V-73391 are meant to validate audit definitions. about microsoft-windows-server-2016-stig-baseline

[rx294]

@kkola found a hack for ConvertTo-Json to retain Enum strings ...

this would make for better reporting in inspec test reporting

because we can write test like its('AuditFlags'){ should cmp "success" }

PS C:\Users\Administrator> (Get-ACL -Audit -Path AD:\$dn).Audit | ConvertTo-Csv | ConvertFrom-Csv | ConvertTo-Json
[
    {
        "ActiveDirectoryRights":  "GenericAll",
        "InheritanceType":  "All",
        "ObjectType":  "00000000-0000-0000-0000-000000000000",
        "InheritedObjectType":  "00000000-0000-0000-0000-000000000000",
        "ObjectFlags":  "None",
        "AuditFlags":  "Success, Failure",
        "IdentityReference":  "Everyone",
        "IsInherited":  "False",
        "InheritanceFlags":  "ContainerInherit",
        "PropagationFlags":  "None"
    },
    {
        "ActiveDirectoryRights":  "WriteProperty, WriteDacl, WriteOwner",
        "InheritanceType":  "None",
        "ObjectType":  "00000000-0000-0000-0000-000000000000",
        "InheritedObjectType":  "00000000-0000-0000-0000-000000000000",
        "ObjectFlags":  "None",
        "AuditFlags":  "Success",
        "IdentityReference":  "Everyone",
        "IsInherited":  "False",
        "InheritanceFlags":  "None",
        "PropagationFlags":  "None"
    },
    {
        "ActiveDirectoryRights":  "ExtendedRight",
        "InheritanceType":  "None",
        "ObjectType":  "00000000-0000-0000-0000-000000000000",
        "InheritedObjectType":  "00000000-0000-0000-0000-000000000000",
        "ObjectFlags":  "None",
        "AuditFlags":  "Success",
        "IdentityReference":  "BUILTIN\\Administrators",
        "IsInherited":  "False",
        "InheritanceFlags":  "None",
        "PropagationFlags":  "None"
    },
    {
        "ActiveDirectoryRights":  "ExtendedRight",
        "InheritanceType":  "None",
        "ObjectType":  "00000000-0000-0000-0000-000000000000",
        "InheritedObjectType":  "00000000-0000-0000-0000-000000000000",
        "ObjectFlags":  "None",
        "AuditFlags":  "Success",
        "IdentityReference":  "VSPHEREAD\\Domain Users",
        "IsInherited":  "False",
        "InheritanceFlags":  "None",
        "PropagationFlags":  "None"
    },
    {
        "ActiveDirectoryRights":  "WriteProperty",
        "InheritanceType":  "All",
        "ObjectType":  "f30e3bbf-9ff0-11d1-b603-0000f80367c1",
        "InheritedObjectType":  "bf967aa5-0de6-11d0-a285-00aa003049e2",
        "ObjectFlags":  "ObjectAceTypePresent, InheritedObjectAceTypePresent",
        "AuditFlags":  "Success",
        "IdentityReference":  "Everyone",
        "IsInherited":  "False",
        "InheritanceFlags":  "ContainerInherit",
        "PropagationFlags":  "None"
    },
    {
        "ActiveDirectoryRights":  "WriteProperty",
        "InheritanceType":  "All",
        "ObjectType":  "f30e3bbe-9ff0-11d1-b603-0000f80367c1",
        "InheritedObjectType":  "bf967aa5-0de6-11d0-a285-00aa003049e2",
        "ObjectFlags":  "ObjectAceTypePresent, InheritedObjectAceTypePresent",
        "AuditFlags":  "Success",
        "IdentityReference":  "Everyone",
        "IsInherited":  "False",
        "InheritanceFlags":  "ContainerInherit",
        "PropagationFlags":  "None"
    }
]

[kkola]

a2c8e5b and 8e8c1ba fixes issue #14 for V-73391

[rx294]

Hey @kkola after discussion with the team, here is proposed to strategy for controls V-7339*

For the audit definitions defined for an entity, to be compliant at-least one should satisfy the following data points.

Required Audit data points

Type - Fail
Principal - Everyone
Access - Full Control
Inherited from - None
Applies to - This object only

Type - Fail

Type - Should be passed if it is set to Fail or Success or Fail(All)

https://docs.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.auditflags?view=netframework-4.8

Feild: AuditFlags

Failure	2	
Failed access attempts are to be audited.

None	0	
No access attempts are to be audited.

Success	1	
Successful access attempts are to be audited.

Principal - Everyone

IdentityReference     : Everyone

Access - Full Control

ActiveDirectoryRights : GenericAll

Inherited from - None

dont care… minimum possible is None, but it could be others but will be compliant

IsInherited           : True
IsInherited           : False

Applies to - This object only

InheritanceType - Should be passed if it is set to All || None || SelfAndChildren

https://docs.microsoft.com/en-us/dotnet/api/system.directoryservices.activedirectorysecurityinheritance?view=netframework-4.8


Field: InheritanceType
All	1	
Indicates inheritance that includes the object to which the ACE is applied, the object's immediate children, and the descendents of the object's children.

Children	4	
Indicates inheritance that includes the object's immediate children only, not the object itself or the descendents of its children.

Descendents	2	
Indicates inheritance that includes the object's immediate children and the descendants of the object's children, but not the object itself.

None	0	
Indicates no inheritance. The ACE information is only used on the object on which the ACE is set. ACE information is not inherited by any descendents of the object.

SelfAndChildren	3	
Indicates inheritance that includes the object itself and its immediate children. It does not include the descendents of its children.

Proposed Inspec test code for V-73391

control "test" do
  dn = command("(Get-ADDomain).DistinguishedName").stdout
  audits = json(command: "(Get-ACL -Audit -Path 'AD:#{dn}').Audit | ConvertTo-Csv | ConvertFrom-Csv | ConvertTo-Json").params

  describe.one do
    audits.each do |audit|
      describe "One of Audit Def" do
        subject {audit}
        its(["AuditFlags"])  {should match /Failure|Success, Failure/ }
        its(["IdentityReference"])  {should cmp 'Everyone' }
        its(["ActiveDirectoryRights"]) {should cmp 'GenericAll' }
        its(["IsInherited"]) {should match /True|False/ }
        its(["InheritanceType"]) {should match /All|None|SelfAndChildren/ }
      end
    end
  end
end

if you agree u can adapt similar code for the other controls

[rx294]

Also please note that when only one audit entry is defined
json(command: "(Get-ACL -Audit -Path 'AD:#{dn}').Audit | ConvertTo-Csv | ConvertFrom-Csv | ConvertTo-Json").params
returns a single hash instead of array hashes
that would require a special case when during the lines

describe.one do
    audits.each do |audit|

[kkola]

@rx294 the last few commits should resolve this issue