diff --git a/.github/workflows/pr-check.yml b/.github/workflows/pr-check.yml index e18fa96..9849392 100644 --- a/.github/workflows/pr-check.yml +++ b/.github/workflows/pr-check.yml @@ -65,7 +65,12 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 12 steps: + # Full history: the WS2022 baseline-repair suite re-derives its mapping + # evidence with `git show ` instead of trusting the committed + # tables, so a shallow checkout would make those assertions unrunnable. - uses: actions/checkout@v4 + with: + fetch-depth: 0 - uses: actions/setup-node@v4 with: node-version: ${{ env.NODE_VERSION }} diff --git a/.github/workflows/release-mac.yml b/.github/workflows/release-mac.yml index e89f496..75bb332 100644 --- a/.github/workflows/release-mac.yml +++ b/.github/workflows/release-mac.yml @@ -11,7 +11,7 @@ name: Release (macOS author) # # Trigger: workflow_dispatch only. Run the workflow definition from protected `main`; # the checkout step below switches to and verifies the supplied immutable mac tag. -# CLI: `gh workflow run "Release (macOS author)" --ref main -f release_tag=mac-v0.3.98-author.1` +# CLI: `gh workflow run "Release (macOS author)" --ref main -f release_tag=mac-v0.3.101-author.1` # The protected main copy of the public packaging guard checks the tagged tree # before npm install or electron-builder runs. # @@ -143,7 +143,7 @@ jobs: ) > SHA256SUMS-macos-author.txt cat SHA256SUMS-macos-author.txt - # Attach to the existing draft release (e.g. mac-v0.3.98-author.1). + # Attach to the existing draft release (e.g. mac-v0.3.101-author.1). # `--clobber` overwrites if a re-run uploads the same filename. - name: Upload artifacts to draft release env: diff --git a/AGENTS.md b/AGENTS.md index 0c456be..d7a76df 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -19,19 +19,17 @@ The following release references describe the current tagged source lines: | Line | Reference | State | |---|---|---| -| `main` | `v0.3.98` | Current Full-edition Windows/Linux tagged source with the public Machine Configuration guide and documentation cleanup. Its matching GitHub release remains an unpublished draft. | -| `mac-author-build` | `mac-v0.3.98-author.1` | Current author-only macOS tagged source with the same public documentation corrections. Its matching GitHub release remains an unpublished draft. | +| `main` | `v0.3.101` | Current Full-edition Windows/Linux release, published as a prerelease with the enforcement and dependency-security fixes. | +| `mac-author-build` | `mac-v0.3.101-author.1` | Current author-only macOS release, published as a prerelease with the compatible baseline, authoring, packaging, and security fixes. | On `mac-author-build`, the root package, desktop package, and matching lockfile -records use `0.3.98-author.1`. This release carries no dependency changes from -the prior macOS line. The package version on `main` is `0.3.98`; do not copy -macOS package metadata to `main`. +records use `0.3.101-author.1`. This release preserves the author-only +capability boundary while porting shared baseline, lossless data, Machine +Configuration packaging, build compatibility, and dependency-security fixes. +The package version on `main` is `0.3.101`; do not copy macOS package metadata +to `main`. -The prior annotated tag `mac-v0.3.94-author.1` resolves to -`c1c8cdfd17b85c2e85d48e2ab7f52f1b4a02787b`. Its five assets were verified by -workflow run -[#30233283418](https://github.com/Azure/ConfigForge/actions/runs/30233283418), -but that release remains a draft and unpublished. +The prior macOS Author release is `mac-v0.3.98-author.1`. ### Current feature inventory @@ -121,15 +119,13 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag - The macOS tag must resolve to the exact final validated commit on `mac-author-build`. `scripts/ship-mac.ps1` accepts only the `mac-v` form and defaults to `Azure/ConfigForge`. -- The current macOS Author tagged source `mac-v0.3.98-author.1` expects - these asset names. Its matching GitHub release remains an unpublished - draft; this documentation does not assert asset availability or - publication: +- The current macOS Author release `mac-v0.3.101-author.1` contains exactly + these asset names: | Asset | Exact name | |---|---| - | DMG | `ConfigForge-Author-0.3.98-author.1-mac-arm64.dmg` | - | Blockmap | `ConfigForge-Author-0.3.98-author.1-mac-arm64.dmg.blockmap` | + | DMG | `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg` | + | Blockmap | `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg.blockmap` | | Update metadata | `latest-mac.yml` | | CycloneDX SBOM | `sbom-macos-author.cdx.json` | | SHA-256 manifest | `SHA256SUMS-macos-author.txt` | @@ -145,7 +141,7 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag gh workflow run "Release (macOS author)" ` --repo Azure/ConfigForge ` --ref main ` - -f release_tag=mac-v0.3.98-author.1 + -f release_tag=mac-v0.3.101-author.1 ``` - `--ref main` selects the reviewed workflow definition, not the source to @@ -453,15 +449,10 @@ When touching IPC contracts or `packages/core/src/handlers/`, exercise the chann - PR #77 at `aec0775` ported all five PR #76 commits and passed 79 focused Manifest Editor tests, two isolated Playwright scenarios, lint with 0 errors, the desktop build, and a production audit with 0 vulnerabilities. -- The prior annotated tag `mac-v0.3.94-author.1` resolves to - `c1c8cdfd17b85c2e85d48e2ab7f52f1b4a02787b`. Its five assets were verified by - workflow run - [#30233283418](https://github.com/Azure/ConfigForge/actions/runs/30233283418), - but that release remains a draft and unpublished. -- The current macOS Author tagged source is `mac-v0.3.98-author.1`. Its - matching GitHub release remains an unpublished draft; use current GitHub - checks and release metadata as the authority for build and asset status - rather than recording a merge SHA or workflow run here. +- The prior macOS Author release is `mac-v0.3.98-author.1`. +- The current macOS Author release is `mac-v0.3.101-author.1`; use current + GitHub checks and release metadata as the authority for build and asset + status rather than recording a merge SHA or workflow run here. --- diff --git a/CHANGELOG.md b/CHANGELOG.md index e98928d..2d1a564 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,9 +1,41 @@ # Changelog +## [0.3.101-author.1] - 2026-08-07 + +> `mac-v0.3.101-author.1` is the current macOS Author release and is +> published as a prerelease. The author-only capability boundary is unchanged: +> device deploy, audit, enforce, revert, elevation, health, and audit-results +> storage remain excluded. + +### Added + +- Add a fail-closed Azure Machine Configuration package helper for + `AuditAndSet` packages. It patches both packaged Microsoft.OSConfig 1.4.3 + wrapper copies so Set properties cross the DSC boundary as compressed JSON. + +### Fixed + +- Repair the Windows Server 2022 Member Server, Domain Controller, and + Workgroup Member baselines for standalone authoring and Machine + Configuration export while preserving explicit empty user-rights + assertions and deterministic repair provenance. +- Preserve exact QWord values across YAML, JSON, spreadsheets, visual + editing, Diff, reports, registration, and MOF export. Registry aliases and + recognized hive paths normalize to canonical upstream `REG_*` contracts. +- Serialize concurrent history retention and rationale writes so authoring + metadata is not lost when saves overlap. +- Support source builds on Node 22.12 and Node 24 without the Vite optimizer + compatibility failure. + +### Security + +- Upgrade js-yaml to 4.3.1, DOMPurify to 3.4.13, fast-uri to 3.1.5, + ip-address to 10.4.0, React Router to 7.18.2, Undici 6.x to 6.28.0, and + Undici 7.x to 7.29.0 to clear the current dependency advisories. + ## [0.3.98-author.1] - 2026-07-28 -> `mac-v0.3.98-author.1` is the current macOS Author tagged source. Its -> matching GitHub release remains an unpublished draft. +> `mac-v0.3.98-author.1` is the prior macOS Author prerelease. ### Documentation diff --git a/INSTALL.md b/INSTALL.md index 3583bdf..d3f344c 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -8,11 +8,10 @@ ConfigForge has two editions: and Audit Pack export are available. Device Deploy, Audit, and Revert are intentionally omitted. -The current Windows/Linux Full-edition tagged source is `v0.3.98`. The -current macOS Author tagged source is `mac-v0.3.98-author.1`. Both matching -GitHub releases remain unpublished drafts. The Full-edition package version -on `main` is `0.3.98`; the macOS Author package version is -`0.3.98-author.1`. +The current Windows/Linux Full-edition release is `v0.3.101`. The current +macOS Author release is `mac-v0.3.101-author.1`. Both are published as +prereleases. The Full-edition package version on `main` is `0.3.101`; the +macOS Author package version is `0.3.101-author.1`. ConfigForge does **not** bundle the OSConfig CLI. To use the Full edition's Deploy, Audit, or Revert features against a real Windows or Linux machine, install `oscfg` separately from its upstream source. @@ -128,10 +127,9 @@ later). The release contains an ARM64-only binary. It is not an x64 or universal build and does not support Intel Macs. Rosetta does not provide ARM64-on-Intel compatibility. -The current macOS Author source tag is `mac-v0.3.98-author.1`. Its matching -GitHub release remains an unpublished draft and must stay draft-only until a -maintainer completes validation and approves publication. Users can build the -tagged source by following the instructions in the +The current macOS Author release is `mac-v0.3.101-author.1`, published as a +prerelease after its five assets pass validation. Users can download the +release or build the tagged source by following the instructions in the [Azure/ConfigForge repository](https://github.com/Azure/ConfigForge). The app is unsigned and not notarized. Copy **ConfigForge Author.app** to diff --git a/README.md b/README.md index 05847df..e6bde56 100644 --- a/README.md +++ b/README.md @@ -6,16 +6,15 @@ > The `oscfg` binary is **not** bundled. Editor, Microsoft Baselines, Diff, Benchmark Mapping, and Audit Pack PDF/Markdown export all work without it, including in the macOS Author edition. Deploy, device Audit, and Revert require the Full edition and the CLI. See [`INSTALL.md`](./INSTALL.md) for platform-by-platform install steps. -The current Windows/Linux Full-edition tagged source is `v0.3.98`. The -current macOS Author tagged source is `mac-v0.3.98-author.1`. Both matching -GitHub releases remain unpublished drafts. The Full-edition package version -on `main` is `0.3.98`; the macOS Author package version is `0.3.98-author.1`. +The current Windows/Linux Full-edition release is `v0.3.101`. The current +macOS Author release is `mac-v0.3.101-author.1`. Both are published as +prereleases. The Full-edition package version on `main` is `0.3.101`; the +macOS Author package version is `0.3.101-author.1`. -The macOS Author release ports applicable documentation-accuracy corrections -from `main` PR [#97](https://github.com/Azure/ConfigForge/pull/97) via PR -[#99](https://github.com/Azure/ConfigForge/pull/99), and replaces unreliable -native HTML hover titles with FluentUI tooltips on the My Baselines status -cells via PR [#101](https://github.com/Azure/ConfigForge/pull/101). +The macOS Author release includes the compatible Windows Server 2022 baseline +repairs, exact QWord and canonical Registry handling, Machine Configuration +package compatibility, Node 24 source-build support, and dependency-security +updates while preserving the author-only capability boundary. ## Export to Azure Machine Configuration @@ -221,8 +220,7 @@ is not a universal binary. - **[`SUPPORT.md`](./SUPPORT.md)** and **[`SECURITY.md`](./SECURITY.md)**: best-effort support boundaries and private vulnerability reporting. - **[`apps/desktop/src/design/PLATFORM.md`](./apps/desktop/src/design/PLATFORM.md)**: platform-specific UX rules (Windows Mica + custom titlebar, Linux native frame, etc.). - **[`CHANGELOG.md`](./CHANGELOG.md)**: per-release notes. The current macOS - Author line is tagged as `mac-v0.3.97-author.1`; its release is an - unpublished draft. + Author release is `mac-v0.3.101-author.1`. - **[`docs/src/SUMMARY.md`](./docs/src/SUMMARY.md)**: documentation source for Quick Start, User Guide, Architecture, API Reference, and Operations. The `docs` workflow builds this into an mdBook site and deploys it to the @@ -248,8 +246,10 @@ is not a universal binary. | Version | Highlights | |---|---| -| **0.3.98-author.1** (current macOS tagged source; draft unpublished) | Adds complete Machine Configuration documentation and removes stale/internal public-doc guidance. | -| **0.3.98** (current Windows/Linux tagged source; draft unpublished) | Adds the same public Machine Configuration guide and documentation cleanup to the Full edition. | +| **0.3.101-author.1** (current macOS prerelease) | Ports the author-safe WS2022 baseline repairs, lossless QWord and Registry handling, Machine Configuration packaging compatibility, Node 24 build support, and dependency-security fixes. | +| **0.3.101** (current Windows/Linux prerelease) | Clears the remaining dependency alerts after the verified OSConfig enforcement and Machine Configuration fixes. | +| **0.3.98-author.1** (prior macOS prerelease) | Adds complete Machine Configuration documentation and removes stale/internal public-doc guidance. | +| **0.3.98** (prior Windows/Linux source) | Adds the same public Machine Configuration guide and documentation cleanup to the Full edition. | | **0.3.97-author.1** (prior macOS draft) | Preserves authoritative CLI reasons and adds detailed templates to every WS2025 control. | | **0.3.97** (prior Windows/Linux draft) | Preserves authoritative CLI reasons for expression-backed Test resources and adds detailed WS2025 reason templates. | | **0.3.96-author.1** (prior macOS draft) | Ports the full 320/321/296 WS2025 control-preservation work and global Machine Configuration MOF export fixes from main PR #104 through PR #105. | diff --git a/SECURITY.md b/SECURITY.md index 2b9cd23..0166d9d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,8 +6,8 @@ Security fixes are evaluated for the current tagged release lines. | Edition | Current version | Security updates | | --- | --- | --- | -| Full edition for Windows and Linux | `v0.3.98` | Supported tagged source; release remains a draft | -| macOS Author edition | `mac-v0.3.98-author.1` | Supported tagged source; release remains a draft | +| Full edition for Windows and Linux | `v0.3.101` | Supported published prerelease | +| macOS Author edition | `mac-v0.3.101-author.1` | Supported published prerelease | | Older versions | Earlier tags | Not supported | ## Security scope diff --git a/apps/desktop/PACKAGING.md b/apps/desktop/PACKAGING.md index c9b6ec9..feff66b 100644 --- a/apps/desktop/PACKAGING.md +++ b/apps/desktop/PACKAGING.md @@ -9,7 +9,7 @@ > flavor lives on the `mac-author-build` branch and uses its own > `electron-builder.author.yml`. > -> **Current through v0.3.98-author.1:** the release pipeline +> **Current through v0.3.101-author.1:** the release pipeline > generates a CycloneDX SBOM per platform, enforces > `npm audit --omit=dev --audit-level=high` as a release gate, > pins `electron-builder` invocation via `npx --no-install`, and diff --git a/apps/desktop/build/release-notes-author.md b/apps/desktop/build/release-notes-author.md index 0bab36b..2b80c08 100644 --- a/apps/desktop/build/release-notes-author.md +++ b/apps/desktop/build/release-notes-author.md @@ -1,29 +1,43 @@ -# ConfigForge Author 0.3.98-author.1 - macOS +# ConfigForge Author 0.3.101-author.1 - macOS -> **Release state: draft and unpublished.** +> **Release state: prerelease.** -This documentation-focused release adds a complete Azure Machine Configuration -deployment path and removes stale public guidance. +This release brings the author-safe Windows Server baseline, lossless data, +Machine Configuration packaging, build compatibility, and dependency security +updates from the 0.3.101 Full-edition line to Apple Silicon Macs. ## Added -- Standalone Machine Configuration workflow in the README. -- Full mdBook guide covering MOF export, module-version resolution, package - creation, local testing, Azure Storage, policy generation, assignment, - verification, and troubleshooting. +- Added a fail-closed Azure Machine Configuration package helper that patches + both packaged Microsoft.OSConfig 1.4.3 Set wrappers to pass resource + properties as compressed JSON. -## Corrected +## Fixed -- Removed guidance for a nonexistent suggestion Apply button. -- Removed internal tracker and repository details from public documentation. -- Removed obsolete private-repository wording. -- Replaced unused AI-analysis product terminology with accurate local-analysis - and provenance terminology. +- Repaired the Windows Server 2022 Member Server, Domain Controller, and + Workgroup Member baselines for standalone authoring and Machine + Configuration export. +- Preserved exact QWord values and canonical Registry contracts across YAML, + JSON, spreadsheets, Visual mode, Diff, reports, registration, and MOF + export. +- Serialized overlapping history-retention and rationale writes. +- Supported source builds on Node 22.12 and Node 24. + +## Security + +- Updated js-yaml to 4.3.1, DOMPurify to 3.4.13, fast-uri to 3.1.5, + ip-address to 10.4.0, React Router to 7.18.2, Undici 6.x to 6.28.0, and + Undici 7.x to 7.29.0. + +## Author-only scope + +- Device deploy, audit, enforce, revert, elevation, health, and audit-results + storage remain intentionally excluded. ## Expected assets -1. `ConfigForge-Author-0.3.98-author.1-mac-arm64.dmg` -2. `ConfigForge-Author-0.3.98-author.1-mac-arm64.dmg.blockmap` +1. `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg` +2. `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg.blockmap` 3. `latest-mac.yml` 4. `sbom-macos-author.cdx.json` 5. `SHA256SUMS-macos-author.txt` diff --git a/apps/desktop/package.json b/apps/desktop/package.json index a038d51..0244ae7 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -1,6 +1,6 @@ { "name": "@configforge/desktop", - "version": "0.3.98-author.1", + "version": "0.3.101-author.1", "private": true, "description": "ConfigForge \u2014 OSConfig Baseline Editing tool", "main": "./dist/electron/main.js", @@ -40,7 +40,7 @@ "electron-updater": "6.8.9", "i18next": "^25.0.0", "i18next-browser-languagedetector": "^8.0.0", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "react-i18next": "^15.0.0", "monaco-editor": "^0.55.1", "pdfkit": "^0.18.0" @@ -66,7 +66,7 @@ "postcss": "^8.5.23", "react": "^18.3.1", "react-dom": "^18.3.1", - "react-router-dom": "^7.18.0", + "react-router-dom": "^7.18.2", "sharp": "0.35.0", "tailwindcss": "^3.4.19", "typescript": "^5.7.3", diff --git a/apps/desktop/src/components/conflict-detector.tsx b/apps/desktop/src/components/conflict-detector.tsx index be16fd0..c0133dc 100644 --- a/apps/desktop/src/components/conflict-detector.tsx +++ b/apps/desktop/src/components/conflict-detector.tsx @@ -5,6 +5,7 @@ import { useEffect, useState, useCallback, useRef, useMemo } from "react"; import { WarningRegular, ArrowSyncRegular } from "@fluentui/react-icons"; import { Button, MessageBar, MessageBarBody, Spinner } from "@fluentui/react-components"; import { detectConflicts, type Conflict } from "@configforge/core/ai/analyzer"; +import { stringifyLosslessJson } from "@configforge/core/manifest/lossless"; import { cfs } from "../lib/cfs"; import { useTranslation } from "react-i18next"; @@ -160,7 +161,8 @@ export function ConflictDetector({ manifestNames }: ConflictDetectorProps) { > {manifest}: - {JSON.stringify(conflict.values[mIdx])} + {stringifyLosslessJson(conflict.values[mIdx]) ?? + String(conflict.values[mIdx])} ))} diff --git a/apps/desktop/src/components/manifest-editor.tsx b/apps/desktop/src/components/manifest-editor.tsx index 83fde8e..7260ae6 100644 --- a/apps/desktop/src/components/manifest-editor.tsx +++ b/apps/desktop/src/components/manifest-editor.tsx @@ -3,7 +3,10 @@ import { lazy, Suspense, useEffect, useLayoutEffect, useMemo, useRef, useState, useCallback } from "react"; import type { OnChange, Monaco } from "@monaco-editor/react"; -import yaml from "js-yaml"; +import { + parseLosslessJson, + parseLosslessYaml, +} from "@configforge/core/manifest/lossless"; import oscSchema from "../data/osc-manifest-schema.json"; import { WarningRegular, @@ -207,12 +210,12 @@ export function ConfigEditor({ let doc: Record | null = null; try { // Try YAML first (superset of JSON), then JSON as fallback - const parsed = yaml.load(content); + const parsed = parseLosslessYaml(content); if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) { doc = parsed as Record; } else { try { - const jsonParsed = JSON.parse(content); + const jsonParsed = parseLosslessJson(content); if (jsonParsed && typeof jsonParsed === 'object' && !Array.isArray(jsonParsed)) { doc = jsonParsed as Record; } @@ -227,7 +230,7 @@ export function ConfigEditor({ // parser error in a "YAML syntax error:" prefix — that produces // "YAML syntax error: ... is not valid JSON" which is contradictory. try { - const jsonParsed = JSON.parse(content); + const jsonParsed = parseLosslessJson(content); if (jsonParsed && typeof jsonParsed === 'object' && !Array.isArray(jsonParsed)) { doc = jsonParsed as Record; } else { diff --git a/apps/desktop/src/components/rationale-diff.ts b/apps/desktop/src/components/rationale-diff.ts index 53c6dfb..df3d64c 100644 --- a/apps/desktop/src/components/rationale-diff.ts +++ b/apps/desktop/src/components/rationale-diff.ts @@ -9,7 +9,10 @@ * or React testing harness. Any logic in the hook that doesn't *need* a * React lifecycle should live here. */ -import yaml from 'js-yaml'; +import { + parseLosslessYaml, + stringifyLosslessJson, +} from '@configforge/core/manifest/lossless'; export interface ResourceDiff { /** The `name` field of the resource. Used as the rationale entry's resourceName. */ @@ -23,7 +26,7 @@ export interface ResourceDiff { } /** - * Cheap structural compare using JSON serialization. We don't need to + * Cheap structural compare using lossless JSON serialization. We don't need to * pretty-print, just hash by canonical form. `JSON.stringify` is * NON-deterministic for object-key order — but here both sides come * from `js-yaml` which preserves insertion order, so equal documents @@ -33,7 +36,7 @@ export interface ResourceDiff { * purpose since manifest YAML doesn't admit them anyway. */ function structuralEqual(a: unknown, b: unknown): boolean { - return JSON.stringify(a) === JSON.stringify(b); + return stringifyLosslessJson(a) === stringifyLosslessJson(b); } /** @@ -48,7 +51,7 @@ export function extractResources(content: string): Array if (typeof content !