Importing converted .xml. Updating classes and tests to account for the addition of the .NET Framework 4.0 STIG

Windows Server Module can't be found

I know everything was just migrated but I don't see a WindowsServer.ps1 file. After I install and import the PowerStig module, I tried to compile one of the example mofs and keep getting an error that the Windows Server module wasn't found in any directory. I'm a noob to PowerStig. Any help is appreciated.

Dot NET STIG 1.4 rule V-30935 parses incorrectly

From @ldillonel on July 2, 2018 19:10

Convert the .NET STIG version 1.4 with PowerStigConvert. Review the STIG data.
Rule V-30935 will parse with valueData = 1
Should be valueData = 0

Copied from original issue: Microsoft/PowerStigConvert#1

Rule V-15505 return the wrong service name for the McAfee agent

Describe the bug
Rule V-15505 return the wrong service name for the McAfee agent

To Reproduce
Steps to reproduce the behavior:

1. Run ConvertFrom-StigXccdf
2. Review serviceName for rule V-15505

Expected behavior
Should return McAfee agent service name of masvc

Stig rules in the StigData contain properties intended to be on the parent element

Describe the bug
All stig data contains rules with the properties intended for the parent (DscResource, Id, Severity, ConversionStatus)

To Reproduce
Steps to reproduce the behavior:

1. Generate STIG data
2. Inspect any rule in the STIG data

Expected behavior
StigData is produced with child elements that do not contain properties intended for the parent element.

PowerStigXml Delta files

I don't really like publishing a full XML file with every STIG release, because it is a lot of data to go through in a PR. Since the files are new, there is nothing to compare a new parsed STIG against. Compare-PowerStigXml will highlight deltas, but that is run outside of the PR process and requires a reviewer to pull the code down and run the compare locally.

I purpose that we highlight the deltas in the xccdf Compare-XccdfXml and only parse them and output thePowerStigXml as a delta file to the previous Stig version. Each major STIG version would be a full parse and each minor release would be a delta parse.

This would make the PR for new PowerStigXml files much smaller and easier to validate. We can also add a test that validates (hashes) the delta file and it's parsed content. The PowerStig module will handle all of the data merging so it will be transparent to the caller (PowerStigDsc).

PowerShellGallery Doesn't have proper dependencies listed

Describe the bug
Powershell Gallery does not have any dependencies listed for PowerSTIG version 2.0.0.0. The psd1 file format changed and powershell gallery can't read it properly.

Without dependencies, find-module does not install the required dependent modules. Save-module does not download the required modules either.

To Reproduce

Additional context
Need to have ability to resolve dependencies with Find-Module.

Class Help content is not in the correct format

The PowerShell help system does not use inline help but does use an external help file. The inline help content can be extracted out, but only if it is in the correct format for an AST extraction. Most of the class help text is spread across the classes themselves and needs to be moved to the top of the class help section. By updating the help we can automatically build help and wiki content.

2012R2 V-4448 registry path is incorrect

Describe the bug

V-4448 in the 2012R2 processed Stigs have an incorrect registry path.

To Reproduce

Expected behavior

GroupPolicy should be 'Group Policy'

Screenshots

    <Rule id="V-4448" severity="medium" conversionstatus="pass" title="Group Policy - Registry Policy Processing" dscresource="Registry">
      <Ensure>Present</Ensure>
      <IsNullOrEmpty>False</IsNullOrEmpty>
      <Key>HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\GroupPolicy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}</Key>
      <OrganizationValueRequired>False</OrganizationValueRequired>
      <OrganizationValueTestString />
      <RawString>If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\

Value Name: NoGPOListChanges

Type: REG_DWORD
Value: 0</RawString>
      <ValueData>0</ValueData>
      <ValueName>NoGPOListChanges</ValueName>
      <ValueType>Dword</ValueType>
    </Rule>

Additional context

Add SQL 2012 Instance 1.17 STIG

Is your feature request related to a problem? Please describe.

SQL 2012 Instance STIG has a newer version available

Describe the solution you'd like

A converted and Archived version should be available

Describe alternatives you've considered

Additional context

PowerStig Baseline Scanning and Reporting

Is your feature request related to a problem? Please describe.
To implement PowerStig, you must know the exemptions and skip rules. If not you could break your current machines. There needs to be a way to reduce the Technical Debt to start using PowerStig at least in a Monitor and Report function. There is no automated tool to identify the exemptions and org settings for current machines.

Describe the solution you'd like
There needs to be a built in tool module that can scan and report on a machines STIG compliance without changing the system. This tool will have a baseline mof for each stig and scan the system. Then generate a stig exemption file or skip rule file for later consumption by PowerStig Config that will apply STIG settings. Also this tool will need to produce an aggregated report to management of STIG compliance. Lastly there will be a feature to provide automated documentation for consumption by the RMF process.

Describe alternatives you've considered
Adding a field in the current PowerStigDsc module that would override the Set script and not modify the system but monitor and report.

Suggested Feature for PowerStigDSC:

• MonitorAndReport = $true
• GenerateStigExceptionFile = $true
• IncludeValuesInStigExceptionFile = $true

Additional context
For my organization to adopt PowerStig, DevOps, and accreditation of a config instead of a machine, there needs to be a low cost of entry to show management the value and status of the network. Adding into PowerStig a scanning tool that will report on the STIG status will enable an immediate adoption of using PowerStig without the technical debt. If this feature is implemented, then using PowerStig to implement STIG settings will be easier for management to accept and administrators to identify their exemptions. With this staged process, PowerStig will be easier to adopt by the majority of government systems.

Update with converted data for the IIS 8.5 Server STIG

Importing converted .xml. Updating classes and tests to account for the addition of the IIS Server STIG data.
@winthrop28