microsoft / powerstigdsc Goto Github PK

Describe the bug
Attempting to set a binary registry key to 0 will result in the key being set to "zero-length binary value" due to a bug with the registry resource parsing the value of 0 into a binary format.

To Reproduce
Steps to reproduce the behavior:

1. Create a test configuration containing the following:

Configuration TestConfig {

 Import-DSCResource -ModuleName 'PSDesiredStateConfiguration'
 
 Nodename $Nodename 
 {
       Registry 'Registry(INF): HKLM:\System\CurrentControlSet\Control\Lsa\FullPrivilegeAuditing'
      {
       ValueName = 'FullPrivilegeAuditing'
       ValueType = 'Binary'
       Key = 'HKLM:\System\CurrentControlSet\Control\Lsa'
           ValueData = 0
           Ensure = "Present"
           Force = $True
        }
 }

}

2. Generate a MOF and push the configuration.
3. Check the HKLM:\System\CurrentControlSet\Control\Lsa registry key, it will be set to "Zero-Length Binary Value."
4. Set the valuedata to 1, and it will parse correctly, resulting in the key being set to "01"
5. Regardless of how you attempt to set the "00" value, it will result in the "Zero-Length Binary Value

Expected behavior
HKLM:\System\CurrentControlSet\Control\Lsa registry key should be set to "00"

Screenshots

Additional context
Work-around is importing the xPSDesiredStateConfiguration module and using the xRegistry resource, which will parse the value of "0" into a binary key of "00"

Example:

Configuration TestConfig {

 Import-DSCResource -ModuleName 'xPSDesiredStateConfiguration'
 
 Nodename $Nodename 
 {
       xRegistry 'Registry(INF): HKLM:\System\CurrentControlSet\Control\Lsa\FullPrivilegeAuditing'
      {
       ValueName = 'FullPrivilegeAuditing'
       ValueType = 'Binary'
       Key = 'HKLM:\System\CurrentControlSet\Control\Lsa'
           ValueData = 0
           Ensure = "Present"
           Force = $True
        }
 }

}

Link to the original bug: PowerShell/DscResources#203

Is your feature request related to a problem? Please describe.
Sql Server Composite Stig README is not in compliance with the project format and there are no SQL Server Examples

Describe the solution you'd like
Remove SqlServer README and update Project README. Add SqlServer examples to Project

Describe alternatives you've considered

Additional context

The composite resources currently instantiate the technology class in PowerSTIG as part of the StigData constructor to query for the Stig settings. Upcoming changes to PowerStig will replace the technology Class with an Enumeration, which will break the composite resources call into the PowerStig classes.

The following update will detect what is available in PowerStig and use it until the PowerStigDsc manifest is updated to require a minimum version of PowerSTIG that contains the enumeration.

if((New-Object Technology).GetType().BaseType.Name -eq 'Enum')
{
    $technology = [Technology]::Windows
}
else
{
    $technology = [Technology]::New( "Windows" )
}

In common/windows.AccessControl.ps1 there is a switch to select the AccessEntry type, but ActiveDirectoryAuditRuleEntry is missing from the switch.

These rules are not being added to the output mof.

The WindowsServer.integration.tests.ps1 has been updated to filter out ActiveDirectoryAuditRuleEntry rules. Once this issue is updated, the Permissions Context should be updated to remove the liter.

I should have clarified further with my PR. There is no actual error when compiling the configuration using these composite resources. I'm actually just getting a syntax error in the code as shown in the screenshot above. My OCD kicked in which prompted the PR #8 😄 .

PowerSTIG currently can't automate the SqlServer2012 STIG. Needs to be updated to accommodate.

I wanted to open an issue to communicate that we are planning to collapse PowerStigDsc into PowerStig. There are a few maintenance issues pushing this.

Right now we don’t have the using statements calling a fully qualified module (no version number).
We did that so that we could update PowerStig and not have to update PowerStigDsc., but this causes 2 issues.

1. You can only have one version of PowerStig on your system.
2. We have a validate set version on the STIG numbers that need to be updated with PowerStig, so they are tied together anyway.

We have a third project that helps mange the dependencies, but we can collapse most of that back into PowerStig as well. These were all originally broken into different modules to keep the module size down and the scope narrow, but after writing some documentation and talking with different people that are evaluating the project, having multiple modules adds to user complexity, so we want to eliminate as much complexity for everyone by consolidating the projects into a single module to do all things PowerStig related.

I will archive this repo and move all of the PowerStigDsc code and supporting code over to PowerStig this weekend.

Describe the bug

The following code should be removed now that PowerStig has released with the Technology enumeration.

    # BEGIN: This is a temporary fix until PowerStig has migrated the technolgy class to an enumeration
    if ((New-Object Technology).GetType().BaseType.Name -eq 'Enum')
    {
        # BEGIN: leave this after the temp fix is removed
        $technology = [Technology]::Windows
        # END: leave this after the temp fix is removed
    }
    else
    {
        $technology = [Technology]::New( "Windows" )
    }
    # END: This is a temporary fix until PowerStig has migrated the technolgy class to an enumeration

To Reproduce
none

Expected behavior
The technology enumeration should only be used in all composite resources.

$technology = [Technology]::WindowsServer

Screenshots
none

Additional context
none

Describe the bug
PowerStigDsc is now listed as a manifest module (vs a script module) so when you install the module from the gallery, the required modules are no longer automatically installed.

To Reproduce

1. Uninstall-Module -Name PowerStigDsc
2. Uninstall-Module -Name AccessControlDsc
3. Install-Module PowerStigDsc
4. Look in the $PsModulePath an see that AccessControlDsc was not installed.

Expected behavior
Install-Module PowerStigDsc should install all required modules.