== 'string' || content.trim() === '') return []; let parsed: unknown; try { - parsed = yaml.load(content); + parsed = parseLosslessYaml(content); } catch { return []; } diff --git a/apps/desktop/src/data/baseline-catalog.ts b/apps/desktop/src/data/baseline-catalog.ts index 951a4d2..e29c392 100644 --- a/apps/desktop/src/data/baseline-catalog.ts +++ b/apps/desktop/src/data/baseline-catalog.ts @@ -76,15 +76,13 @@ export const BASELINE_CATALOG: BaselineEntry[] = [ id: 'ws2022-domain-member', name: 'Windows Server 2022 - Member Server', description: - 'Azure security baseline for Windows Server 2022 member servers. 257 settings covering registry, CSP, account policy, audit policy, and user rights.', + 'Azure security baseline for Windows Server 2022 member servers. 259 settings covering registry, account policy, audit policy, and user rights.', platform: 'windows', category: 'security-baseline', version: '2510', source: 'local', manifestUrl: '/_baselines/ws2022-domain-member.osc.yaml', - githubUrl: - 'https://github.com/microsoft/osconfig/blob/main/manifests/azure-security-baseline-windows-server-2022-domain-member.yaml', - resourceCount: 257, + resourceCount: 259, resourceTypes: ['Microsoft.OSConfig/Test'], scenarioName: 'SecurityBaseline/Server/2022/MemberServer', }, @@ -98,9 +96,7 @@ export const BASELINE_CATALOG: BaselineEntry[] = [ version: '2510', source: 'local', manifestUrl: '/_baselines/ws2022-domain-controller.osc.yaml', - githubUrl: - 'https://github.com/microsoft/osconfig/blob/main/manifests/azure-security-baseline-windows-server-2022-domain-controller.yaml', - resourceCount: 242, + resourceCount: 244, resourceTypes: ['Microsoft.OSConfig/Test'], scenarioName: 'SecurityBaseline/Server/2022/DomainController', }, @@ -114,9 +110,7 @@ export const BASELINE_CATALOG: BaselineEntry[] = [ version: '2510', source: 'local', manifestUrl: '/_baselines/ws2022-workgroup-member.osc.yaml', - githubUrl: - 'https://github.com/microsoft/osconfig/blob/main/manifests/azure-security-baseline-windows-server-2022-workgroup-member.yaml', - resourceCount: 200, + resourceCount: 202, resourceTypes: ['Microsoft.OSConfig/Test'], scenarioName: 'SecurityBaseline/Server/2022/WorkgroupMember', }, diff --git a/apps/desktop/src/data/ws2022-baselines.test.ts b/apps/desktop/src/data/ws2022-baselines.test.ts new file mode 100644 index 0000000..a5adf2d --- /dev/null +++ b/apps/desktop/src/data/ws2022-baselines.test.ts @@ -0,0 +1,615 @@ +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. + +import { describe, it, expect } from "vitest"; +import { readFileSync } from "node:fs"; +import path from "node:path"; +import { fileURLToPath } from "node:url"; +import yaml from "js-yaml"; +import { parseOscYaml } from "@configforge/core/import-export"; +import { validateManifestSchema, validateManifestPlatform } from "@configforge/core/platform"; +import { BASELINE_CATALOG } from "./baseline-catalog"; +import manifestSchema from "./osc-manifest-schema.json"; + +/** + * Regression coverage for the WS2022 standalone-baseline repair. + * + * The three bundled Windows Server 2022 baselines shipped in their original + * generated form: every audit-policy / user-rights / account-policy control + * was addressed through `Microsoft.Windows/CSP` at `./Vendor/MSFT/Policy/ + * Result/...`, which cannot be read on a standalone (non-MDM) machine, so + * ~30% of each profile came back unread. WS2025 was already repaired this + * way in PRs #82/#93; this suite locks in the same shape for WS2022. + * + * Everything asserted here is derived from committed evidence: + * - `scripts/ws2022-baseline-repair/conversion-report.json` records the + * pre-repair source of every rule (produced by the deterministic + * converter from `173177e:public/_baselines/ws2022-*.osc.yaml`). + * - `scripts/ws2022-baseline-repair/csp-provider-map.json` records the + * reviewed WS2025 CSP-path -> dedicated-provider mappings. + * CI checks out shallow, so the tests read the committed report rather than + * shelling out to `git show`. + */ + +interface OscResource { + name: string; + type: string; + properties?: { + resource?: { type?: string; properties?: Record }; + expression?: string; + template?: string; + schema?: unknown; + resources?: OscResource[]; + }; +} + +interface ProfileReport { + profile: string; + sourceRules: number; + outputRules: number; + sourceCsp: number; + convertedCsp: number; + residualCsp: string[]; + keyPathNormalized: number; + providerCounts: Record; + expansions: { name: string; into: string[] }[]; + registryShapeRepairs: { name: string; valueType: string }[]; + assertionRestatements: { name: string; from: unknown; to: string; reason?: string }[]; + assertionDowngrades: { name: string }[]; + valueChanges: { name: string; from: unknown; to: unknown }[]; + conversions: { name: string; cspPath: string; to: string; evidence: string[] }[]; + sourceRuleNames: string[]; + sourceValues: Record; +} + +const HERE = path.dirname(fileURLToPath(import.meta.url)); +const BASELINE_DIR = path.resolve(HERE, "../../../../public/_baselines"); +const REPAIR_DIR = path.resolve(HERE, "../../../../scripts/ws2022-baseline-repair"); + +const CONVERSION_REPORT = JSON.parse( + readFileSync(path.join(REPAIR_DIR, "conversion-report.json"), "utf8"), +) as { profiles: ProfileReport[] }; + +const CSP_PROVIDER_MAP = new Map( + ( + JSON.parse(readFileSync(path.join(REPAIR_DIR, "csp-provider-map.json"), "utf8")) as { + entries: { cspPath: string; target: { type: string }; evidence: string[] }[]; + } + ).entries.map((entry) => [entry.cspPath, entry] as const), +); + +const TEST_TYPE = "Microsoft.OSConfig/Test"; +const REGISTRY = "Microsoft.Windows/Registry"; +const AUDIT = "Microsoft.Windows/AuditPolicy"; +const USER_RIGHTS = "Microsoft.Windows/UserRightsAssignment"; +const ACCOUNT = "Microsoft.Windows/AccountPolicy"; +const CSP = "Microsoft.Windows/CSP"; + +/** + * User rights whose WS2022 source demanded "empty string or not set". The + * `UserRightsAssignment` provider reads back a principal list, so the assertion + * is restated over that list instead of being downgraded to informational. + */ +const UNASSIGNED_EXPRESSION = "value == null || value.size() == 0"; +const UNASSIGNED_BASE = [ + "UserRightsAccessCredentialManagerAsTrustedCaller", + "UserRightsActAsPartOfTheOperatingSystem", + "UserRightsCreatePermanentSharedObjects", + "UserRightsCreateToken", + "UserRightsLockMemory", + "UserRightsModifyObjectLabel", +] as const; + +/** + * Minimal CEL harness for the restored assertion. `||` short-circuits the way + * CEL does, so `size()` is never applied to an unset value; any atom outside the + * grammar throws rather than being silently approximated. + */ +function evalUnassigned(expression: string, value: unknown): boolean { + return expression + .split("||") + .map((part) => part.trim()) + .some((atom) => { + if (atom === "value == null") return value === null || value === undefined; + const sized = /^value\.size\(\) == (\d+)$/.exec(atom); + if (sized) { + if (!Array.isArray(value)) throw new Error(`size() applied to ${String(value)}`); + return value.length === Number(sized[1]); + } + throw new Error(`unsupported CEL atom for this harness: ${atom}`); + }); +} + +/** Exact post-repair shape, asserted per profile. */ +const EXPECTED = [ + { + file: "ws2022-domain-member.osc.yaml", + catalogId: "ws2022-domain-member", + sourceRules: 257, + outputRules: 259, + sourceCsp: 73, + providers: { [REGISTRY]: 184, [AUDIT]: 26, [USER_RIGHTS]: 36, [ACCOUNT]: 13 }, + unassignedUserRights: [...UNASSIGNED_BASE, "UserRightsEnableDelegation"], + }, + { + file: "ws2022-domain-controller.osc.yaml", + catalogId: "ws2022-domain-controller", + sourceRules: 242, + outputRules: 244, + sourceCsp: 71, + providers: { [REGISTRY]: 171, [AUDIT]: 32, [USER_RIGHTS]: 28, [ACCOUNT]: 13 }, + // A domain controller delegates through AD, so `UserRightsEnableDelegation` + // is not one of the controls the DC profile pins to "unassigned". + unassignedUserRights: [...UNASSIGNED_BASE], + }, + { + file: "ws2022-workgroup-member.osc.yaml", + catalogId: "ws2022-workgroup-member", + sourceRules: 202 - 2, + outputRules: 202, + sourceCsp: 71, + providers: { [REGISTRY]: 129, [AUDIT]: 26, [USER_RIGHTS]: 36, [ACCOUNT]: 11 }, + unassignedUserRights: [...UNASSIGNED_BASE, "UserRightsEnableDelegation"], + }, +] as const; + +interface EnumSchema { + enum: T[]; +} + +interface NamedProviderSchema { + properties: { + properties: { + properties: { + name: EnumSchema; + }; + }; + }; +} + +interface AuditPolicySchema { + properties: { + properties: { + properties: { + value: EnumSchema; + }; + }; + }; +} + +interface RegistrySchema { + properties: { + properties: { + allOf: Array<{ + oneOf?: Array<{ + properties?: { + valueType?: EnumSchema; + }; + }>; + }>; + }; + }; +} + +interface ManifestSchema { + $defs: { + userrights: NamedProviderSchema; + accpol: NamedProviderSchema; + auditpol: AuditPolicySchema; + registry: RegistrySchema; + }; +} + +// Enum/pattern sources of truth, read straight out of the manifest schema so +// the assertions track the schema rather than a hand-copied list. +const schemaDefs = (manifestSchema as unknown as ManifestSchema).$defs; +const URA_NAMES: string[] = schemaDefs.userrights.properties.properties.properties.name.enum; +const ACCOUNT_POLICY_NAMES: string[] = schemaDefs.accpol.properties.properties.properties.name.enum; +const AUDIT_VALUES: number[] = schemaDefs.auditpol.properties.properties.properties.value.enum; +const REGISTRY_VALUE_TYPES: string[] = schemaDefs.registry.properties.properties.allOf + .flatMap((clause) => clause.oneOf ?? []) + .flatMap((variant) => variant.properties?.valueType?.enum ?? []); +const AUDIT_SUBCATEGORY_PATTERN = /^\{0CCE[0-9A-F]{4}-69AE-11D9-BED3-505054503030\}$/; +const HIVE_PATTERN = /^(?:HKLM|HKCU|HKCR|HKU|HKCC|HKEY_[A-Z_]+):\\/; + +function loadRaw(file: string): string { + return readFileSync(path.join(BASELINE_DIR, file), "utf8"); +} + +function flatten(resources: OscResource[]): OscResource[] { + const out: OscResource[] = []; + for (const resource of resources) { + if (resource.properties?.resources) { + out.push(...flatten(resource.properties.resources)); + } else { + out.push(resource); + } + } + return out; +} + +function loadRules(file: string): OscResource[] { + const document = yaml.load(loadRaw(file)) as { resources?: OscResource[] }; + return flatten(document.resources ?? []); +} + +function reportFor(file: string): ProfileReport { + const report = CONVERSION_REPORT.profiles.find((p) => p.profile === file); + if (!report) throw new Error(`no conversion report entry for ${file}`); + return report; +} + +describe.each(EXPECTED)("WS2022 baseline — $file", (expected) => { + const rules = loadRules(expected.file); + const report = reportFor(expected.file); + const byName = new Map(rules.map((r) => [r.name, r])); + + describe("parses and validates", () => { + it("parses as an OSConfig manifest", () => { + const parsed = parseOscYaml(loadRaw(expected.file)); + expect(parsed.resources.length).toBeGreaterThan(0); + }); + + it("passes ConfigForge manifest schema validation with zero errors", () => { + const parsed = parseOscYaml(loadRaw(expected.file)); + expect(validateManifestSchema(parsed)).toEqual([]); + }); + + it("passes ConfigForge windows platform validation with zero errors", () => { + const parsed = parseOscYaml(loadRaw(expected.file)); + expect(validateManifestPlatform(parsed.resources, "windows")).toEqual([]); + }); + }); + + describe("rule and provider counts", () => { + it("has the exact post-repair rule count", () => { + expect(rules.length).toBe(expected.outputRules); + expect(report.outputRules).toBe(expected.outputRules); + }); + + it("has the exact per-provider rule counts", () => { + const counts: Record = {}; + for (const rule of rules) { + const type = rule.properties?.resource?.type ?? ""; + counts[type] = (counts[type] ?? 0) + 1; + } + expect(counts).toEqual(expected.providers); + }); + + it("agrees with the committed conversion report", () => { + expect(report.sourceRules).toBe(expected.sourceRules); + expect(report.sourceCsp).toBe(expected.sourceCsp); + expect(report.convertedCsp).toBe(expected.sourceCsp); + expect(Object.keys(report.sourceRuleNames).length).toBe(expected.sourceRules); + }); + }); + + describe("source-to-output logical rule parity", () => { + it("carries every source rule forward by name", () => { + const missing = report.sourceRuleNames.filter((name) => !byName.has(name)); + expect(missing).toEqual([]); + }); + + it("reconciles the rule-count delta entirely through documented expansions", () => { + const extra = report.expansions.reduce((sum, e) => sum + e.into.length - 1, 0); + expect(expected.sourceRules + extra).toBe(expected.outputRules); + expect(extra).toBe(2); + }); + + it("expands the composite lockout policy into three AccountPolicy rules", () => { + expect(report.expansions).toHaveLength(1); + const [expansion] = report.expansions; + expect(expansion.name).toBe("AccountLockoutPolicy"); + expect(expansion.into).toEqual([ + "AccountLockoutPolicy", + "AccountLockoutPolicy_LockoutThreshold", + "AccountLockoutPolicy_LockoutReset", + ]); + for (const name of expansion.into) { + expect(byName.get(name)?.properties?.resource?.type).toBe(ACCOUNT); + } + }); + + it("introduces no rules that are neither a source rule nor an expansion product", () => { + const known = new Set(report.sourceRuleNames); + for (const expansion of report.expansions) { + for (const name of expansion.into) known.add(name); + } + expect(rules.filter((r) => !known.has(r.name)).map((r) => r.name)).toEqual([]); + }); + + it("has no duplicate rule names", () => { + expect(byName.size).toBe(rules.length); + }); + }); + + describe("no Policy/Result CSP remains", () => { + it("contains no Microsoft.Windows/CSP resources at all", () => { + expect(rules.filter((r) => r.properties?.resource?.type === CSP).map((r) => r.name)).toEqual( + [], + ); + expect(report.residualCsp).toEqual([]); + }); + + it("contains no ./Vendor/MSFT/Policy/Result addressing anywhere in the file", () => { + expect(loadRaw(expected.file)).not.toContain("/Policy/Result/"); + }); + + it("routes every converted CSP path through a reviewed WS2025 mapping", () => { + for (const conversion of report.conversions) { + const mapping = CSP_PROVIDER_MAP.get(conversion.cspPath); + expect(mapping, `unmapped CSP path ${conversion.cspPath}`).toBeDefined(); + expect(mapping!.target.type).toBe(conversion.to); + expect(mapping!.evidence.length).toBeGreaterThan(0); + } + expect(report.conversions).toHaveLength(expected.sourceCsp); + }); + + it("only converts to the four dedicated providers", () => { + const targets = new Set(report.conversions.map((c) => c.to)); + expect([...targets].sort()).toEqual([ACCOUNT, AUDIT, USER_RIGHTS].sort()); + }); + }); + + describe("no malformed provider payloads", () => { + it("wraps every rule in a Microsoft.OSConfig/Test with a CEL expression", () => { + for (const rule of rules) { + expect(rule.type, rule.name).toBe(TEST_TYPE); + expect(rule.properties?.schema, rule.name).toBeUndefined(); + expect(typeof rule.properties?.expression, rule.name).toBe("string"); + expect(rule.properties?.expression?.length, rule.name).toBeGreaterThan(0); + expect(typeof rule.properties?.template, rule.name).toBe("string"); + expect(rule.properties?.template, rule.name).toContain("{value}"); + } + }); + + it("emits well-formed Registry payloads", () => { + for (const rule of rules.filter((r) => r.properties?.resource?.type === REGISTRY)) { + const props = rule.properties!.resource!.properties as Record; + expect(props.keyPath, rule.name).toMatch(HIVE_PATTERN); + expect(REGISTRY_VALUE_TYPES, rule.name).toContain(props.valueType as string); + expect(typeof props.valueName, rule.name).toBe("string"); + // A handful of controls are read-only/informational upstream and carry + // no desired value; the provider still needs a well-formed address. + if (!("value" in props)) continue; + if (props.valueType === "REG_DWORD" || props.valueType === "REG_QWORD") { + expect(typeof props.value, rule.name).toBe("number"); + } else if (props.valueType === "REG_MULTI_SZ") { + expect(Array.isArray(props.value), rule.name).toBe(true); + } else if (props.valueType === "REG_SZ" || props.valueType === "REG_EXPAND_SZ") { + expect(typeof props.value, rule.name).toBe("string"); + } + } + }); + + it("emits well-formed UserRightsAssignment payloads", () => { + for (const rule of rules.filter((r) => r.properties?.resource?.type === USER_RIGHTS)) { + const props = rule.properties!.resource!.properties as Record; + expect(props.name, rule.name).toMatch(/^Se[A-Za-z]+$/); + expect(URA_NAMES, rule.name).toContain(props.name as string); + expect(Array.isArray(props.value), rule.name).toBe(true); + for (const principal of props.value as unknown[]) { + expect(typeof principal, rule.name).toBe("string"); + } + } + }); + + it("emits well-formed AuditPolicy payloads", () => { + for (const rule of rules.filter((r) => r.properties?.resource?.type === AUDIT)) { + const props = rule.properties!.resource!.properties as Record; + expect(props.subcategory, rule.name).toMatch(AUDIT_SUBCATEGORY_PATTERN); + expect(AUDIT_VALUES, rule.name).toContain(props.value as number); + } + }); + + it("emits well-formed AccountPolicy payloads", () => { + for (const rule of rules.filter((r) => r.properties?.resource?.type === ACCOUNT)) { + const props = rule.properties!.resource!.properties as Record; + expect(ACCOUNT_POLICY_NAMES, rule.name).toContain(props.name as string); + if ("value" in props) { + expect(["number", "boolean", "string"], rule.name).toContain(typeof props.value); + } + } + }); + + it("leaves no colon-less registry hive prefixes behind", () => { + const registry = rules.filter((r) => r.properties?.resource?.type === REGISTRY); + expect(registry.length).toBe(report.keyPathNormalized); + expect( + registry + .map((r) => (r.properties!.resource!.properties as Record).keyPath) + .filter((keyPath) => !HIVE_PATTERN.test(String(keyPath))), + ).toEqual([]); + }); + }); + + describe("desired values are preserved", () => { + it("changes no desired value outside the documented provider-contract reshapes", () => { + const documented = new Set(report.valueChanges.map((change) => change.name)); + const unexpected: string[] = []; + for (const [name, sourceValue] of Object.entries(report.sourceValues)) { + if (documented.has(name)) continue; + const props = byName.get(name)?.properties?.resource?.properties ?? {}; + if (!("value" in props)) continue; + if (JSON.stringify(props.value) !== JSON.stringify(sourceValue)) unexpected.push(name); + } + expect(unexpected).toEqual([]); + }); + + it("documents every reshape with a provider-mandated justification", () => { + const reshapeNames = new Set([ + ...report.registryShapeRepairs.map((r) => r.name), + ...report.expansions.flatMap((e) => e.into), + ...report.expansions.map((e) => e.name), + ]); + for (const change of report.valueChanges) { + const target = byName.get(change.name)?.properties?.resource?.type; + const isUserRightsListReshape = target === USER_RIGHTS && change.from === ""; + const isAccountPolicyBoolean = target === ACCOUNT && typeof change.to === "boolean"; + expect( + isUserRightsListReshape || isAccountPolicyBoolean || reshapeNames.has(change.name), + `${change.name}: ${JSON.stringify(change.from)} -> ${JSON.stringify(change.to)}`, + ).toBe(true); + } + }); + + it("keeps every numeric Registry desired value byte-identical", () => { + for (const rule of rules.filter((r) => r.properties?.resource?.type === REGISTRY)) { + const source = report.sourceValues[rule.name]; + if (typeof source !== "number") continue; + expect((rule.properties!.resource!.properties as Record).value, rule.name) + .toBe(source); + } + }); + }); + + describe("residual unread risk is declared, not hidden", () => { + it("asserts 'unassigned' on every user right whose source demanded it", () => { + const restated = rules.filter( + (r) => + r.properties?.resource?.type === USER_RIGHTS && + r.properties?.expression === UNASSIGNED_EXPRESSION, + ); + expect(restated.map((r) => r.name).sort()).toEqual( + [...expected.unassignedUserRights].sort(), + ); + expect(restated.length).toBe(expected.unassignedUserRights.length); + for (const rule of restated) { + expect(rule.properties?.resource?.properties?.value, rule.name).toEqual([]); + expect(rule.properties?.template, rule.name).toBe( + "The value {value} must be unassigned (no principals).", + ); + expect(rule.properties?.template, rule.name).not.toContain("informational"); + } + }); + + it("passes the restored assertion on an empty list and fails it on any principal", () => { + for (const rule of rules.filter( + (r) => r.properties?.expression === UNASSIGNED_EXPRESSION, + )) { + expect(evalUnassigned(rule.properties!.expression!, null), rule.name).toBe(true); + expect(evalUnassigned(rule.properties!.expression!, []), rule.name).toBe(true); + expect( + evalUnassigned(rule.properties!.expression!, ["*S-1-5-32-544"]), + rule.name, + ).toBe(false); + } + }); + + it("reconciles the restatements with the conversion report", () => { + const reported = report.assertionRestatements.map((item) => item.name).sort(); + expect(reported).toEqual([...expected.unassignedUserRights].sort()); + for (const item of report.assertionRestatements) { + expect(item.to, item.name).toBe(UNASSIGNED_EXPRESSION); + expect(byName.get(item.name)?.properties?.expression, item.name).toBe( + UNASSIGNED_EXPRESSION, + ); + } + }); + + it("leaves every other UserRightsAssignment rule explicitly informational", () => { + const restated = new Set(expected.unassignedUserRights as readonly string[]); + for (const rule of rules.filter((r) => r.properties?.resource?.type === USER_RIGHTS)) { + if (restated.has(rule.name!)) continue; + expect(rule.properties?.expression, rule.name).toBe("true"); + expect(rule.properties?.template, rule.name).toContain("informational"); + } + }); + + it("carries no remaining assertion downgrade", () => { + expect(report.assertionDowngrades).toEqual([]); + }); + + it("never leaves a rule without a readable assertion or template", () => { + for (const rule of rules) { + expect(rule.properties?.expression, rule.name).toBeTruthy(); + expect(rule.properties?.template, rule.name).toBeTruthy(); + } + }); + }); + + describe("catalog metadata", () => { + const entry = BASELINE_CATALOG.find((b) => b.id === expected.catalogId); + + it("reports the corrected resource count", () => { + expect(entry?.resourceCount).toBe(expected.outputRules); + }); + + it("drops the upstream githubUrl (local manifest no longer matches upstream)", () => { + expect(entry?.githubUrl).toBeUndefined(); + }); + + it("keeps manifestUrl and scenarioName untouched", () => { + expect(entry?.manifestUrl).toBe(`/_baselines/${expected.file}`); + expect(entry?.scenarioName).toBe( + `SecurityBaseline/Server/2022/${ + { + "ws2022-domain-member": "MemberServer", + "ws2022-domain-controller": "DomainController", + "ws2022-workgroup-member": "WorkgroupMember", + }[expected.catalogId] + }`, + ); + }); + }); +}); + +describe("WS2022 representative rules", () => { + const member = new Map( + loadRules("ws2022-domain-member.osc.yaml").map((r) => [r.name, r] as const), + ); + + it("Registry: ICMP redirect hardening keeps its WS2022 value on a colon hive", () => { + const rule = member.get("AllowICMPRedirectsToOverrideOSPFGeneratedRoutes"); + expect(rule?.properties?.resource?.type).toBe(REGISTRY); + expect(rule?.properties?.resource?.properties).toEqual({ + keyPath: "HKEY_LOCAL_MACHINE:\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters", + valueName: "EnableICMPRedirect", + valueType: "REG_DWORD", + value: 0, + }); + expect(rule?.properties?.expression).toBe("((((value == 0)) || ((value == null))))"); + expect(rule?.properties?.schema).toBeUndefined(); + }); + + it("AuditPolicy: AuditCredentialValidation uses an exact subcategory GUID", () => { + const rule = member.get("AuditCredentialValidation"); + expect(rule?.properties?.resource?.type).toBe(AUDIT); + expect(rule?.properties?.resource?.properties).toEqual({ + subcategory: "{0CCE923F-69AE-11D9-BED3-505054503030}", + value: 3, + }); + }); + + it("UserRightsAssignment: UserRightsDenyAccessFromNetwork uses an exact Se* right name", () => { + const rule = member.get("UserRightsDenyAccessFromNetwork"); + expect(rule?.properties?.resource?.type).toBe(USER_RIGHTS); + expect(rule?.properties?.resource?.properties).toEqual({ + name: "SeDenyNetworkLogonRight", + value: ["*S-1-5-32-546"], + }); + }); + + it("AccountPolicy: minimum password length uses an exact policy name and the WS2022 value", () => { + const rule = member.get("DeviceLockMinDevicePasswordLength"); + expect(rule?.properties?.resource?.type).toBe(ACCOUNT); + expect(rule?.properties?.resource?.properties).toEqual({ + name: "MinimumPasswordLength", + value: 14, + }); + expect(rule?.properties?.expression).toBe("(value != null && value >= 14)"); + }); + + it("AccountPolicy: the composite lockout CSP expands into three separate policies", () => { + expect(member.get("AccountLockoutPolicy")?.properties?.resource?.properties).toEqual({ + name: "LockoutDuration", + value: 15, + }); + expect( + member.get("AccountLockoutPolicy_LockoutThreshold")?.properties?.resource?.properties, + ).toEqual({ name: "LockoutThreshold", value: 3 }); + expect( + member.get("AccountLockoutPolicy_LockoutReset")?.properties?.resource?.properties, + ).toEqual({ name: "LockoutReset", value: 15 }); + }); +}); diff --git a/apps/desktop/src/pages/Diff/index.tsx b/apps/desktop/src/pages/Diff/index.tsx index 507fef6..a2b85ad 100644 --- a/apps/desktop/src/pages/Diff/index.tsx +++ b/apps/desktop/src/pages/Diff/index.tsx @@ -6,7 +6,10 @@ import { useState, useEffect, useCallback, useMemo, useRef } from "react"; import { Trans, useTranslation } from "react-i18next"; import { useLocation, useNavigate } from "react-router-dom"; -import yaml from "js-yaml"; +import { + parseLosslessYaml, + stringifyLosslessJson, +} from "@configforge/core/manifest/lossless"; import { ManifestEditor } from "../../components/manifest-editor"; import { DiffViewer } from "../../components/diff-viewer"; import { AiAnalysisPanel } from "../../components/ai-analysis-panel"; @@ -356,7 +359,10 @@ export function DiffPage() { return; } if (json.data) { - const content = typeof json.data === "string" ? json.data : JSON.stringify(json.data, null, 2); + const content = + typeof json.data === "string" + ? json.data + : (stringifyLosslessJson(json.data, 2) ?? String(json.data)); setText(content); } else { setText(`# No reported configuration found for: ${name}\n# The manifest may not have been deployed yet.\n`); @@ -382,8 +388,8 @@ export function DiffPage() { const matrixStats = useMemo(() => { if (!showDiff) return null; try { - const lDoc = yaml.load(leftText); - const rDoc = yaml.load(rightText); + const lDoc = parseLosslessYaml(leftText); + const rDoc = parseLosslessYaml(rightText); if (!lDoc || !rDoc) return null; const rows = buildMatrix([ { name: 'left', doc: lDoc }, @@ -918,7 +924,7 @@ function valuePreview(v: unknown): string { if (v == null) return ''; if (typeof v === 'string') return v.length > 60 ? v.slice(0, 57) + '…' : v; try { - const s = JSON.stringify(v); + const s = stringifyLosslessJson(v) ?? String(v); return s.length > 60 ? s.slice(0, 57) + '…' : s; } catch { return String(v); } } @@ -1259,6 +1265,8 @@ function MatrixTab({ function formatMatrixValue(v: unknown): string { if (v === undefined || v === null) return ""; if (typeof v === "string") return v; - if (typeof v === "number" || typeof v === "boolean") return String(v); - return JSON.stringify(v); + if (typeof v === "number" || typeof v === "boolean" || typeof v === "bigint") { + return String(v); + } + return stringifyLosslessJson(v) ?? String(v); } diff --git a/apps/desktop/src/pages/ManifestCompliance.tsx b/apps/desktop/src/pages/ManifestCompliance.tsx index 26dffa6..0639c0c 100644 --- a/apps/desktop/src/pages/ManifestCompliance.tsx +++ b/apps/desktop/src/pages/ManifestCompliance.tsx @@ -16,6 +16,7 @@ import { } from "@fluentui/react-icons"; import { MessageBar, MessageBarBody, MessageBarTitle, Spinner } from "@fluentui/react-components"; import { useCisAvailable } from "../components/use-cis-available"; +import { stringifyLosslessJson } from "@configforge/core/manifest/lossless"; import { cfs } from "../lib/cfs"; import { useTranslation } from "react-i18next"; @@ -43,6 +44,10 @@ interface ComplianceReport { extras: Array<{ ruleName: string; type?: string }>; } +function formatComplianceValue(value: unknown): string { + return stringifyLosslessJson(value) ?? String(value); +} + interface ComplianceResponse { manifest: string; against: string; @@ -537,11 +542,11 @@ function RulesTable({ rows, status }: { rows: PerRule[]; status: ComplianceStatu {status !== "missing" && ( - {r.myValue === undefined ? "-" : JSON.stringify(r.myValue)} + {r.myValue === undefined ? "-" : formatComplianceValue(r.myValue)} )} - {r.expected === undefined ? "-" : JSON.stringify(r.expected)} + {r.expected === undefined ? "-" : formatComplianceValue(r.expected)} {r.gpoPath ?? "-"} @@ -601,8 +606,10 @@ function renderMarkdown(data: ComplianceResponse): string { out.push("| Status | Severity | Rule | GPO Path | My Value | Expected |"); out.push("| --- | --- | --- | --- | --- | --- |"); for (const row of r.perRule) { - const my = row.myValue === undefined ? "" : "`" + JSON.stringify(row.myValue) + "`"; - const exp = row.expected === undefined ? "" : "`" + JSON.stringify(row.expected) + "`"; + const my = + row.myValue === undefined ? "" : "`" + stringifyLosslessJson(row.myValue) + "`"; + const exp = + row.expected === undefined ? "" : "`" + stringifyLosslessJson(row.expected) + "`"; const gpo = row.gpoPath ? row.gpoPath.replace(/\\/g, "\\\\").replace(/\|/g, "\\|") : ""; const name = row.ruleName.replace(/\\/g, "\\\\").replace(/\|/g, "\\|"); out.push(`| ${row.status} | ${row.severity} | ${name} | ${gpo} | ${my} | ${exp} |`); diff --git a/apps/desktop/src/pages/ManifestEditor/components/ManifestContent.tsx b/apps/desktop/src/pages/ManifestEditor/components/ManifestContent.tsx index b53f2fe..2ce71ee 100644 --- a/apps/desktop/src/pages/ManifestEditor/components/ManifestContent.tsx +++ b/apps/desktop/src/pages/ManifestEditor/components/ManifestContent.tsx @@ -7,7 +7,7 @@ import { MessageBar, MessageBarBody, Spinner } from "@fluentui/react-components" import { CodeRegular, TableRegular } from "@fluentui/react-icons"; import { ManifestEditor } from "../../../components/manifest-editor"; import { FORMAT_TABS, EDITOR_LANGUAGE } from "../helpers"; -import { dumpVisualManifest } from "../visual-viewer"; +import { dumpVisualManifest, parseLosslessJson } from "../visual-viewer"; import type { ManifestEditorState } from "../state/useManifestEditorState"; import { VisualManifestViewer } from "./VisualManifestViewer"; @@ -117,7 +117,7 @@ export const ManifestContent = React.memo(function ManifestContent({ if (activeFormat === "json") { try { const previousYaml = formatCache.current.yaml ?? savedContent; - const yamlSource = dumpVisualManifest(JSON.parse(editedContent)); + const yamlSource = dumpVisualManifest(parseLosslessJson(editedContent)); formatCache.current.yaml = yamlSource; contentRef.current = yamlSource; const nextStack = previousYaml && previousYaml !== yamlSource ? [previousYaml] : []; diff --git a/apps/desktop/src/pages/ManifestEditor/helpers.tsx b/apps/desktop/src/pages/ManifestEditor/helpers.tsx index 89a4553..8e2af36 100644 --- a/apps/desktop/src/pages/ManifestEditor/helpers.tsx +++ b/apps/desktop/src/pages/ManifestEditor/helpers.tsx @@ -15,6 +15,7 @@ import type { TFunction } from "i18next"; import { useTranslation } from "react-i18next"; import type { OscResource } from "@configforge/core/types"; +import { stringifyLosslessJson } from "@configforge/core/manifest/lossless"; // ── Shared types ──────────────────────────────────────────────────── @@ -104,6 +105,16 @@ export function extractPropertyPath(properties: Record): string return null; } +function formatResourceValue(value: unknown): string { + if (value === null || value === undefined) return "-"; + if (typeof value !== "object") return String(value); + try { + return stringifyLosslessJson(value) ?? String(value); + } catch { + return String(value); + } +} + // ── ResourceDetailPanel ───────────────────────────────────────────── export function ResourceDetailPanel({ resource }: { resource: OscResource }) { @@ -150,7 +161,7 @@ export function ResourceDetailPanel({ resource }: { resource: OscResource }) {

{t("resourceDetails.desiredValue")}:{" "} - {typeof resource.value === "object" ? JSON.stringify(resource.value) : String(resource.value)} + {formatResourceValue(resource.value)}

)} @@ -181,7 +192,7 @@ export function ResourceDetailPanel({ resource }: { resource: OscResource }) { - {typeof val === "object" && val !== null ? JSON.stringify(val) : String(val ?? "-")} + {formatResourceValue(val)} diff --git a/apps/desktop/src/pages/ManifestEditor/index.tsx b/apps/desktop/src/pages/ManifestEditor/index.tsx index 70d6966..f55d088 100644 --- a/apps/desktop/src/pages/ManifestEditor/index.tsx +++ b/apps/desktop/src/pages/ManifestEditor/index.tsx @@ -9,7 +9,10 @@ import { Link } from "react-router-dom"; import { useRationalePrompt, RationalePromptModal } from "../../components/use-rationale-prompt"; import { useCisAvailable } from "../../components/use-cis-available"; import { useBaselineWorkspace } from "../../components/BaselineWorkspace"; -import yaml from "js-yaml"; +import { + parseLosslessYaml, + stringifyLosslessJson, +} from "@configforge/core/manifest/lossless"; import { ArrowLeftRegular, WarningRegular } from "@fluentui/react-icons"; import { Button, @@ -223,7 +226,7 @@ export function ManifestDetailPage() { detectedPlatform = storedPlatform; } else if (currentDisplayContent) { try { - const parsed = yaml.load(currentDisplayContent) as Record | null; + const parsed = parseLosslessYaml(currentDisplayContent) as Record | null; if (parsed && Array.isArray(parsed.resources)) { detectedPlatform = detectManifestPlatform(parsed.resources); } @@ -527,7 +530,8 @@ export function ManifestDetailPage() { if (!yamlContent) { const status = await cfs.manifests.status(manifestName); const data = (status as { data?: unknown }).data; - const content = typeof data === "string" ? data : JSON.stringify(data, null, 2); + const content = + typeof data === "string" ? data : (stringifyLosslessJson(data, 2) ?? String(data)); sessionStorage.setItem("baseline-template-content", content); } else { sessionStorage.setItem("baseline-template-content", yamlContent); diff --git a/apps/desktop/src/pages/ManifestEditor/visual-viewer.test.ts b/apps/desktop/src/pages/ManifestEditor/visual-viewer.test.ts index 97083e6..d688717 100644 --- a/apps/desktop/src/pages/ManifestEditor/visual-viewer.test.ts +++ b/apps/desktop/src/pages/ManifestEditor/visual-viewer.test.ts @@ -421,6 +421,9 @@ describe("visual viewer helpers", () => { const formattedObject = formatVisualValue(objectValue); expect(formattedObject).toBe(JSON.stringify(objectValue, null, 2)); expect(formattedObject).toContain(longValue); + expect( + formatVisualValue({ nested: { qword: 18446744073709551615n } }), + ).toContain('"qword": 18446744073709551615'); }); it("cycles ascending, descending, and unsorted while keeping equal values stable", () => { diff --git a/apps/desktop/src/pages/ManifestEditor/visual-viewer.ts b/apps/desktop/src/pages/ManifestEditor/visual-viewer.ts index 960db77..f44c15c 100644 --- a/apps/desktop/src/pages/ManifestEditor/visual-viewer.ts +++ b/apps/desktop/src/pages/ManifestEditor/visual-viewer.ts @@ -1,7 +1,15 @@ // Copyright (c) Microsoft Corporation. All rights reserved. // Licensed under the MIT License. -import yaml from "js-yaml"; +import { + LOSSLESS_MANIFEST_SCHEMA, + dumpLosslessYaml, + parseLosslessJson as parseSharedLosslessJson, + parseLosslessYaml, + stringifyLosslessJson as stringifySharedLosslessJson, +} from "@configforge/core/manifest/lossless"; + +export { LOSSLESS_MANIFEST_SCHEMA }; const GROUP_RESOURCE_TYPE = "Microsoft.OSConfig/Group"; const TEST_RESOURCE_TYPE = "Microsoft.OSConfig/Test"; @@ -138,30 +146,6 @@ export const VISUAL_RESOURCE_TEMPLATES: readonly VisualResourceTemplate[] = [ }, ]; -const YAML_INTEGER_PATTERN = /^[+-]?(?:[0-9]+|0b[01]+|0o[0-7]+|0x[0-9a-fA-F]+)$/; - -function constructLosslessInteger(source: string): number | bigint { - const negative = source.startsWith("-"); - const unsigned = source.startsWith("-") || source.startsWith("+") ? source.slice(1) : source; - const integer = BigInt(unsigned) * (negative ? -1n : 1n); - return integer >= BigInt(Number.MIN_SAFE_INTEGER) && integer <= BigInt(Number.MAX_SAFE_INTEGER) - ? Number(integer) - : integer; -} - -const LOSSLESS_INTEGER_TYPE = new yaml.Type("tag:yaml.org,2002:int", { - kind: "scalar", - resolve: (value: unknown) => typeof value === "string" && YAML_INTEGER_PATTERN.test(value), - construct: (value: string) => constructLosslessInteger(value), - predicate: (value: unknown) => - typeof value === "bigint" || (typeof value === "number" && Number.isInteger(value)), - represent: (value: bigint | number) => value.toString(), -}); - -export const LOSSLESS_MANIFEST_SCHEMA = yaml.DEFAULT_SCHEMA.extend({ - implicit: [LOSSLESS_INTEGER_TYPE], -}); - function asRecord(value: unknown): Record | null { return value !== null && typeof value === "object" && !Array.isArray(value) ? (value as Record) @@ -1063,96 +1047,19 @@ export function sortVisualSettings( } export function parseVisualManifest(source: string): unknown { - return yaml.load(source, { schema: LOSSLESS_MANIFEST_SCHEMA }); + return parseLosslessYaml(source); } -const BIGINT_JSON_MARKER = "\u0000CONFIGFORGE_BIGINT_"; -const JSON_NUMBER_PATTERN = /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/; - export function stringifyLosslessJson(value: unknown, space = 2): string | undefined { - const bigintValues: string[] = []; - const seen = new WeakSet(); - let serialized = JSON.stringify( - value, - (_key, nestedValue: unknown) => { - if (typeof nestedValue === "bigint") { - const index = bigintValues.push(nestedValue.toString()) - 1; - return `${BIGINT_JSON_MARKER}${index}`; - } - if (nestedValue !== null && typeof nestedValue === "object") { - if (seen.has(nestedValue)) return "[Circular]"; - seen.add(nestedValue); - } - return nestedValue; - }, - space, - ); - if (serialized === undefined) return undefined; - - bigintValues.forEach((integer, index) => { - serialized = serialized.replaceAll(JSON.stringify(`${BIGINT_JSON_MARKER}${index}`), integer); - }); - return serialized; -} - -function maskUnsafeJsonIntegers(source: string): string { - let masked = ""; - let inString = false; - let escaped = false; - - for (let index = 0; index < source.length; index += 1) { - const character = source[index]; - if (inString) { - masked += character; - if (escaped) escaped = false; - else if (character === "\\") escaped = true; - else if (character === '"') inString = false; - continue; - } - if (character === '"') { - inString = true; - masked += character; - continue; - } - - if (character === "-" || (character >= "0" && character <= "9")) { - const match = source.slice(index).match(JSON_NUMBER_PATTERN)?.[0]; - if (match) { - const isInteger = !/[.eE]/.test(match); - if (isInteger) { - const integer = BigInt(match); - if ( - integer < BigInt(Number.MIN_SAFE_INTEGER) || - integer > BigInt(Number.MAX_SAFE_INTEGER) - ) { - masked += JSON.stringify(`${BIGINT_JSON_MARKER}${match}`); - index += match.length - 1; - continue; - } - } - masked += match; - index += match.length - 1; - continue; - } - } - masked += character; - } - return masked; + return stringifySharedLosslessJson(value, space); } export function parseLosslessJson(source: string): unknown { - return JSON.parse(maskUnsafeJsonIntegers(source), (_key, value: unknown) => { - if (typeof value === "string" && value.startsWith(BIGINT_JSON_MARKER)) { - const integer = value.slice(BIGINT_JSON_MARKER.length); - if (YAML_INTEGER_PATTERN.test(integer)) return BigInt(integer); - } - return value; - }); + return parseSharedLosslessJson(source); } export function dumpVisualManifest(document: unknown): string { - return yaml.dump(document, { - schema: LOSSLESS_MANIFEST_SCHEMA, + return dumpLosslessYaml(document, { indent: 2, lineWidth: 120, noRefs: false, diff --git a/apps/desktop/src/pages/ManifestHistory.tsx b/apps/desktop/src/pages/ManifestHistory.tsx index a5e36d2..c9da80e 100644 --- a/apps/desktop/src/pages/ManifestHistory.tsx +++ b/apps/desktop/src/pages/ManifestHistory.tsx @@ -9,6 +9,7 @@ import { ManifestEditor } from "../components/manifest-editor"; import { Breadcrumb } from "../components/Breadcrumb"; import { DiffViewer } from "../components/diff-viewer"; import { safeRestore } from "@configforge/core/history/restore"; +import { stringifyLosslessJson } from "@configforge/core/manifest/lossless"; import { electronRestoreClient } from "../lib/electron-restore-client"; import { cfs } from "../lib/cfs"; import { @@ -134,7 +135,11 @@ export function ManifestHistoryPage() { const currentRes = results[1] as { data?: unknown }; if (currentRes?.data != null) { const data = currentRes.data; - setCurrentYaml(typeof data === "string" ? data : JSON.stringify(data, null, 2)); + setCurrentYaml( + typeof data === "string" + ? data + : (stringifyLosslessJson(data, 2) ?? String(data)), + ); } } return snapshotRes.data; @@ -205,7 +210,12 @@ export function ManifestHistoryPage() { setRestoreCandidate(entry); setRestorePreview({ snapshotYaml: snapData.data.content as string, - currentYaml: typeof cur === "string" ? cur : cur ? JSON.stringify(cur, null, 2) : "", + currentYaml: + typeof cur === "string" + ? cur + : cur + ? (stringifyLosslessJson(cur, 2) ?? String(cur)) + : "", }); } catch (err) { setError(err instanceof Error ? err.message : t("errors.restorePreviewLoadFailed")); diff --git a/apps/desktop/src/pages/ManifestNew/state/useNewManifestForm.ts b/apps/desktop/src/pages/ManifestNew/state/useNewManifestForm.ts index 8e14aef..b41d233 100644 --- a/apps/desktop/src/pages/ManifestNew/state/useNewManifestForm.ts +++ b/apps/desktop/src/pages/ManifestNew/state/useNewManifestForm.ts @@ -2,7 +2,7 @@ // Licensed under the MIT License. import { useCallback, useEffect, useRef, useState } from "react"; -import yaml from "js-yaml"; +import { parseLosslessYaml } from "@configforge/core/manifest/lossless"; import { type Platform, getValidTypesForPlatform } from "@configforge/core/platform"; import { cfs } from "../../../lib/cfs"; import { @@ -117,7 +117,7 @@ export function useNewManifestForm(options: UseNewManifestFormOptions = {}) { if (newPlatform === platform) return; try { - const parsed = yaml.load(yamlContent) as Record | null; + const parsed = parseLosslessYaml(yamlContent) as Record | null; if (parsed && Array.isArray(parsed.resources)) { const validTypes = getValidTypesForPlatform(newPlatform); const incompatible = (parsed.resources as { type?: string }[]).filter( diff --git a/docs/src/api-reference/history-import-export.md b/docs/src/api-reference/history-import-export.md index 968263e..54c9b9c 100644 --- a/docs/src/api-reference/history-import-export.md +++ b/docs/src/api-reference/history-import-export.md @@ -176,10 +176,11 @@ import omitted `valueType` (and the JSON path also omitted `valueName`), so the editor's inline validator flagged every imported row as invalid. `valueType` is inferred from `expectedValue` via -`inferRegistryValueType()` (exported from `import.ts`): integer-shaped -values — numbers (`42`) and integer-shaped strings (`"0"`, `"-7"`, -`" 42 "`) — get `Dword`; everything else gets `String`. Users can -override after import. New import sources should re-use the same helper. +`inferRegistryValueType()` (exported from `import.ts`) emits canonical +upstream Registry types. Integer-shaped values in the DWORD range get +`REG_DWORD`. Larger exact integers get `REG_QWORD`. Other values get +`REG_SZ`. Users can override after import. New import sources should re-use +the same helper. ## `cfs.exportChannel.get({ name, format?, effect?, osType? })` — channel `cfs:export:get` diff --git a/docs/src/architecture/module-map.md b/docs/src/architecture/module-map.md index 1f3ef48..455bc24 100644 --- a/docs/src/architecture/module-map.md +++ b/docs/src/architecture/module-map.md @@ -117,7 +117,7 @@ Single source of truth for business logic. Each handler is a pure function calle | `exec.ts` | `oscfg exec resource --mode ...` wrapper for direct provider reads. | | `manage.ts` | Namespace/resource deletion helpers. | | `registered-types.ts` | Whitelist of resource types accepted by the targeted CLI version (`OSCFG_CLI_VERSION = '1.3.9-preview11'`). Types missing from the list trigger a soft warning at register time; the manifest still registers. | -| `registry-types.ts` | Registry `valueType` mapping (`Dword`, `String`, …). | +| `registry-types.ts` | Maps compatibility Registry `valueType` inputs to the canonical upstream `REG_*` forms. | | `registry.ts` | Registry resource specifics. | | `compliance.ts` | Decides `compliant` / `non-compliant` / `indeterminate` from CLI output. | | `naming.ts` | `isValidNamespace`: refuses path-traversal, control chars. | diff --git a/docs/src/architecture/system-overview.md b/docs/src/architecture/system-overview.md index 256361e..b6d358c 100644 --- a/docs/src/architecture/system-overview.md +++ b/docs/src/architecture/system-overview.md @@ -1,6 +1,6 @@ # System overview -ConfigForge is an Electron desktop app for authoring, validating, comparing, and exporting OSConfig manifests (`.osc.yaml`). The Full edition (`v0.3.98`) also supports live deploy/audit/revert operations; the macOS Author edition (`mac-v0.3.98-author.1`) intentionally omits those device-operation namespaces. The renderer uses Electron 42, React 18, Fluent UI v9, and Vite; shared business logic lives in the platform-neutral `@configforge/core` package. +ConfigForge is an Electron desktop app for authoring, validating, comparing, and exporting OSConfig manifests (`.osc.yaml`). The Full edition (`v0.3.101`) also supports live deploy/audit/revert operations; the macOS Author edition (`mac-v0.3.101-author.1`) intentionally omits those device-operation namespaces. The renderer uses Electron 42, React 18, Fluent UI v9, and Vite; shared business logic lives in the platform-neutral `@configforge/core` package. There is no HTTP server, database, queue, or microservice layer in the current app. Renderer code calls the Electron preload bridge (`window.cfs.*`), the main process validates IPC payloads, and pure handlers in `packages/core` own filesystem and CLI operations. diff --git a/docs/src/changelog.md b/docs/src/changelog.md index a75e518..aeafab7 100644 --- a/docs/src/changelog.md +++ b/docs/src/changelog.md @@ -3,10 +3,28 @@ A concise release history for ConfigForge. Newer entries use the shipped semver tag; older entries summarize the foundational work by theme. +## macOS Author v0.3.101-author.1 - 2026-08-07 + +`mac-v0.3.101-author.1` is the current macOS Author release and is published +as a prerelease. The author-only capability boundary remains unchanged. + +- **Windows Server 2022 baselines:** Repair the Member Server, Domain + Controller, and Workgroup Member profiles for standalone authoring and + Machine Configuration export while preserving empty user-rights + assertions. +- **Lossless authoring:** Preserve exact QWord values and canonical Registry + contracts across YAML, JSON, spreadsheets, Visual mode, Diff, reports, + registration, and MOF export. +- **Machine Configuration packaging:** Add the fail-closed helper that patches + both Microsoft.OSConfig 1.4.3 Set wrappers to pass compressed JSON. +- **Authoring stability:** Serialize overlapping history retention and + rationale writes, and support source builds on Node 22.12 and Node 24. +- **Security:** Update js-yaml, DOMPurify, fast-uri, ip-address, React Router, + and both affected Undici dependency lines to their patched releases. + ## macOS Author v0.3.98-author.1 — 2026-07-28 -`mac-v0.3.98-author.1` is the current macOS Author tagged source. Its matching -GitHub release remains an unpublished draft. +`mac-v0.3.98-author.1` is the prior macOS Author prerelease. - **Machine Configuration documentation:** Add standalone README guidance and a complete mdBook deployment workflow. diff --git a/docs/src/introduction.md b/docs/src/introduction.md index c95fc44..49c5139 100644 --- a/docs/src/introduction.md +++ b/docs/src/introduction.md @@ -20,10 +20,10 @@ application** with two editions: and elevation methods under `system`) are intentionally omitted. Authors deploy later from the Full edition on Windows or Linux. -The current Windows/Linux Full-edition tagged source is `v0.3.98`. The -current macOS Author tagged source is `mac-v0.3.98-author.1`. Both matching -GitHub releases remain unpublished drafts. The package version on `main` is -`0.3.98`; the macOS Author package version is `0.3.98-author.1`. +The current Windows/Linux Full-edition release is `v0.3.101`. The current +macOS Author release is `mac-v0.3.101-author.1`. Both are published as +prereleases. The package version on `main` is `0.3.101`; the macOS Author +package version is `0.3.101-author.1`. If you've ever maintained a security baseline by editing GPO templates, exporting Defender for Endpoint settings to a spreadsheet, or copy-pasting between half a dozen runbooks - this app is for you. diff --git a/docs/src/operations/ci.md b/docs/src/operations/ci.md index 8a9dd14..0175656 100644 --- a/docs/src/operations/ci.md +++ b/docs/src/operations/ci.md @@ -13,12 +13,12 @@ ConfigForge uses GitHub Actions from `.github/workflows/`. The product is an Ele The Win/Linux Release workflow intentionally ignores hyphen-suffix tags (`!v*-*`). macOS Author releases use separate tags such as -`mac-v0.3.98-author.1`; dispatch the protected `main` workflow definition +`mac-v0.3.101-author.1`; dispatch the protected `main` workflow definition manually and let its checkout step select the immutable macOS tag. ## What `pr-check.yml` runs -Three jobs run in parallel: +Four jobs run in parallel: 1. **Lint** (`ubuntu-latest`) - run the dependency-free public-asset and package-lock registry guard with its Node tests, then `npm ci` and @@ -28,6 +28,9 @@ Three jobs run in parallel: `npm test`, `npm run desktop:build`, then smoke-checks the built renderer/main/preload files. 3. **Playwright Electron smoke** (`windows-latest`) - installs, builds the desktop app, generates icons, then runs `npx playwright test --config apps/desktop/playwright.config.ts`. +4. **Node 24 source-build compatibility** (`ubuntu-latest`) - installs with + Node 24, builds core and the desktop app, and verifies the Vite config can + load without optimizer compatibility failures. Test counts change as features land. Use the current `npm test` summary as the authority. For reference, macOS parity PR #75 passed 1,584 Vitest tests in 117 @@ -36,10 +39,9 @@ tests. Mac port PR #77 passed 79 focused tests and two isolated Playwright scenarios. The prior `mac-v0.3.94-author.1` draft release remains unpublished; workflow run [#30233283418](https://github.com/Azure/ConfigForge/actions/runs/30233283418) -verified its five assets. The current macOS Author tagged source is -`mac-v0.3.98-author.1`; its matching GitHub release remains an unpublished -draft. Use current GitHub checks and release metadata as the authority for -build and asset status. +verified its five assets. The current macOS Author release is +`mac-v0.3.101-author.1`, published as a prerelease. Use current GitHub checks +and release metadata as the authority for build and asset status. Caching covers npm, Electron binaries, electron-builder, and Playwright browser downloads. Concurrency cancels stale PR runs on the same branch. @@ -73,7 +75,7 @@ the immutable macOS tag: gh workflow run "Release (macOS author)" \ --repo Azure/ConfigForge \ --ref main \ - -f release_tag=mac-v0.3.98-author.1 + -f release_tag=mac-v0.3.101-author.1 ``` The target draft release and tag must already exist. The workflow loads its @@ -81,22 +83,17 @@ definition from `main`, checks out `release_tag`, verifies that `HEAD` resolves to the tag, checks that tagged tree with the dependency-free public-asset guard from protected `main`, then builds with `electron-builder.author.yml`. -For `mac-v0.3.98-author.1`, it uses exactly these expected asset names: +For `mac-v0.3.101-author.1`, it uses exactly these expected asset names: -1. `ConfigForge-Author-0.3.98-author.1-mac-arm64.dmg` -2. `ConfigForge-Author-0.3.98-author.1-mac-arm64.dmg.blockmap` +1. `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg` +2. `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg.blockmap` 3. `latest-mac.yml` 4. `sbom-macos-author.cdx.json` 5. `SHA256SUMS-macos-author.txt` The workflow refuses a published release and never publishes automatically. -For the prior `mac-v0.3.94-author.1` release, workflow run -[#30233283418](https://github.com/Azure/ConfigForge/actions/runs/30233283418) -passed every gate and verified these five assets. The matching GitHub release -exists but remains a draft and is unpublished. The current -`mac-v0.3.98-author.1` tagged source has a matching GitHub release that -remains an unpublished draft; this documentation does not assert asset -availability or publication. +The current `mac-v0.3.101-author.1` release is published only after the five +uploaded assets and their metadata pass validation. ## Linux runner notes diff --git a/docs/src/quick-start/first-manifest.md b/docs/src/quick-start/first-manifest.md index 91f3516..95dd406 100644 --- a/docs/src/quick-start/first-manifest.md +++ b/docs/src/quick-start/first-manifest.md @@ -16,9 +16,9 @@ resources: - name: hello-cfs-registry type: Microsoft.Windows/Registry properties: - keyPath: HKLM\Software\ConfigForge + keyPath: HKLM:\Software\ConfigForge valueName: HelloFromCFS - valueType: String + valueType: REG_SZ value: "1" ``` diff --git a/docs/src/quick-start/install-run.md b/docs/src/quick-start/install-run.md index 9e438b3..33ef2a2 100644 --- a/docs/src/quick-start/install-run.md +++ b/docs/src/quick-start/install-run.md @@ -8,16 +8,16 @@ Benchmark Mapping, history, rationale, and Audit Pack export while omitting device operations. The native `oscfg` CLI is **not bundled** and is **not required** for authoring in either edition. -The current Windows/Linux Full-edition tagged source is `v0.3.98`. The -current macOS Author tagged source is `mac-v0.3.98-author.1`. Both matching -GitHub releases remain unpublished drafts. The package version on `main` is -`0.3.98`; the macOS Author package version is `0.3.98-author.1`. +The current Windows/Linux Full-edition release is `v0.3.101`. The current +macOS Author release is `mac-v0.3.101-author.1`. Both are published as +prereleases. The package version on `main` is `0.3.101`; the macOS Author +package version is `0.3.101-author.1`. ## Prerequisites | Requirement | Notes | | --- | --- | -| **Node.js 22 LTS** | The repo pins Node 22 via `.nvmrc`. Run `nvm use` (or upgrade your Node) so `node --version` reports `v22`. | +| **Node.js 22.12+ or 24** | The repo pins Node 22.12 via `.nvmrc` and also validates source builds on Node 24. | | **`oscfg` CLI binary** *(optional)* | Only needed for Deploy / Audit / Revert in the Full edition. Install separately from the [OSConfig CLI docs](https://github.com/microsoft/osconfig/tree/main/docs/cli). | | **Admin / root** *(optional)* | Required on Windows for *every* CLI operation (preview-CLI bug - see [Operations → Filing upstream bugs](../operations/upstream-bugs.md)). On Linux, only `oscfg apply` needs `sudo`. | @@ -30,8 +30,7 @@ cd ConfigForge > **Note:** `main` is the active Windows/Linux Full-edition line. On an Apple > Silicon Mac (M1 or later), build the current -> `mac-v0.3.98-author.1` tagged source. Its matching release remains an -> unpublished draft. Intel Macs and universal binaries are not supported. +> `mac-v0.3.101-author.1` release. Intel Macs and universal binaries are not supported. > macOS release builds are unsigned by design. Clear quarantine after > copying the app into Applications: > diff --git a/docs/src/reference/manifest-schema.md b/docs/src/reference/manifest-schema.md index d2f7a24..4654aed 100644 --- a/docs/src/reference/manifest-schema.md +++ b/docs/src/reference/manifest-schema.md @@ -77,22 +77,51 @@ resources: - name: NTLMOutgoingHardening type: Microsoft.Windows/Registry properties: - keyPath: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 + keyPath: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 valueName: NtlmMinClientSec - valueType: Dword + valueType: REG_DWORD value: 537395200 ``` -### Legal `valueType` values and matching `value` shapes +### Canonical `valueType` values and matching `value` shapes -The shipped schema accepts **both** the modern OSConfig names and -the legacy `REG_*` names. The pairing rules are: +Registry `valueType` behavior: + +- **Upstream contract:** The current microsoft/osconfig `schema/.document.json` + defines only `REG_DWORD` and `REG_QWORD` in its integer enum and + `REG_MULTI_SZ` in its array enum. +- **Published examples:** Upstream `docs/resources/windows/Registry.md`, + `examples/registry.osc.yaml`, and Microsoft Learn set/test/quickstart files + use `REG_*` names. +- **Compatibility inputs:** The editor accepts aliases such as `Dword` and + `String` when opening older content. +- **Execution boundary:** ConfigForge normalizes every known alias to `REG_*`. +- **Provider behavior:** Observed provider versions can return success for a + compatibility alias without applying the registry value. + +The canonical pairing rules are: | `valueType` | `value` JSON type | | --- | --- | -| `String`, `ExpandString`, `Binary`, `REG_SZ`, `REG_EXPAND_SZ`, `REG_BINARY` | `string` | -| `Dword`, `QWord`, `REG_DWORD`, `REG_QWORD` | `integer` | -| `MultiString`, `REG_MULTI_SZ` | `array` of `string` | +| `REG_SZ`, `REG_EXPAND_SZ`, `REG_BINARY` | `string` | +| `REG_DWORD`, `REG_QWORD` | `integer` | +| `REG_MULTI_SZ` | `array` of `string` | + +ConfigForge maps compatibility aliases before execution: + +| Compatibility input | Canonical output | +| --- | --- | +| `String` | `REG_SZ` | +| `ExpandString` | `REG_EXPAND_SZ` | +| `Binary` | `REG_BINARY` | +| `Dword`, `REG_DWORD_LITTLE_ENDIAN` | `REG_DWORD` | +| `QWord`, `REG_QWORD_LITTLE_ENDIAN` | `REG_QWORD` | +| `MultiString` | `REG_MULTI_SZ` | +| `None` | `REG_NONE` | + +`REG_DWORD_BIG_ENDIAN` is not rewritten because changing its byte order would +change the requested Registry semantics. It remains unchanged so the installed +OSConfig provider can reject it explicitly if unsupported. A `value` whose type doesn't match the `valueType` category will fail the editor JSON-Schema `oneOf` constraint. The core register @@ -100,9 +129,9 @@ validator is intentionally lighter and only enforces manifest shape. > The CSV / security-definition import (`packages/core/src/handlers/import.ts`) > calls `inferRegistryValueType(expectedValue)` to satisfy the -> `valueType` requirement automatically - integer-shaped strings or -> numbers become `Dword`, everything else becomes `String`. Adding -> new import sources? Re-use that helper. +> `valueType` requirement automatically. Integers in the DWORD range become +> `REG_DWORD`. Larger exact integers become `REG_QWORD`. Other values become +> `REG_SZ`. New import sources should re-use that helper. ## `Microsoft.OSConfig/BaselineRule` placeholder (v0.2.2+) diff --git a/docs/src/reference/registered-types.md b/docs/src/reference/registered-types.md index 17bbc50..99420ef 100644 --- a/docs/src/reference/registered-types.md +++ b/docs/src/reference/registered-types.md @@ -21,7 +21,7 @@ order). | Type | Notes | | --- | --- | | `Microsoft.Windows/CSP` | Configuration Service Provider - the OMA-DM-style policy surface. | -| `Microsoft.Windows/Registry` | Registry value - `keyPath` + `valueName` + `valueType` (use `Dword` / `String` / … or the legacy `REG_*` names) + `value`. All three of `keyPath`, `valueName`, `valueType` are schema-required. | +| `Microsoft.Windows/Registry` | Registry value - `keyPath` + `valueName` + `valueType` + `value`. Use the `REG_*` forms defined by the current upstream `schema/.document.json`, `docs/resources/windows/Registry.md`, `examples/registry.osc.yaml`, and Microsoft Learn set/test/quickstart files. Compatibility aliases are normalized before execution. All three of `keyPath`, `valueName`, and `valueType` are schema-required. | | `Microsoft.Windows/AccountPolicy` | Password / lockout policies. | | `Microsoft.Windows/AuditPolicy` | Audit subcategories. | | `Microsoft.Windows/UserRightsAssignment` | `Se*Privilege` / `Se*Right` user rights. | diff --git a/docs/src/user-guide/machine-configuration.md b/docs/src/user-guide/machine-configuration.md index 78a34ac..f56be66 100644 --- a/docs/src/user-guide/machine-configuration.md +++ b/docs/src/user-guide/machine-configuration.md @@ -18,12 +18,13 @@ configuration. | Package or policy mode | Purpose | Current guidance | | ---------------------------------------------------- | ---------------------------------------------- | --------------------------------------------------------------------------- | | `Audit` | Report compliance without changing the machine | Recommended default | -| `AuditAndSet` package + `ApplyAndMonitor` policy | Apply once during remediation, then monitor | Use only with a Microsoft.OSConfig version whose `Set()` path you validated | -| `AuditAndSet` package + `ApplyAndAutoCorrect` policy | Reapply whenever drift is detected | Use only with a validated Microsoft.OSConfig remediation path | +| `AuditAndSet` package + `ApplyAndMonitor` policy | Apply once during remediation, then monitor | Build with ConfigForge's package helper and validate on a disposable machine | +| `AuditAndSet` package + `ApplyAndAutoCorrect` policy | Reapply whenever drift is detected | Build with ConfigForge's package helper and validate on a disposable machine | -Microsoft.OSConfig 1.3.11 audits ConfigForge packages successfully, but its -PowerShell DSC resource has an upstream `Set()` serialization defect. The -examples below therefore use `Audit`. +Microsoft.OSConfig 1.4.3 audits ConfigForge packages successfully, but its +PowerShell DSC resource has an upstream `Set()` serialization defect. +ConfigForge's package helper applies a compatibility patch to the package copy +for `AuditAndSet`; the globally installed module remains unchanged. ## Prerequisites @@ -128,22 +129,31 @@ Do not replace `ModuleName = "Microsoft.OSConfig"`. ## 3. Create the package -Create an Audit package: +Create packages through ConfigForge's package helper: ```powershell -Import-Module GuestConfiguration - -$Package = New-GuestConfigurationPackage ` +$Package = & .\scripts\new-machine-configuration-package.ps1 ` -Name $PackageName ` -Configuration $ResolvedMofPath ` -Type Audit ` -Path $WorkingDirectory ` - -Force + -Version 1.0.0 $PackagePath = $Package.Path Get-Item $PackagePath ``` +For enforcement, use `-Type AuditAndSet`. The helper patches the package copy +of Microsoft.OSConfig's DSC `Set()` boundary so Registry properties are passed +to `oscfg` as compressed JSON. Microsoft.OSConfig 1.4.3 otherwise converts the +property object to a PowerShell hashtable string such as `@{keyPath=...}`, +which the Registry provider rejects as missing `keyPath`. + +The helper does not modify the globally installed PowerShell module. It fails +closed if either expected wrapper copy is missing or no longer matches the +known vulnerable/fixed implementation. Remove this compatibility patch after +an upstream Microsoft.OSConfig release includes the JSON serialization fix. + The ZIP contains: - The resolved MOF. @@ -168,9 +178,7 @@ baseline. For example, the ConfigForge Windows Server 2025 Workgroup Member baseline produces 296 resource results. -If you use a newer Microsoft.OSConfig version with a validated remediation -path, recreate the package as `AuditAndSet`, then test remediation only on a -disposable machine: +For an `AuditAndSet` package, test remediation only on a disposable machine: ```powershell Start-GuestConfigurationPackageRemediation ` @@ -369,7 +377,7 @@ show NonCompliant while the guest assignment is still Pending. | `Microsoft.OSConfig` cannot be found | Install it in the PowerShell 7 module path and recreate the ZIP. | | More than one Microsoft.OSConfig version is installed | The resolution step selects the newest version. Remove older copies if you require a different deterministic version. | | Runtime says module version `0.0.0` does not exist | Package the resolved MOF, not the portable exported MOF. | -| Package audits but remediation does not change values on Microsoft.OSConfig 1.3.11 | Use Audit or package with a newer version whose `Set()` path you validated. | +| Deployment reports `missing field keyPath` with properties like `{"@{keyPath": ...}` | Recreate the `AuditAndSet` ZIP with `scripts/new-machine-configuration-package.ps1`; vanilla Microsoft.OSConfig 1.4.3 packages retain the upstream DSC serialization defect. | | Local compliance fails with access errors | Run PowerShell 7 elevated or through `sudo`. | | Package download returns HTTP 403 | Renew the SAS URI or correct Storage Blob Data Reader access. | | The extension rejects the package hash | Upload a new ZIP and regenerate the policy. Do not alter the existing ZIP. | diff --git a/docs/src/user-guide/manifest-editor.md b/docs/src/user-guide/manifest-editor.md index 71a1d04..59afdd3 100644 --- a/docs/src/user-guide/manifest-editor.md +++ b/docs/src/user-guide/manifest-editor.md @@ -66,8 +66,8 @@ a newline for structured values. > JSON path also dropped `valueName`), so the schema validator flagged > every imported row as invalid the moment the editor opened it. The > importer now infers `valueType` from `expectedValue` via -> `inferRegistryValueType()`: integer-shaped values → `Dword`, -> everything else → `String`. +> `inferRegistryValueType()`: DWORD-range integers → `REG_DWORD`, larger +> exact integers → `REG_QWORD`, and other values → `REG_SZ`. ## Resource wrappers diff --git a/package-lock.json b/package-lock.json index 6dd6fa5..495b60d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,13 @@ { "name": "configforge", - "version": "0.3.98-author.1", + "version": "0.3.101-author.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "configforge", - "version": "0.3.98-author.1", + "version": "0.3.101-author.1", + "hasInstallScript": true, "license": "MIT", "workspaces": [ "apps/*", @@ -19,7 +20,7 @@ "@testing-library/react": "^16.3.2", "@testing-library/user-event": "^14.6.1", "@types/node": "^22.10.5", - "dompurify": "^3.4.12", + "dompurify": "^3.4.13", "eslint-config-prettier": "10.1.8", "jsdom": "^29.1.1", "prettier": "3.8.3", @@ -33,7 +34,7 @@ }, "apps/desktop": { "name": "@configforge/desktop", - "version": "0.3.98-author.1", + "version": "0.3.101-author.1", "license": "MIT", "dependencies": { "@fluentui/react-components": "^9.73.8", @@ -43,7 +44,7 @@ "electron-updater": "6.8.9", "i18next": "^25.0.0", "i18next-browser-languagedetector": "^8.0.0", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "monaco-editor": "^0.55.1", "pdfkit": "^0.18.0", "react-i18next": "^15.0.0" @@ -69,7 +70,7 @@ "postcss": "^8.5.23", "react": "^18.3.1", "react-dom": "^18.3.1", - "react-router-dom": "^7.18.0", + "react-router-dom": "^7.18.2", "sharp": "0.35.0", "tailwindcss": "^3.4.19", "typescript": "^5.7.3", @@ -761,6 +762,13 @@ "jiti": "lib/jiti-cli.mjs" } }, + "apps/desktop/node_modules/json-schema-traverse": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz", + "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==", + "dev": true, + "license": "MIT" + }, "apps/desktop/node_modules/jsonfile": { "version": "6.2.1", "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz", @@ -833,9 +841,9 @@ } }, "apps/desktop/node_modules/node-gyp/node_modules/undici": { - "version": "6.27.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz", - "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==", + "version": "6.28.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz", + "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==", "dev": true, "license": "MIT", "engines": { @@ -955,13 +963,13 @@ } }, "apps/desktop/node_modules/react-router-dom": { - "version": "7.18.0", - "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.18.0.tgz", - "integrity": "sha512-Fi0yY6kgtKae/Th2xibdWK0KSdYZ4B53Gyf6wRtomOKWgpNm7H7+DyfDhncdz9FKbpS+1jmDhg3F4WoGJ+yFOA==", + "version": "7.18.2", + "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.18.2.tgz", + "integrity": "sha512-AIKJ/jgGlFb3EbfCXk5Gzshiwt+l3mqbCrNjmEWMMjqQxNJ3svBa6bgzFyCC2Sw3RA0VWF1kg3uQf2OFhxb8hw==", "dev": true, "license": "MIT", "dependencies": { - "react-router": "7.18.0" + "react-router": "7.18.2" }, "engines": { "node": ">=20.0.0" @@ -972,9 +980,9 @@ } }, "apps/desktop/node_modules/react-router-dom/node_modules/react-router": { - "version": "7.18.0", - "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.18.0.tgz", - "integrity": "sha512-pTTGt8J+ji1NOmYnjzT+bAJy/1zD+Jp4ziO6cL7T3ZLvXKtusO7BpFqlRXitqpcPVqllsIXFHRMt+2/k3Xn6HQ==", + "version": "7.18.2", + "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.18.2.tgz", + "integrity": "sha512-aUVMjFm3GAPTTZL7oYr5E7ETiqfQCHRLH+B+5afnICvf0r7kkK4eR6SMuwbSTJw/7t+12khT/Kahij49fqOCIg==", "dev": true, "license": "MIT", "dependencies": { @@ -7720,9 +7728,9 @@ "peer": true }, "node_modules/dompurify": { - "version": "3.4.12", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz", - "integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==", + "version": "3.4.13", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.13.tgz", + "integrity": "sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" @@ -8481,9 +8489,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.4", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", - "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", + "version": "3.1.5", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", + "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", "dev": true, "funding": [ { @@ -9412,9 +9420,9 @@ "optional": true }, "node_modules/ip-address": { - "version": "10.2.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", - "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "version": "10.4.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz", + "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==", "dev": true, "license": "MIT", "optional": true, @@ -9608,9 +9616,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha1-0ZAFcqf3zwtfVAyDZz5gutNDZZI=", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github", @@ -13114,9 +13122,9 @@ } }, "node_modules/undici": { - "version": "7.28.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz", - "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==", + "version": "7.29.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", + "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", "dev": true, "license": "MIT", "engines": { @@ -13833,7 +13841,7 @@ "license": "MIT", "dependencies": { "fast-xml-parser": "^5.8.0", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "pdfkit": "^0.18.0", "react": "^18.3.1", "zustand": "^5.0.2" diff --git a/package.json b/package.json index 27d2901..54fdd06 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "configforge", - "version": "0.3.98-author.1", + "version": "0.3.101-author.1", "private": true, "license": "MIT", "description": "ConfigForge \u2014 Cross-platform Electron desktop app for OSConfig security baseline authoring", @@ -46,7 +46,7 @@ "@testing-library/react": "^16.3.2", "@testing-library/user-event": "^14.6.1", "@types/node": "^22.10.5", - "dompurify": "^3.4.12", + "dompurify": "^3.4.13", "eslint-config-prettier": "10.1.8", "jsdom": "^29.1.1", "prettier": "3.8.3", @@ -61,8 +61,8 @@ "brace-expansion@2": "2.1.2", "brace-expansion@5": "5.0.8", "esbuild": "^0.28.1", - "js-yaml": "^4.3.0", - "undici@7": "^7.28.0", - "undici@6": "^6.27.0" + "js-yaml": "^4.3.1", + "undici@7": "^7.29.0", + "undici@6": "^6.28.0" } } diff --git a/packages/core/package.json b/packages/core/package.json index e24ca22..7f001ac 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -42,7 +42,7 @@ }, "dependencies": { "fast-xml-parser": "^5.8.0", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "pdfkit": "^0.18.0", "react": "^18.3.1", "zustand": "^5.0.2" diff --git a/packages/core/src/ai/analyzer.ts b/packages/core/src/ai/analyzer.ts index 14c23bd..462a9fc 100644 --- a/packages/core/src/ai/analyzer.ts +++ b/packages/core/src/ai/analyzer.ts @@ -1,7 +1,10 @@ // Copyright (c) Microsoft Corporation. All rights reserved. // Licensed under the MIT License. -import yaml from "js-yaml"; +import { + parseLosslessYaml, + stringifyLosslessJson, +} from "../manifest/lossless"; import { type AiSource, type Provenance, @@ -165,7 +168,7 @@ function isComplianceOnlyField(field: string): boolean { function parseManifest(content: string, label: string): ParsedResource[] { let doc: Record | null; try { - doc = yaml.load(content) as Record | null; + doc = parseLosslessYaml(content) as Record | null; } catch (err) { const message = err instanceof Error ? err.message : 'unknown YAML parse error'; throw new Error(`Invalid ${label} manifest YAML: ${message}`); @@ -564,7 +567,7 @@ export function analyzeDiff(before: string, after: string): DiffAnalysis { if (isCrossType) { const bVal = extractEnforcementValue(beforeRes); const aVal = extractEnforcementValue(afterRes); - if (JSON.stringify(bVal) !== JSON.stringify(aVal)) { + if (stringifyLosslessJson(bVal) !== stringifyLosslessJson(aVal)) { changedResources.push({ name: resourceLabel, field: "value", from: bVal, to: aVal }); changeResourceRefs.push(afterRes); } @@ -586,7 +589,7 @@ export function analyzeDiff(before: string, after: string): DiffAnalysis { for (const field of Array.from(allFields)) { const bVal = beforeFlat[field]; const aVal = afterFlat[field]; - if (JSON.stringify(bVal) !== JSON.stringify(aVal)) { + if (stringifyLosslessJson(bVal) !== stringifyLosslessJson(aVal)) { changedResources.push({ name: resourceLabel, field, from: bVal, to: aVal }); changeResourceRefs.push(afterRes); } @@ -777,9 +780,9 @@ export function detectConflicts( // ship the same set in different order should not show as // conflicting, so sort string-array elements before serializing. if (Array.isArray(v) && v.every((x) => typeof x === 'string')) { - return JSON.stringify([...(v as string[])].sort()); + return stringifyLosslessJson([...(v as string[])].sort()) ?? ''; } - return JSON.stringify(v); + return stringifyLosslessJson(v) ?? ''; }; const isConflictBucket = (entries: Entry[]): boolean => { @@ -903,7 +906,7 @@ export function explainDelta( const bLabel = formatValue(valueB); // Same value → no delta to explain. - if (JSON.stringify(valueA) === JSON.stringify(valueB)) { + if (stringifyLosslessJson(valueA) === stringifyLosslessJson(valueB)) { return { explanation: `${aName} and ${bName} both set ${rule.name} to ${aLabel}; no delta.`, confidence: 1, @@ -1017,7 +1020,7 @@ function formatValue(v: unknown): string { if (v === null) return 'null'; if (typeof v === 'string') return v; if (typeof v === 'number' || typeof v === 'boolean') return String(v); - return JSON.stringify(v); + return stringifyLosslessJson(v) ?? String(v); } /** diff --git a/packages/core/src/cis/compliance.ts b/packages/core/src/cis/compliance.ts index 8e8ffec..07a00a1 100644 --- a/packages/core/src/cis/compliance.ts +++ b/packages/core/src/cis/compliance.ts @@ -20,6 +20,7 @@ * score — round(matched / cisRules * 100); 0 if cisRules == 0 */ import { extractResourcesFull } from '../platform'; +import { stringifyLosslessJson } from '../manifest/lossless'; import { findCisRulesForResources, type CrossRefMatch } from './crossref'; export type ComplianceStatus = 'matched' | 'mismatched' | 'missing'; @@ -293,8 +294,10 @@ export function reportToMarkdown( out.push('| Status | Severity | Rule | GPO Path | My Value | Expected |'); out.push('| --- | --- | --- | --- | --- | --- |'); for (const r of report.perRule) { - const my = r.myValue === undefined ? '' : '`' + JSON.stringify(r.myValue) + '`'; - const exp = r.expected === undefined ? '' : '`' + JSON.stringify(r.expected) + '`'; + const my = + r.myValue === undefined ? '' : '`' + (stringifyLosslessJson(r.myValue) ?? '') + '`'; + const exp = + r.expected === undefined ? '' : '`' + (stringifyLosslessJson(r.expected) ?? '') + '`'; const gpo = r.gpoPath ? r.gpoPath.replace(/\\/g, '\\\\').replace(/\|/g, '\\|') : ''; const name = r.ruleName.replace(/\\/g, '\\\\').replace(/\|/g, '\\|'); out.push(`| ${r.status} | ${r.severity} | ${name} | ${gpo} | ${my} | ${exp} |`); diff --git a/packages/core/src/diff/matrix.test.ts b/packages/core/src/diff/matrix.test.ts index ff01f6f..b01fb8c 100644 --- a/packages/core/src/diff/matrix.test.ts +++ b/packages/core/src/diff/matrix.test.ts @@ -71,6 +71,24 @@ describe('buildMatrix — status classification', () => { expect(m[0].values.WS2025.status).toBe('differs'); }); + it('treats decimal strings as equivalent to numeric values', () => { + const m = buildMatrix([ + { name: 'text', doc: doc(reg('NumericText', '24')) }, + { name: 'number', doc: doc(reg('NumericText', 24)) }, + ]); + + expect(m[0].status).toBe('identical'); + }); + + it('does not coerce quoted hexadecimal strings into numbers', () => { + const m = buildMatrix([ + { name: 'text', doc: doc(reg('HexText', '0x10')) }, + { name: 'number', doc: doc(reg('HexText', 16)) }, + ]); + + expect(m[0].status).toBe('differs'); + }); + it('marks settings present in some baselines as partial', () => { const a = doc(reg('MaxAuthTries', 3), reg('LegalNotice', 'A')); const b = doc(reg('MaxAuthTries', 3)); diff --git a/packages/core/src/diff/matrix.ts b/packages/core/src/diff/matrix.ts index 3de2ac2..8fd9646 100644 --- a/packages/core/src/diff/matrix.ts +++ b/packages/core/src/diff/matrix.ts @@ -27,6 +27,8 @@ * `fast-xml-parser` which break the browser/Electron-renderer bundle. * The function is a pure string transform; keep a local copy. */ +import { stringifyLosslessJson } from '../manifest/lossless'; + function splitPascalCase(s: string): string[] { return s .replace(/([A-Z]+)([A-Z][a-z])/g, '$1 $2') // ABBR+Word boundary @@ -38,6 +40,7 @@ function splitPascalCase(s: string): string[] { } const MAX_DEPTH = 50; +const DECIMAL_INTEGER_PATTERN = /^[+-]?[0-9]+$/; export type CellStatus = | 'identical' // value matches the first non-empty baseline value @@ -727,7 +730,16 @@ function canonicalize(v: unknown): unknown { // try numeric coercion so '24' equals 24. if (typeof v === 'string') { const trimmed = v.trim(); - if (/^-?\d+(\.\d+)?$/.test(trimmed)) return Number(trimmed); + // Quoted hexadecimal/binary/octal values are strings, not numeric + // literals. Only coerce decimal text so "0x10" does not equal 16. + if (DECIMAL_INTEGER_PATTERN.test(trimmed)) { + const integer = BigInt(trimmed); + return integer >= BigInt(Number.MIN_SAFE_INTEGER) && + integer <= BigInt(Number.MAX_SAFE_INTEGER) + ? Number(integer) + : integer; + } + if (/^-?\d+\.\d+$/.test(trimmed)) return Number(trimmed); // Path-like strings (containing backslashes) collapse doubled // backslashes and strip trailing ones so "Foo\\Bar\\" == "Foo\Bar". // Catches Windows Firewall logging-name paths that come from CSP @@ -757,7 +769,7 @@ function canonicalize(v: unknown): unknown { } function serialize(value: unknown): string { - return JSON.stringify(canonicalize(value)); + return stringifyLosslessJson(canonicalize(value)) ?? ''; } /** diff --git a/packages/core/src/doc-generator.ts b/packages/core/src/doc-generator.ts index 5cc2a5f..033461a 100644 --- a/packages/core/src/doc-generator.ts +++ b/packages/core/src/doc-generator.ts @@ -1,9 +1,13 @@ // Copyright (c) Microsoft Corporation. All rights reserved. // Licensed under the MIT License. -import yaml from 'js-yaml'; import { getPlatformForType } from './platform'; import { escMdInline, escMdCell, escInlineCode } from './markdown/escape'; +import { + parseLosslessJson, + parseLosslessYaml, + stringifyLosslessJson, +} from './manifest/lossless'; interface Resource { name?: string; @@ -16,6 +20,11 @@ interface Resource { dependsOn?: string | string[]; } +function formatManifestValue(value: unknown): string { + if (typeof value !== 'object' || value === null) return String(value); + return stringifyLosslessJson(value) ?? String(value); +} + function renderResources(resources: Resource[], lines: string[], startIndex: number, indent = ''): number { let idx = startIndex; for (const r of resources) { @@ -46,7 +55,7 @@ function renderResources(resources: Resource[], lines: string[], startIndex: num if (otherProps.length > 0) { lines.push(`${indent}- **Properties:**`); for (const [k, v] of otherProps) { - const val = typeof v === 'object' ? JSON.stringify(v) : String(v); + const val = formatManifestValue(v); lines.push(`${indent} - \`${escInlineCode(k)}\`: ${escMdInline(val)}`); } } @@ -62,13 +71,13 @@ function renderResources(resources: Resource[], lines: string[], startIndex: num lines.push(`${indent}- **Properties:**`); for (const [k, v] of Object.entries(props)) { - const val = typeof v === 'object' ? JSON.stringify(v) : String(v); + const val = formatManifestValue(v); lines.push(`${indent} - \`${escInlineCode(k)}\`: ${escMdInline(val)}`); } } if (hasValue) { - const val = typeof r.value === 'object' ? JSON.stringify(r.value) : String(r.value); + const val = formatManifestValue(r.value); lines.push(`${indent}- **Desired Value:** \`${escInlineCode(val)}\``); } @@ -92,7 +101,9 @@ function renderResources(resources: Resource[], lines: string[], startIndex: num export function generateManifestDoc(content: string, manifestName: string): string { let doc: Record; try { - doc = (content.trimStart().startsWith('{') ? JSON.parse(content) : yaml.load(content)) as Record; + doc = (content.trimStart().startsWith('{') + ? parseLosslessJson(content) + : parseLosslessYaml(content)) as Record; } catch { return `# ${escMdInline(manifestName)}\n\nError: Could not parse manifest content.`; } diff --git a/packages/core/src/handlers/audit-pack.ts b/packages/core/src/handlers/audit-pack.ts index 1bcc426..dc25106 100644 --- a/packages/core/src/handlers/audit-pack.ts +++ b/packages/core/src/handlers/audit-pack.ts @@ -23,7 +23,6 @@ */ import { readFile } from 'node:fs/promises'; import path from 'node:path'; -import yaml from 'js-yaml'; import { getRegistration, getRegistrationSource, @@ -45,6 +44,7 @@ import { readAuditResultForRegistration, type PersistedAuditResult, } from '../manifest/audit-results-store'; +import { parseLosslessYaml } from '../manifest/lossless'; import { _getBaselineCatalog } from './library'; import { HandlerError } from './errors'; @@ -119,8 +119,8 @@ async function tryLoadCompliance( const userYaml = await getRegistrationSource(namespace); if (!userYaml) return undefined; const cisYaml = await readFile(requested, 'utf-8'); - const userDoc = yaml.load(userYaml) as { resources?: unknown }; - const cisDoc = yaml.load(cisYaml) as { resources?: unknown }; + const userDoc = parseLosslessYaml(userYaml) as { resources?: unknown }; + const cisDoc = parseLosslessYaml(cisYaml) as { resources?: unknown }; return await computeCompliance(userDoc, cisDoc); } catch (err) { // eslint-disable-next-line no-console diff --git a/packages/core/src/handlers/compliance-report.ts b/packages/core/src/handlers/compliance-report.ts index 7e086e0..55cb706 100644 --- a/packages/core/src/handlers/compliance-report.ts +++ b/packages/core/src/handlers/compliance-report.ts @@ -15,8 +15,8 @@ */ import { readFile } from 'node:fs/promises'; import path from 'node:path'; -import yaml from 'js-yaml'; import { resolvePublicAsset } from '../runtime/paths'; +import { parseLosslessYaml } from '../manifest/lossless'; import { getRegistrationSource, sanitizeNamespace, @@ -83,7 +83,7 @@ async function computeReport( let myDoc: unknown; let cisDoc: unknown; try { - myDoc = yaml.load(source); + myDoc = parseLosslessYaml(source); } catch (err) { throw new HandlerError( 422, @@ -91,7 +91,7 @@ async function computeReport( ); } try { - cisDoc = yaml.load(baseline.content); + cisDoc = parseLosslessYaml(baseline.content); } catch (err) { throw new HandlerError( 500, diff --git a/packages/core/src/handlers/diff-matrix.test.ts b/packages/core/src/handlers/diff-matrix.test.ts new file mode 100644 index 0000000..8bcba1e --- /dev/null +++ b/packages/core/src/handlers/diff-matrix.test.ts @@ -0,0 +1,44 @@ +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. + +import { beforeEach, describe, expect, it, vi } from 'vitest'; + +vi.mock('../oscfg', async (importOriginal) => { + const actual = await importOriginal(); + return { + ...actual, + getRegistrationSource: vi.fn(), + sanitizeNamespace: vi.fn((name: string) => name.toLowerCase()), + }; +}); + +import { getRegistrationSource } from '../oscfg'; +import { getDiffMatrix } from './diff-matrix'; + +const getRegistrationSourceMock = vi.mocked(getRegistrationSource); + +describe('getDiffMatrix lossless values', () => { + beforeEach(() => { + vi.clearAllMocks(); + }); + + it('does not collapse adjacent unsafe QWord values', async () => { + getRegistrationSourceMock.mockImplementation(async (name) => `resources: + - name: ExactQword + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\\SOFTWARE\\Example + valueName: Exact + valueType: REG_QWORD + value: ${name === 'first' ? '18446744073709551615' : '18446744073709551614'} +`); + + const result = await getDiffMatrix('first,second'); + + expect(result.stats).toMatchObject({ + identical: 0, + differs: 1, + totalRows: 1, + }); + }); +}); diff --git a/packages/core/src/handlers/diff-matrix.ts b/packages/core/src/handlers/diff-matrix.ts index 0d6dd8b..d554c7f 100644 --- a/packages/core/src/handlers/diff-matrix.ts +++ b/packages/core/src/handlers/diff-matrix.ts @@ -10,7 +10,7 @@ */ import { getRegistrationSource, - parseYamlDocument, + parseYamlDocumentLossless, sanitizeNamespace, } from '../oscfg'; import { buildMatrix, type MatrixRow } from '../diff/matrix'; @@ -66,7 +66,7 @@ export async function getDiffMatrix(rawNames: string): Promise if (!yamlText) { return { name, doc: null, missing: true } as const; } - const doc = parseYamlDocument(yamlText) as Record; + const doc = parseYamlDocumentLossless(yamlText) as Record; return { name, doc, missing: false } as const; }), ); diff --git a/packages/core/src/handlers/downloads.test.ts b/packages/core/src/handlers/downloads.test.ts index a09d663..12e2c58 100644 --- a/packages/core/src/handlers/downloads.test.ts +++ b/packages/core/src/handlers/downloads.test.ts @@ -9,18 +9,22 @@ */ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'; -vi.mock('../oscfg', () => ({ - getRegistration: vi.fn(), - getRegistrationSource: vi.fn(), - getResources: vi.fn(), - resourcesToYaml: vi.fn(), - parseYamlDocument: vi.fn((s: string) => { +vi.mock('../oscfg', () => { + const parseYamlDocument = vi.fn((s: string) => { if (!s) return {}; if (s.includes('resources:')) return { resources: [] }; return {}; - }), - sanitizeNamespace: vi.fn((s: string) => s.toLowerCase().replace(/[^a-z0-9-]/g, '-')), -})); + }); + return { + getRegistration: vi.fn(), + getRegistrationSource: vi.fn(), + getResources: vi.fn(), + resourcesToYaml: vi.fn(), + parseYamlDocument, + parseYamlDocumentLossless: parseYamlDocument, + sanitizeNamespace: vi.fn((s: string) => s.toLowerCase().replace(/[^a-z0-9-]/g, '-')), + }; +}); vi.mock('../history', () => ({ getHistory: vi.fn().mockResolvedValue([]), diff --git a/packages/core/src/handlers/export.ts b/packages/core/src/handlers/export.ts index cc91e44..54085ae 100644 --- a/packages/core/src/handlers/export.ts +++ b/packages/core/src/handlers/export.ts @@ -22,7 +22,7 @@ import { getRegistrationSource, sanitizeNamespace, resourcesToYaml, - parseYamlDocument, + parseYamlDocumentLossless, } from '../oscfg'; import { exportToYaml, @@ -31,6 +31,7 @@ import { exportToExcel, exportToAzurePolicy, } from '../import-export'; +import { stringifyLosslessJson } from '../manifest/lossless'; import { HandlerError } from './errors'; export type ExportFormat = 'yaml' | 'json' | 'mof' | 'excel' | 'azurepolicy'; @@ -330,7 +331,9 @@ function flattenResourcesToRows(resources: unknown): Array<{ ? 'object' : typeof val; const valueStr = - typeof val === 'object' && val !== null ? JSON.stringify(val) : String(val); + typeof val === 'object' && val !== null + ? (stringifyLosslessJson(val) ?? String(val)) + : String(val); rows.push({ Name: `${path}.${key}`, Description: `${type} — ${key}`, @@ -369,7 +372,7 @@ export async function exportManifest(req: ExportRequest): Promise | null = null; if (sourceYaml) { try { - const doc = parseYamlDocument(sourceYaml); + const doc = parseYamlDocumentLossless(sourceYaml); if (doc && typeof doc === 'object' && !Array.isArray(doc)) { parsedManifest = doc as Record; } diff --git a/packages/core/src/handlers/import.test.ts b/packages/core/src/handlers/import.test.ts index 0365f14..94d0451 100644 --- a/packages/core/src/handlers/import.test.ts +++ b/packages/core/src/handlers/import.test.ts @@ -33,13 +33,21 @@ vi.mock('../import-export', () => ({ }, ]), inferRegistryValueType: vi.fn((expectedValue: unknown) => { - if ( - (typeof expectedValue === 'number' && Number.isInteger(expectedValue)) || - (typeof expectedValue === 'string' && /^-?\d+$/.test(expectedValue.trim())) + let integer: bigint | null = null; + if (typeof expectedValue === 'bigint') integer = expectedValue; + else if (typeof expectedValue === 'number' && Number.isInteger(expectedValue)) { + if (!Number.isSafeInteger(expectedValue)) return 'REG_QWORD'; + integer = BigInt(expectedValue); + } else if ( + typeof expectedValue === 'string' && + /^-?\d+$/.test(expectedValue.trim()) ) { - return 'Dword'; + integer = BigInt(expectedValue.trim()); } - return 'String'; + if (integer === null) return 'REG_SZ'; + return integer >= -2147483648n && integer <= 4294967295n + ? 'REG_DWORD' + : 'REG_QWORD'; }), buildBaselineManifest: vi.fn((settings: Array>) => ({ manifest: { @@ -50,7 +58,7 @@ vi.mock('../import-export', () => ({ properties: { keyPath: setting.registryPath, valueName: setting.settingName, - valueType: 'Dword', + valueType: 'REG_DWORD', value: 24, }, compliance: { equals: 24 }, @@ -165,6 +173,23 @@ describe('importFile', () => { expect(result.data.resourceCount).toBe(2); }); + it('preserves unsafe QWords at the JSON import boundary', () => { + const result = importFile({ + filename: 'qword.json', + content: + '{"resources":[{"name":"qword","type":"Microsoft.Windows/Registry",' + + '"properties":{"valueType":"REG_QWORD","value":18446744073709551615}}]}', + }); + + expect(result.type).toBe('manifest'); + const exportedManifest = vi.mocked(exportToYaml).mock.calls[0][0] as { + resources: Array<{ properties: { value: unknown } }>; + }; + expect(exportedManifest.resources[0].properties.value).toBe( + 18446744073709551615n, + ); + }); + it('parses .json with Settings array as security-definition', () => { const json = JSON.stringify({ Name: 'w10', @@ -232,8 +257,8 @@ describe('importFile', () => { expect(r.type).toBe('Microsoft.Windows/Registry'); expect(r.properties.keyPath).toBe('HKLM\\Soft'); expect(r.properties.valueName).toBe('PasswordHistory'); - // mocked expectedValue is 24 (integer) → Dword - expect(r.properties.valueType).toBe('Dword'); + // mocked expectedValue is 24 (integer) → REG_DWORD + expect(r.properties.valueType).toBe('REG_DWORD'); expect(r.compliance).toEqual({ equals: 24 }); }); @@ -261,39 +286,44 @@ describe('importFile', () => { // valueName falls back to the setting name when not present in the // security-definition row. expect(r.properties.valueName).toBe('s1'); - // mocked expectedValue is 1 (integer) → Dword - expect(r.properties.valueType).toBe('Dword'); + // mocked expectedValue is 1 (integer) → REG_DWORD + expect(r.properties.valueType).toBe('REG_DWORD'); }); }); describe('inferRegistryValueType', () => { - it('returns Dword for integer numbers', () => { - expect(inferRegistryValueType(0)).toBe('Dword'); - expect(inferRegistryValueType(1)).toBe('Dword'); - expect(inferRegistryValueType(-1)).toBe('Dword'); - expect(inferRegistryValueType(24)).toBe('Dword'); + it('returns REG_DWORD for integer numbers', () => { + expect(inferRegistryValueType(0)).toBe('REG_DWORD'); + expect(inferRegistryValueType(1)).toBe('REG_DWORD'); + expect(inferRegistryValueType(-1)).toBe('REG_DWORD'); + expect(inferRegistryValueType(24)).toBe('REG_DWORD'); + }); + + it('returns REG_DWORD for integer-shaped strings', () => { + expect(inferRegistryValueType('0')).toBe('REG_DWORD'); + expect(inferRegistryValueType(' 42 ')).toBe('REG_DWORD'); + expect(inferRegistryValueType('-7')).toBe('REG_DWORD'); }); - it('returns Dword for integer-shaped strings', () => { - expect(inferRegistryValueType('0')).toBe('Dword'); - expect(inferRegistryValueType(' 42 ')).toBe('Dword'); - expect(inferRegistryValueType('-7')).toBe('Dword'); + it('returns REG_QWORD for integers outside the DWORD range', () => { + expect(inferRegistryValueType('4294967296')).toBe('REG_QWORD'); + expect(inferRegistryValueType(18446744073709551615n)).toBe('REG_QWORD'); }); - it('returns String for non-integer values', () => { - expect(inferRegistryValueType('Enabled')).toBe('String'); - expect(inferRegistryValueType('true')).toBe('String'); // boolean-as-string is not Dword - expect(inferRegistryValueType('1.5')).toBe('String'); // non-integer numeric string - expect(inferRegistryValueType('')).toBe('String'); - expect(inferRegistryValueType(' ')).toBe('String'); - expect(inferRegistryValueType('1e3')).toBe('String'); // scientific notation + it('returns REG_SZ for non-integer values', () => { + expect(inferRegistryValueType('Enabled')).toBe('REG_SZ'); + expect(inferRegistryValueType('true')).toBe('REG_SZ'); // boolean-as-string is not a DWORD + expect(inferRegistryValueType('1.5')).toBe('REG_SZ'); // non-integer numeric string + expect(inferRegistryValueType('')).toBe('REG_SZ'); + expect(inferRegistryValueType(' ')).toBe('REG_SZ'); + expect(inferRegistryValueType('1e3')).toBe('REG_SZ'); // scientific notation }); - it('returns String for undefined / null / non-integer JS numbers / other types', () => { - expect(inferRegistryValueType(undefined)).toBe('String'); - expect(inferRegistryValueType(null)).toBe('String'); - expect(inferRegistryValueType(1.5)).toBe('String'); // floats are not Dword - expect(inferRegistryValueType(true)).toBe('String'); - expect(inferRegistryValueType({})).toBe('String'); + it('returns REG_SZ for undefined / null / non-integer JS numbers / other types', () => { + expect(inferRegistryValueType(undefined)).toBe('REG_SZ'); + expect(inferRegistryValueType(null)).toBe('REG_SZ'); + expect(inferRegistryValueType(1.5)).toBe('REG_SZ'); // floats are not DWORDs + expect(inferRegistryValueType(true)).toBe('REG_SZ'); + expect(inferRegistryValueType({})).toBe('REG_SZ'); }); }); diff --git a/packages/core/src/handlers/import.ts b/packages/core/src/handlers/import.ts index 58576f2..9d5760d 100644 --- a/packages/core/src/handlers/import.ts +++ b/packages/core/src/handlers/import.ts @@ -31,6 +31,7 @@ import { type ParsedSDSetting, type ParsedSecurityDefinition, } from '../import-export'; +import { parseLosslessJson } from '../manifest/lossless'; import { HandlerError } from './errors'; import { xlsxToDelimitedText } from './xlsx-import'; @@ -401,7 +402,7 @@ export function importFile(req: ImportRequest): ImportResult { case 'json': { let parsedJson: unknown; try { - parsedJson = JSON.parse(content); + parsedJson = parseLosslessJson(content); } catch { throw new HandlerError(400, 'File is not valid JSON'); } diff --git a/packages/core/src/handlers/manifests.test.ts b/packages/core/src/handlers/manifests.test.ts index 364f07b..6af09f5 100644 --- a/packages/core/src/handlers/manifests.test.ts +++ b/packages/core/src/handlers/manifests.test.ts @@ -158,6 +158,17 @@ describe('normalizeManifestContent', () => { expect(result.yaml).toContain('a'); }); + it('preserves unsafe QWords while normalizing manifest JSON to YAML', () => { + const result = normalizeManifestContent( + '{"resources":[{"name":"qword","type":"Microsoft.Windows/Registry",' + + '"properties":{"valueType":"REG_QWORD","value":18446744073709551615}}]}', + ); + + expect(result.ok).toBe(true); + expect(result.yaml).toContain('18446744073709551615'); + expect(result.yaml).not.toContain('18446744073709552000'); + }); + it('converts security-definition JSON with Settings array', () => { const json = JSON.stringify({ Name: 'win10-baseline', @@ -713,6 +724,20 @@ describe('registerManifest', () => { expect(saveRegistrationMock.mock.calls[0][0].source).toBe('user'); }); + it('persists exact QWord YAML when registering manifest JSON', async () => { + await registerManifest({ + name: 'qword', + content: + '{"resources":[{"name":"qword","type":"Microsoft.Windows/Registry",' + + '"properties":{"keyPath":"HKLM:\\\\Software\\\\QWord","valueName":"Exact",' + + '"valueType":"REG_QWORD","value":18446744073709551615}}]}', + }); + + const persistedYaml = saveRegistrationMock.mock.calls[0][1]; + expect(persistedYaml).toContain('18446744073709551615'); + expect(persistedYaml).not.toContain('18446744073709552000'); + }); + it('waits for the history snapshot so consecutive saves preserve order', async () => { let markSnapshotStarted!: () => void; let finishSnapshot!: () => void; diff --git a/packages/core/src/handlers/manifests.ts b/packages/core/src/handlers/manifests.ts index f435082..7a32eb1 100644 --- a/packages/core/src/handlers/manifests.ts +++ b/packages/core/src/handlers/manifests.ts @@ -25,7 +25,6 @@ // field that allowed arbitrary host-file reads via a compromised // renderer is no longer honored. Manifests come from `content` // (inline YAML) or `uri` (fetched + SSRF-guarded) only. -import yaml from 'js-yaml'; import { lookup as dnsLookup } from 'node:dns/promises'; import { isIP } from 'node:net'; import { @@ -35,7 +34,6 @@ import { getRegistration, getRegistrationSource, listRegistrations, - parseYamlDocument, REGISTERED_LINUX_TYPES, REGISTERED_WINDOWS_TYPES, sanitizeNamespace, @@ -61,6 +59,11 @@ import { deleteAuditResult, readAuditResultForRegistration, } from '../manifest/audit-results-store'; +import { + dumpLosslessYaml, + parseLosslessJson, + parseLosslessYaml, +} from '../manifest/lossless'; import { deleteHistoryForManifest } from '../history'; import type { OscComplianceSummary } from '../types'; import { HandlerError } from './errors'; @@ -98,6 +101,12 @@ interface NormalizeResult { error?: string; } +function parseManifestYaml(content: string): Record { + const parsed = parseLosslessYaml(content); + if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return {}; + return parsed as Record; +} + /** * Accept YAML, manifest-shaped JSON, or legacy security-definition JSON * and return canonical oscfg manifest YAML. Exported so other handlers @@ -112,7 +121,7 @@ export function normalizeManifestContent(content: string): NormalizeResult { let parsed: unknown; try { - parsed = JSON.parse(content); + parsed = parseLosslessJson(content); } catch (err) { const m = err instanceof Error ? err.message : 'invalid JSON'; return { ok: false, error: `Content looks like JSON but failed to parse: ${m}` }; @@ -122,7 +131,7 @@ export function normalizeManifestContent(content: string): NormalizeResult { if (Array.isArray(parsed)) { return { ok: true, - yaml: yaml.dump( + yaml: dumpLosslessYaml( { $schema: 'https://aka.ms/osc/schemas/prerelease/document.json', resources: parsed }, { indent: 2, lineWidth: 120, noRefs: true, sortKeys: false }, ), @@ -139,7 +148,12 @@ export function normalizeManifestContent(content: string): NormalizeResult { if (Array.isArray(obj.resources)) { return { ok: true, - yaml: yaml.dump(obj, { indent: 2, lineWidth: 120, noRefs: true, sortKeys: false }), + yaml: dumpLosslessYaml(obj, { + indent: 2, + lineWidth: 120, + noRefs: true, + sortKeys: false, + }), }; } @@ -186,7 +200,7 @@ export function normalizeManifestContent(content: string): NormalizeResult { return { ok: true, - yaml: yaml.dump( + yaml: dumpLosslessYaml( { $schema: 'https://aka.ms/osc/schemas/prerelease/document.json', resources }, { indent: 2, lineWidth: 120, noRefs: true, sortKeys: false }, ), @@ -337,7 +351,7 @@ async function buildManifestList( try { const sourceYaml = await readSourceYaml(name); if (sourceYaml) { - const doc = parseYamlDocument(sourceYaml) as Record; + const doc = parseManifestYaml(sourceYaml); const resources = Array.isArray(doc?.resources) ? doc.resources : []; if (!summary) summary = extractResourceSummary(resources); if (!validation) validation = extractValidationSummary(doc); @@ -518,7 +532,7 @@ export async function getManifest( try { const sourceYaml = await readSourceYaml(namespace); if (sourceYaml) { - const doc = parseYamlDocument(sourceYaml) as Record; + const doc = parseManifestYaml(sourceYaml); const resources = Array.isArray(doc?.resources) ? doc.resources : []; if (!summary) summary = extractResourceSummary(resources); if (!validation) validation = extractValidationSummary(doc); @@ -539,13 +553,14 @@ export async function getManifest( const resources = (summary ?? []).map((r) => ({ name: r.name, type: r.type })); const compliance = await readComplianceSummary(reg); + const deployed = Boolean(reg.lastAppliedAt); const data = { Name: namespace, DisplayName: reg.displayName ?? namespace, Source: (reg.source === 'library' ? 'library' : 'oscfg') as 'library' | 'oscfg', RegistrationSource: reg.source, RegistrationSourceId: reg.sourceId ?? null, - Deployed: Boolean(reg.lastAppliedAt), + Deployed: deployed, LastAppliedAt: reg.lastAppliedAt ?? null, LastAuditedAt: reg.lastAuditedAt ?? null, Platform: reg.platform ?? null, @@ -797,7 +812,7 @@ export async function registerManifest( yamlContent = normalized.yaml; // Hard schema validation. - const parsed = parseYamlDocument(yamlContent) as { resources?: unknown[] }; + const parsed = parseManifestYaml(yamlContent) as { resources?: unknown[] }; const schemaErrors = validateManifestSchema(parsed); if (schemaErrors.length) { throw new HandlerError(400, `Invalid manifest schema:\n${schemaErrors.join('\n')}`); @@ -980,7 +995,7 @@ export async function restoreManifest(req: RestoreManifestRequest): Promise }; + return { name, doc: parseYamlDocumentLossless(yamlText) as Record }; }), ); const present = fetched.filter( @@ -121,6 +122,6 @@ function formatCellValue(v: unknown): string | number | boolean | null { if (v === undefined) return ''; if (v === null) return ''; if (typeof v === 'number' || typeof v === 'boolean') return v; - if (typeof v === 'string') return v; - return JSON.stringify(v); + if (typeof v === 'string' || typeof v === 'bigint') return String(v); + return stringifyLosslessJson(v) ?? String(v); } diff --git a/packages/core/src/history/index.ts b/packages/core/src/history/index.ts index 258ab7c..6812c0a 100644 --- a/packages/core/src/history/index.ts +++ b/packages/core/src/history/index.ts @@ -376,7 +376,7 @@ export async function saveSnapshot( await rename(metaTmp, metaFile); } - // 3) Retention sweep — best-effort, never blocks the save success. + // 3) Retention sweep — best-effort and completed before save resolves. // // v0.3.1 (#23): retention is now persisted in the settings store // (`packages/core/src/handlers/settings.ts`) so the user can @@ -385,26 +385,24 @@ export async function saveSnapshot( // `maxRetention()` as a synchronous fallback for callers that // haven't yet been migrated to async, but the actual prune below // resolves through the settings store. - void (async () => { - // Env-var override wins (including 0/-1 to disable pruning) — preserves - // legacy behavior and existing test contracts. When the env var is - // unset, defer to the persisted settings store for the user's choice. - let n: number = maxRetention(); - if (process.env[ENV_MAX_COUNT] === undefined) { - try { - // Lazy import to avoid a circular dep between history and the - // settings handler. - const { resolveHistoryRetention } = await import('../handlers/settings'); - n = await resolveHistoryRetention(); - } catch { - /* fall back to default already in `n` */ - } + // Env-var override wins (including 0/-1 to disable pruning) — preserves + // legacy behavior and existing test contracts. When the env var is + // unset, defer to the persisted settings store for the user's choice. + let n: number = maxRetention(); + if (process.env[ENV_MAX_COUNT] === undefined) { + try { + // Lazy import to avoid a circular dep between history and the + // settings handler. + const { resolveHistoryRetention } = await import('../handlers/settings'); + n = await resolveHistoryRetention(); + } catch { + /* fall back to default already in `n` */ } - await pruneToRetention(dir, n).catch((err) => { - // eslint-disable-next-line no-console - console.warn(`[history] retention sweep failed: ${err instanceof Error ? err.message : err}`); - }); - })(); + } + await pruneToRetention(dir, n).catch((err) => { + // eslint-disable-next-line no-console + console.warn(`[history] retention sweep failed: ${err instanceof Error ? err.message : err}`); + }); return { id, diff --git a/packages/core/src/import-export/baseline.test.ts b/packages/core/src/import-export/baseline.test.ts index 3a61c4b..8d9fecc 100644 --- a/packages/core/src/import-export/baseline.test.ts +++ b/packages/core/src/import-export/baseline.test.ts @@ -2,7 +2,12 @@ // Licensed under the MIT License. import { describe, expect, it } from 'vitest'; -import { buildBaselineManifest, parseComplianceExpression, parseExcelBaseline } from './baseline'; +import { + buildBaselineManifest, + inferRegistryValueType, + parseComplianceExpression, + parseExcelBaseline, +} from './baseline'; describe('parseExcelBaseline', () => { it('parses BOM-prefixed quoted records with embedded commas and newlines', () => { @@ -113,6 +118,24 @@ describe('parseComplianceExpression', () => { /Unsupported compliance expression/, ); }); + + it('preserves unsafe integer literals exactly', () => { + expect(parseComplianceExpression('Equals(18446744073709551615)')).toEqual({ + const: 18446744073709551615n, + }); + }); +}); + +describe('inferRegistryValueType', () => { + it.each([ + [1, 'REG_DWORD'], + ['4294967295', 'REG_DWORD'], + ['4294967296', 'REG_QWORD'], + [18446744073709551615n, 'REG_QWORD'], + ['text', 'REG_SZ'], + ])('infers %s as %s', (value, expected) => { + expect(inferRegistryValueType(value)).toBe(expected); + }); }); describe('buildBaselineManifest', () => { @@ -259,4 +282,61 @@ describe('buildBaselineManifest', () => { }), ); }); + + it('uses QWord when either generic default or expected value exceeds DWORD', () => { + const csv = [ + 'Setting Name,Registry Path,Default Value,Expected Value', + 'WideExpected,HKLM:\\SOFTWARE\\Example,0,18446744073709551615', + ].join('\n'); + + const built = buildBaselineManifest(parseExcelBaseline(csv)); + + expect(built.manifest.resources[0]).toEqual( + expect.objectContaining({ + properties: expect.objectContaining({ + valueType: 'REG_QWORD', + value: 0, + }), + compliance: { equals: 18446744073709551615n }, + }), + ); + }); + + it('keeps inferred generic QWord values exact', () => { + const csv = [ + 'Setting Name,Registry Path,Default Value,Expected Value', + 'ExactQword,HKLM:\\SOFTWARE\\Example,18446744073709551615,18446744073709551614', + ].join('\n'); + + const built = buildBaselineManifest(parseExcelBaseline(csv)); + + expect(built.manifest.resources[0]).toEqual( + expect.objectContaining({ + properties: expect.objectContaining({ + valueType: 'REG_QWORD', + value: 18446744073709551615n, + }), + compliance: { equals: 18446744073709551614n }, + }), + ); + }); + + it('keeps explicit QWord defaults and compliance literals exact', () => { + const csv = [ + 'Name,Registry Key,Registry Value,Registry Value Type,Default Value,Expected Value', + 'ExactQword,HKLM:\\SOFTWARE\\Example,Exact,REG_QWORD,18446744073709551615,Equals(18446744073709551614)', + ].join('\n'); + + const built = buildBaselineManifest(parseExcelBaseline(csv)); + const resource = built.manifest.resources[0] as { + properties: { + resource: { properties: Record }; + schema: Record; + }; + }; + + expect(resource.properties.resource.properties.valueType).toBe('REG_QWORD'); + expect(resource.properties.resource.properties.value).toBe(18446744073709551615n); + expect(resource.properties.schema).toEqual({ const: 18446744073709551614n }); + }); }); diff --git a/packages/core/src/import-export/baseline.ts b/packages/core/src/import-export/baseline.ts index 064c6e4..9a2a97b 100644 --- a/packages/core/src/import-export/baseline.ts +++ b/packages/core/src/import-export/baseline.ts @@ -391,7 +391,10 @@ function parseLiteral(token: string): unknown { if (/^null$/i.test(normalized)) return null; if (/^true$/i.test(normalized)) return true; if (/^false$/i.test(normalized)) return false; - if (/^-?\d+(?:\.\d+)?$/.test(normalized)) return Number(normalized); + if (/^-?\d+$/.test(normalized)) { + return parseExactInteger(normalized, 'Compliance integer'); + } + if (/^-?\d+\.\d+$/.test(normalized)) return Number(normalized); return normalized; } @@ -480,16 +483,25 @@ function deriveDesiredValue(node: ComplianceNode): unknown { } export function inferRegistryValueType(expectedValue: unknown): string { - if (typeof expectedValue === 'number' && Number.isInteger(expectedValue)) { - return 'Dword'; - } - if (typeof expectedValue === 'string') { + let integer: bigint | null = null; + if (typeof expectedValue === 'bigint') { + integer = expectedValue; + } else if (typeof expectedValue === 'number' && Number.isInteger(expectedValue)) { + if (!Number.isSafeInteger(expectedValue)) return 'REG_QWORD'; + integer = BigInt(expectedValue); + } else if (typeof expectedValue === 'string') { const trimmed = expectedValue.trim(); - if (trimmed !== '' && /^-?\d+$/.test(trimmed)) { - return 'Dword'; - } + if (trimmed !== '' && /^-?\d+$/.test(trimmed)) integer = BigInt(trimmed); + } + + if (integer !== null) { + // DWORD accepts the signed policy values commonly authored as negatives + // and the full unsigned 32-bit range. Larger exact integers require QWORD. + return integer >= -2147483648n && integer <= 4294967295n + ? 'REG_DWORD' + : 'REG_QWORD'; } - return 'String'; + return 'REG_SZ'; } function normalizeRegistryValueType(raw: string | undefined, value: unknown): string { @@ -521,8 +533,7 @@ function normalizeRegistryValueType(raw: string | undefined, value: unknown): st return 'REG_SZ'; default: if (Array.isArray(value)) return 'REG_MULTI_SZ'; - if (typeof value === 'number' && Number.isInteger(value)) return 'REG_DWORD'; - return 'REG_SZ'; + return inferRegistryValueType(value); } } @@ -541,6 +552,36 @@ function parseSafeInteger(value: unknown, label: string): number { return parsed; } +function parseExactInteger(value: unknown, label: string): number | bigint { + if (typeof value === 'bigint') { + return value >= BigInt(Number.MIN_SAFE_INTEGER) && + value <= BigInt(Number.MAX_SAFE_INTEGER) + ? Number(value) + : value; + } + if (typeof value === 'number') { + if (!Number.isInteger(value)) { + throw new Error(`${label} must be an integer, found "${value}"`); + } + if (!Number.isSafeInteger(value)) { + throw new Error( + `${label} cannot preserve an unsafe JavaScript number; provide the value as decimal text`, + ); + } + return value; + } + + const text = String(value).trim(); + if (!/^-?\d+$/.test(text)) { + throw new Error(`${label} must be an integer, found "${text}"`); + } + const integer = BigInt(text); + return integer >= BigInt(Number.MIN_SAFE_INTEGER) && + integer <= BigInt(Number.MAX_SAFE_INTEGER) + ? Number(integer) + : integer; +} + function splitListValue(value: unknown): string[] { const normalized = normalizeEmptyMarker(value); if (normalized === '' || normalized === undefined || normalized === null) return []; @@ -572,8 +613,9 @@ function coerceRegistryValue(value: unknown, valueType: string): unknown { const normalized = normalizeEmptyMarker(value); switch (valueType) { case 'REG_DWORD': - case 'REG_QWORD': return parseSafeInteger(normalized, valueType); + case 'REG_QWORD': + return parseExactInteger(normalized, valueType); case 'REG_MULTI_SZ': return splitListValue(normalized); default: @@ -735,19 +777,22 @@ function buildGenericResource(setting: ParsedBaselineSetting): Record value !== undefined) + .map((value) => inferRegistryValueType(value)); + const valueType = inferredTypes.includes('REG_SZ') + ? 'REG_SZ' + : inferredTypes.includes('REG_QWORD') + ? 'REG_QWORD' + : 'REG_DWORD'; const typedValue = rawValue === undefined ? undefined - : valueType === 'Dword' - ? parseSafeInteger(rawValue, 'Dword') - : String(normalizeEmptyMarker(rawValue)); + : coerceRegistryValue(rawValue, valueType); const expectedValue = setting.expectedValue === undefined ? undefined - : valueType === 'Dword' - ? parseSafeInteger(setting.expectedValue, 'Dword') - : String(normalizeEmptyMarker(setting.expectedValue)); + : coerceRegistryValue(setting.expectedValue, valueType); return { name: safeResourceName(setting.settingName), type: 'Microsoft.Windows/Registry', diff --git a/packages/core/src/import-export/index.test.ts b/packages/core/src/import-export/index.test.ts index e8069a4..b8b0a46 100644 --- a/packages/core/src/import-export/index.test.ts +++ b/packages/core/src/import-export/index.test.ts @@ -11,7 +11,60 @@ * of a generic 500. */ import { describe, expect, it } from 'vitest'; -import { parseSecurityDefinition } from './index'; +import { readFile, readdir } from 'node:fs/promises'; +import path from 'node:path'; +import { parseLosslessJson, parseLosslessYaml } from '../manifest/lossless'; +import { + exportToJson, + exportToMof, + exportToYaml, + parseOscYaml, + parseSecurityDefinition, +} from './index'; + +describe('exportToJson', () => { + it('serializes unsafe QWord values without rounding', () => { + const manifest = { + resources: [ + { + type: 'Microsoft.Windows/Registry', + properties: { valueType: 'QWord', value: 18446744073709551615n }, + }, + ], + }; + + const exported = exportToJson(manifest); + + expect(exported).toContain('"value": 18446744073709551615'); + expect(parseLosslessJson(exported)).toEqual(manifest); + }); +}); + +describe('lossless manifest import and export', () => { + it('preserves adjacent unsafe QWords through JSON and YAML exports', () => { + const manifest = { + resources: [ + { + name: 'maximum', + type: 'Microsoft.Windows/Registry', + properties: { valueType: 'QWord', value: 18446744073709551615n }, + }, + { + name: 'adjacent', + type: 'Microsoft.Windows/Registry', + properties: { valueType: 'QWord', value: 18446744073709551614n }, + }, + ], + }; + + const yaml = exportToYaml(manifest); + const reparsed = parseLosslessYaml(yaml) as typeof manifest; + + expect(reparsed).toEqual(manifest); + expect(parseOscYaml(yaml).resources[0].properties.value).toBe(18446744073709551615n); + expect(parseOscYaml(yaml).resources[1].properties.value).toBe(18446744073709551614n); + }); +}); describe('parseSecurityDefinition (PR17 hardening)', () => { it('throws a descriptive Error on malformed JSON', () => { @@ -330,8 +383,6 @@ describe('exportToAzurePolicy structural shape', () => { // `0.0.0` Machine Configuration placeholder. The packaging workflow resolves // it to the customer's newest installed Microsoft.OSConfig version immediately // before New-GuestConfigurationPackage runs. -import { exportToMof } from './index'; - describe('exportToMof — Machine Configuration module binding', () => { const resources = [ { @@ -444,6 +495,88 @@ describe('exportToMof — Machine Configuration module binding', () => { expect(mof).toContain(' Value = "";\n ValueName = "value";\n ValueType = "string";'); }); + it('normalizes legacy Registry syntax before serializing the Machine Configuration package', () => { + const mof = exportToMof('LegacyRegistryBaseline', [ + { + name: 'LegacyRegistry', + type: 'Microsoft.OSConfig/Test', + properties: { + resource: { + type: 'Microsoft.Windows/Registry', + properties: { + keyPath: 'HKLM\\SOFTWARE\\ConfigForge', + valueName: 'Enabled', + valueType: 'Dword', + value: 1, + }, + }, + schema: { const: 1 }, + }, + }, + ]); + + expect(mof).toContain( + 'Properties = "{\\"keyPath\\":\\"HKLM:\\\\\\\\SOFTWARE\\\\\\\\ConfigForge\\",\\"valueName\\":\\"Enabled\\",\\"valueType\\":\\"REG_DWORD\\"}";', + ); + expect(mof).not.toContain('\\"valueType\\":\\"Dword\\"'); + }); + + it('exports every shipped Windows baseline with canonical writable Registry properties', async () => { + const baselineDirectory = path.join( + __dirname, + '..', + '..', + '..', + '..', + 'public', + '_baselines', + ); + const baselineFiles = (await readdir(baselineDirectory)) + .filter((name) => /^ws20(?:16|19|22|25)-.*\.osc\.yaml$/i.test(name)) + .sort(); + + expect(baselineFiles).toHaveLength(12); + + for (const filename of baselineFiles) { + const source = await readFile(path.join(baselineDirectory, filename), 'utf8'); + const manifest = parseOscYaml(source); + const mof = exportToMof(filename, manifest.resources); + const blocks = mof.match(/instance of OSConfig[\s\S]*?\n};/g) ?? []; + + expect(blocks, filename).toHaveLength(manifest.resources.length); + + for (const block of blocks) { + if (!block.includes('Type = "Microsoft.Windows/Registry";')) continue; + const propertiesLine = block.match(/^\s*Properties = "(.*)";$/m)?.[1]; + expect(propertiesLine, filename).toBeDefined(); + const propertiesJson = JSON.parse(`"${propertiesLine}"`) as string; + const properties = parseLosslessJson(propertiesJson) as Record; + + expect( + [ + 'REG_NONE', + 'REG_SZ', + 'REG_EXPAND_SZ', + 'REG_BINARY', + 'REG_DWORD', + 'REG_MULTI_SZ', + 'REG_QWORD', + ], + `${filename}: ${String(properties.valueName ?? '')}`, + ).toContain(properties.valueType); + + if (typeof properties.keyPath === 'string') { + expect( + properties.keyPath, + `${filename}: ${String(properties.valueName ?? '')}`, + ).not.toMatch( + /^(?:HKEY_LOCAL_MACHINE|HKEY_CURRENT_USER|HKEY_USERS|HKEY_CLASSES_ROOT|HKEY_CURRENT_CONFIG|HKLM|HKCU|HKU|HKCR|HKCC)\\/i, + ); + } + } + } + }); + it('still emits the OSConfig DSC resource class and the configuration footer', () => { const mof = exportToMof('LapsBaseline', resources); expect(mof).toContain('instance of OSConfig as $OSConfig0ref'); diff --git a/packages/core/src/import-export/index.ts b/packages/core/src/import-export/index.ts index eb2c5d2..fa88123 100644 --- a/packages/core/src/import-export/index.ts +++ b/packages/core/src/import-export/index.ts @@ -1,7 +1,13 @@ // Copyright (c) Microsoft Corporation. All rights reserved. // Licensed under the MIT License. -import yaml from 'js-yaml'; +import { + dumpLosslessYaml, + parseLosslessJson, + parseLosslessYaml, + stringifyLosslessJson, +} from '../manifest/lossless'; +import { normalizeManifestRegistryTypes } from '../oscfg/registry-types'; import type { SettingConfiguration } from '../types'; export { @@ -82,7 +88,7 @@ export interface ParsedSDSetting { * Parse .osc.yaml content, validate basic schema, return structured manifest. */ export function parseOscYaml(content: string): ParsedManifest { - const doc = yaml.load(content); + const doc = parseLosslessYaml(content); if (!doc || typeof doc !== 'object') { throw new Error('Invalid YAML: document must be an object'); } @@ -151,7 +157,7 @@ function stripSettingNameSuffix(raw: string): string { export function parseSecurityDefinition(jsonStr: string): ParsedSecurityDefinition { let doc: unknown; try { - doc = JSON.parse(jsonStr); + doc = parseLosslessJson(jsonStr); } catch (err) { const m = err instanceof Error ? err.message : 'parse failed'; throw new Error(`Invalid JSON in security definition: ${m}`); @@ -250,7 +256,7 @@ export function parseSecurityDefinition(jsonStr: string): ParsedSecurityDefiniti * Serialize a manifest object to .osc.yaml string. */ export function exportToYaml(manifest: object): string { - return yaml.dump(manifest, { + return dumpLosslessYaml(manifest, { indent: 2, lineWidth: 120, noRefs: true, @@ -262,7 +268,15 @@ export function exportToYaml(manifest: object): string { * Serialize a manifest object to pretty JSON. */ export function exportToJson(manifest: object): string { - return JSON.stringify(manifest, null, 2); + return serializeJson(manifest, 2); +} + +function serializeJson(value: unknown, space?: string | number): string { + const serialized = stringifyLosslessJson(value, space); + if (serialized === undefined) { + throw new TypeError('Value could not be serialized to JSON.'); + } + return serialized; } /** @@ -353,8 +367,9 @@ export function exportToMof( const instances: string[] = []; const configurationName = newUuid(); const correlationGroup = `{${newUuid()}}`; + const normalizedResources = normalizeManifestRegistryTypes(resources); - for (const raw of Array.isArray(resources) ? resources : []) { + for (const raw of Array.isArray(normalizedResources) ? normalizedResources : []) { if (!raw || typeof raw !== 'object') continue; const r = raw as Record; @@ -400,7 +415,7 @@ export function exportToMof( } } - const propsJson = JSON.stringify(props); + const propsJson = serializeJson(props); const lines: string[] = []; lines.push(`instance of OSConfig as $OSConfig${instances.length}ref`); @@ -437,7 +452,7 @@ export function exportToMof( lines.push(` Expression = "${mofEscape(expression)}";`); } if (schema !== undefined) { - lines.push(` Schema = "${mofEscape(JSON.stringify(schema))}";`); + lines.push(` Schema = "${mofEscape(serializeJson(schema))}";`); } if (template) { lines.push(` Template = "${mofEscape(template)}";`); @@ -470,7 +485,7 @@ export function exportToExcel(settings: SettingConfiguration[]): string { const escapeCSV = (val: unknown): string => { if (val === null || val === undefined) return ''; - const str = typeof val === 'object' ? JSON.stringify(val) : String(val); + const str = typeof val === 'object' ? serializeJson(val) : String(val); if (str.includes(',') || str.includes('"') || str.includes('\n')) { return `"${str.replace(/"/g, '""')}"`; } @@ -646,7 +661,7 @@ function extractPolicySettingParams(resources: unknown): PolicySettingParam[] { : typeof defaultValue === 'string' ? defaultValue : typeof defaultValue === 'object' - ? JSON.stringify(defaultValue) + ? serializeJson(defaultValue) : String(defaultValue); // Build a description. Registry/CSP get keyPath+valueName context; @@ -969,5 +984,5 @@ export function exportToAzurePolicy( }, }; - return JSON.stringify(policyDefinition, null, 2); + return serializeJson(policyDefinition, 2); } diff --git a/packages/core/src/manifest-normalize.ts b/packages/core/src/manifest-normalize.ts index fb84632..e799a5e 100644 --- a/packages/core/src/manifest-normalize.ts +++ b/packages/core/src/manifest-normalize.ts @@ -1,7 +1,7 @@ // Copyright (c) Microsoft Corporation. All rights reserved. // Licensed under the MIT License. -import yaml from 'js-yaml'; +import { dumpLosslessYaml, parseLosslessYaml } from './manifest/lossless'; /** * Canonical normalization for manifests so the diff viewer can compare two @@ -46,7 +46,7 @@ function parseManifest(text: string): Record | null { const trimmed = text.trim(); if (!trimmed) return null; try { - const parsed = yaml.load(trimmed); + const parsed = parseLosslessYaml(trimmed); if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null; return parsed as Record; } catch { @@ -190,7 +190,7 @@ export function normalizeManifestForDiff(text: string): string { doc.resources = canon.resources.map(orderResourceKeys); try { - return yaml.dump(doc, { + return dumpLosslessYaml(doc, { lineWidth: 120, noRefs: true, quotingType: '"', diff --git a/packages/core/src/manifest/lossless.test.ts b/packages/core/src/manifest/lossless.test.ts new file mode 100644 index 0000000..de345c4 --- /dev/null +++ b/packages/core/src/manifest/lossless.test.ts @@ -0,0 +1,151 @@ +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. + +import { describe, expect, it } from 'vitest'; +import { + dumpLosslessYaml, + parseLosslessJson, + parseLosslessYaml, + stringifyLosslessJson, +} from './lossless'; + +describe('lossless manifest serialization', () => { + it('keeps adjacent unsafe YAML integers distinct', () => { + const first = parseLosslessYaml('value: 18446744073709551615') as { value: unknown }; + const second = parseLosslessYaml('value: 18446744073709551614') as { value: unknown }; + + expect(first.value).toBe(18446744073709551615n); + expect(second.value).toBe(18446744073709551614n); + expect(first.value).not.toBe(second.value); + }); + + it('dumps unsafe YAML integers without rounding', () => { + expect(dumpLosslessYaml({ value: 18446744073709551615n })).toContain( + '18446744073709551615', + ); + }); + + it('keeps adjacent unsafe JSON integer tokens distinct', () => { + const parsed = parseLosslessJson( + '{"desired":18446744073709551615,"actual":18446744073709551614}', + ) as { desired: unknown; actual: unknown }; + + expect(parsed.desired).toBe(18446744073709551615n); + expect(parsed.actual).toBe(18446744073709551614n); + }); + + it('stringifies bigints as exact JSON integer tokens', () => { + const serialized = stringifyLosslessJson({ value: 18446744073709551615n }); + + expect(serialized).toBe('{"value":18446744073709551615}'); + expect(parseLosslessJson(serialized!)).toEqual({ value: 18446744073709551615n }); + }); + + it('renders nested bigint values without throwing or rounding', () => { + const document = { + outer: { + values: [1, { qword: 18446744073709551615n }], + }, + }; + + const serialized = stringifyLosslessJson(document, 2); + + expect(serialized).toContain('"qword": 18446744073709551615'); + expect(parseLosslessJson(serialized!)).toEqual(document); + }); + + it('serializes shared aliases as values rather than circular placeholders', () => { + const shared = { value: 18446744073709551615n }; + const serialized = stringifyLosslessJson({ first: shared, second: shared }); + + expect(parseLosslessJson(serialized!)).toEqual({ + first: { value: 18446744073709551615n }, + second: { value: 18446744073709551615n }, + }); + }); + + it('renders true cycles safely while preserving exact bigint values', () => { + const cyclic: { value: bigint; self?: unknown } = { + value: 18446744073709551615n, + }; + cyclic.self = cyclic; + + const serialized = stringifyLosslessJson(cyclic); + + expect(serialized).toBe( + '{"value":18446744073709551615,"self":"[Circular]"}', + ); + }); + + it('preserves marker-like strings and keys alongside bigints', () => { + const oldMarker = '\u0000CONFIGFORGE_BIGINT_0'; + const markerLikeKey = '\u0000CONFIGFORGE_BIGINT_1'; + const document = { + [markerLikeKey]: oldMarker, + literal: oldMarker, + qword: 18446744073709551615n, + }; + + const serialized = stringifyLosslessJson(document); + + expect(parseLosslessJson(serialized!)).toEqual(document); + }); + + it('avoids marker strings introduced by toJSON transformations', () => { + const markerLike = '\u0000CONFIGFORGE_BIGINT_0'; + const document = { + toJSON: () => ({ + literal: markerLike, + qword: 18446744073709551615n, + }), + }; + + const serialized = stringifyLosslessJson(document); + + expect(parseLosslessJson(serialized!)).toEqual({ + literal: markerLike, + qword: 18446744073709551615n, + }); + }); + + it('skips many colliding marker candidates without changing literal data', () => { + const baseMarker = '\u0000CONFIGFORGE_BIGINT_'; + const literals = [ + `${baseMarker}0`, + ...Array.from({ length: 128 }, (_value, index) => `${baseMarker}${index + 1}_0`), + ]; + const document = { + literals, + qwords: Array.from( + { length: 256 }, + (_value, index) => 18446744073709551615n - BigInt(index), + ), + }; + + const serialized = stringifyLosslessJson(document); + + expect(parseLosslessJson(serialized!)).toEqual(document); + }); + + it('does not revive a raw JSON string equal to the old fixed marker', () => { + const oldMarker = '\u0000CONFIGFORGE_BIGINT_0'; + const source = + '{"literal":"\\u0000CONFIGFORGE_BIGINT_0","qword":18446744073709551615}'; + + expect(parseLosslessJson(source)).toEqual({ + literal: oldMarker, + qword: 18446744073709551615n, + }); + }); + + it('does not revive a marker assembled from JSON unicode escapes', () => { + const source = + '{"literal":"\\u0000CONFIGFORGE_\\u0042IGINT_18446744073709551615",' + + '"qword":18446744073709551615}'; + + expect(parseLosslessJson(source)).toEqual({ + literal: '\u0000CONFIGFORGE_BIGINT_18446744073709551615', + qword: 18446744073709551615n, + }); + }); +}); diff --git a/packages/core/src/manifest/lossless.ts b/packages/core/src/manifest/lossless.ts new file mode 100644 index 0000000..53242dd --- /dev/null +++ b/packages/core/src/manifest/lossless.ts @@ -0,0 +1,295 @@ +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. + +import yaml, { type DumpOptions } from 'js-yaml'; + +// Renderer code imports this module directly. Keep it browser-safe: no +// node:crypto, node:buffer, or filesystem dependencies. +export const YAML_INTEGER_PATTERN = + /^[+-]?(?:[0-9]+|0b[01]+|0o[0-7]+|0x[0-9a-fA-F]+)$/; + +function constructLosslessInteger(source: string): number | bigint { + const negative = source.startsWith('-'); + const unsigned = source.startsWith('-') || source.startsWith('+') ? source.slice(1) : source; + const integer = BigInt(unsigned) * (negative ? -1n : 1n); + return integer >= BigInt(Number.MIN_SAFE_INTEGER) && integer <= BigInt(Number.MAX_SAFE_INTEGER) + ? Number(integer) + : integer; +} + +const LOSSLESS_INTEGER_TYPE = new yaml.Type('tag:yaml.org,2002:int', { + kind: 'scalar', + resolve: (value: unknown) => typeof value === 'string' && YAML_INTEGER_PATTERN.test(value), + construct: (value: string) => constructLosslessInteger(value), + predicate: (value: unknown) => + typeof value === 'bigint' || (typeof value === 'number' && Number.isInteger(value)), + represent: (value: unknown) => String(value), +}); + +export const LOSSLESS_MANIFEST_SCHEMA = yaml.DEFAULT_SCHEMA.extend({ + implicit: [LOSSLESS_INTEGER_TYPE], +}); + +export function parseLosslessYaml(source: string): unknown { + return yaml.load(source, { schema: LOSSLESS_MANIFEST_SCHEMA }); +} + +export function dumpLosslessYaml(document: unknown, options: DumpOptions = {}): string { + return yaml.dump(document, { + ...options, + schema: LOSSLESS_MANIFEST_SCHEMA, + }); +} + +const BIGINT_JSON_MARKER_STEM = 'CONFIGFORGE_BIGINT_'; +const JSON_NUMBER_PATTERN = /-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/y; +const MAX_STRINGIFY_MARKER_ATTEMPTS = 32; + +function markerForIndex(index: number): string { + return index === 0 + ? `\u0000${BIGINT_JSON_MARKER_STEM}` + : `\u0000${BIGINT_JSON_MARKER_STEM}${index}_`; +} + +function parseCanonicalArrayIndex(source: string): number | null { + if (!/^(?:0|[1-9][0-9]*)$/.test(source)) return null; + const index = Number(source); + return Number.isSafeInteger(index) ? index : null; +} + +function forEachDecodedJsonString( + source: string, + callback: (value: string) => void, +): void { + for (let index = 0; index < source.length; index += 1) { + if (source[index] !== '"') continue; + const start = index; + let escaped = false; + for (index += 1; index < source.length; index += 1) { + const character = source[index]; + if (escaped) { + escaped = false; + continue; + } + if (character === '\\') { + escaped = true; + continue; + } + if (character !== '"') continue; + try { + const value = JSON.parse(source.slice(start, index + 1)) as unknown; + if (typeof value === 'string') callback(value); + } catch { + // The full JSON parse below owns syntax errors. This scan only + // selects a collision-free placeholder for otherwise-valid input. + } + break; + } + } +} + +function selectParseMarker(source: string): string { + let baseMarkerBlocked = false; + const blockedIndexes = new Set(); + forEachDecodedJsonString(source, (candidate) => { + if (!candidate.startsWith(markerForIndex(0))) return; + baseMarkerBlocked = true; + + const suffix = candidate.slice(markerForIndex(0).length); + const separator = suffix.indexOf('_'); + if (separator <= 0) return; + const markerIndex = parseCanonicalArrayIndex(suffix.slice(0, separator)); + if (markerIndex !== null && markerIndex > 0) blockedIndexes.add(markerIndex); + }); + + if (!baseMarkerBlocked) return markerForIndex(0); + for (let index = 1; ; index += 1) { + if (!blockedIndexes.has(index)) return markerForIndex(index); + } +} + +function collectBlockedStringifyMarkers( + observedStrings: ReadonlySet, + bigintCount: number, +): Set { + const blockedIndexes = new Set(); + const baseMarker = markerForIndex(0); + + for (const candidate of observedStrings) { + if (!candidate.startsWith(baseMarker)) continue; + const suffix = candidate.slice(baseMarker.length); + + const baseValueIndex = parseCanonicalArrayIndex(suffix); + if (baseValueIndex !== null && baseValueIndex < bigintCount) { + blockedIndexes.add(0); + continue; + } + + const separator = suffix.indexOf('_'); + if (separator <= 0) continue; + const markerIndex = parseCanonicalArrayIndex(suffix.slice(0, separator)); + const valueIndex = parseCanonicalArrayIndex(suffix.slice(separator + 1)); + if ( + markerIndex !== null && + markerIndex > 0 && + valueIndex !== null && + valueIndex < bigintCount + ) { + blockedIndexes.add(markerIndex); + } + } + + return blockedIndexes; +} + +function replaceBigintPlaceholders( + serialized: string, + marker: string, + bigintValues: readonly string[], +): string | null { + const encodedMarkerPrefix = JSON.stringify(marker).slice(0, -1); + const occurrenceCounts = new Array(bigintValues.length).fill(0); + const chunks: string[] = []; + let copiedThrough = 0; + let searchFrom = 0; + + while (searchFrom < serialized.length) { + const markerStart = serialized.indexOf(encodedMarkerPrefix, searchFrom); + if (markerStart === -1) break; + + const indexStart = markerStart + encodedMarkerPrefix.length; + let indexEnd = indexStart; + while ( + indexEnd < serialized.length && + serialized[indexEnd] >= '0' && + serialized[indexEnd] <= '9' + ) { + indexEnd += 1; + } + + const indexText = serialized.slice(indexStart, indexEnd); + const valueIndex = + serialized[indexEnd] === '"' ? parseCanonicalArrayIndex(indexText) : null; + if (valueIndex === null || valueIndex >= bigintValues.length) { + searchFrom = indexStart; + continue; + } + + occurrenceCounts[valueIndex] += 1; + chunks.push(serialized.slice(copiedThrough, markerStart), bigintValues[valueIndex]); + copiedThrough = indexEnd + 1; + searchFrom = copiedThrough; + } + + if (occurrenceCounts.some((count) => count !== 1)) return null; + chunks.push(serialized.slice(copiedThrough)); + return chunks.join(''); +} + +/** + * JSON.stringify-compatible serializer that emits bigint values as exact JSON + * integer tokens instead of rounding them or throwing. + */ +export function stringifyLosslessJson(value: unknown, space?: string | number): string | undefined { + let markerIndex = 0; + for (let attempt = 0; attempt < MAX_STRINGIFY_MARKER_ATTEMPTS; attempt += 1) { + const marker = markerForIndex(markerIndex); + const bigintValues: string[] = []; + const observedStrings = new Set(); + const ancestors: object[] = []; + const serialized = JSON.stringify( + value, + function losslessReplacer(this: unknown, key, nestedValue: unknown) { + if (key) observedStrings.add(key); + if (typeof nestedValue === 'bigint') { + const index = bigintValues.push(nestedValue.toString()) - 1; + return `${marker}${index}`; + } + if (typeof nestedValue === 'string') observedStrings.add(nestedValue); + if (nestedValue !== null && typeof nestedValue === 'object') { + while (ancestors.length > 0 && ancestors.at(-1) !== this) ancestors.pop(); + if (ancestors.includes(nestedValue)) return '[Circular]'; + ancestors.push(nestedValue); + } + return nestedValue; + }, + space, + ); + if (serialized === undefined || bigintValues.length === 0) return serialized; + + const output = replaceBigintPlaceholders(serialized, marker, bigintValues); + if (output !== null) return output; + + // A literal string or key can equal a placeholder, including one created + // by toJSON(). Skip all markers observed in this final JSON shape rather + // than rescanning the full payload once per candidate. + const blockedIndexes = collectBlockedStringifyMarkers( + observedStrings, + bigintValues.length, + ); + blockedIndexes.add(markerIndex); + markerIndex = 0; + while (blockedIndexes.has(markerIndex)) markerIndex += 1; + } + + throw new TypeError('Unable to select a collision-free bigint JSON marker'); +} + +function maskUnsafeJsonIntegers(source: string, marker: string): string { + let masked = ''; + let inString = false; + let escaped = false; + + for (let index = 0; index < source.length; index += 1) { + const character = source[index]; + if (inString) { + masked += character; + if (escaped) escaped = false; + else if (character === '\\') escaped = true; + else if (character === '"') inString = false; + continue; + } + if (character === '"') { + inString = true; + masked += character; + continue; + } + + if (character === '-' || (character >= '0' && character <= '9')) { + JSON_NUMBER_PATTERN.lastIndex = index; + const match = JSON_NUMBER_PATTERN.exec(source)?.[0]; + if (match) { + if (!/[.eE]/.test(match)) { + const integer = BigInt(match); + if ( + integer < BigInt(Number.MIN_SAFE_INTEGER) || + integer > BigInt(Number.MAX_SAFE_INTEGER) + ) { + masked += JSON.stringify(`${marker}${match}`); + index += match.length - 1; + continue; + } + } + masked += match; + index += match.length - 1; + continue; + } + } + masked += character; + } + return masked; +} + +/** + * Parse JSON without rounding integer tokens outside JavaScript's safe range. + */ +export function parseLosslessJson(source: string): unknown { + const marker = selectParseMarker(source); + return JSON.parse(maskUnsafeJsonIntegers(source, marker), (_key, value: unknown) => { + if (typeof value === 'string' && value.startsWith(marker)) { + const integer = value.slice(marker.length); + if (YAML_INTEGER_PATTERN.test(integer)) return BigInt(integer); + } + return value; + }); +} diff --git a/packages/core/src/manifest/rationale-store.ts b/packages/core/src/manifest/rationale-store.ts index 0e03c00..2f3c865 100644 --- a/packages/core/src/manifest/rationale-store.ts +++ b/packages/core/src/manifest/rationale-store.ts @@ -23,6 +23,7 @@ import { createReadStream } from 'fs'; import readline from 'readline'; import path from 'path'; import os from 'os'; +import { parseLosslessJson, stringifyLosslessJson } from './lossless'; // ── Types ─────────────────────────────────────────────────────────────────── @@ -98,11 +99,29 @@ function fileFor(ns: string): { dir: string; file: string; lock: string } { */ const LOCK_MAX_RETRIES = 100; const LOCK_RETRY_DELAY_MS = 20; +const appendQueues = new Map>(); async function sleep(ms: number): Promise { await new Promise((r) => setTimeout(r, ms)); } +async function serializeInProcess(lock: string, operation: () => Promise): Promise { + const previous = appendQueues.get(lock) ?? Promise.resolve(); + const current = previous.catch(() => undefined).then(operation); + const settled = current.then( + () => undefined, + () => undefined, + ); + appendQueues.set(lock, settled); + try { + await current; + } finally { + if (appendQueues.get(lock) === settled) { + appendQueues.delete(lock); + } + } +} + /** * Append a single rationale entry to the namespace's JSONL log. * @@ -118,55 +137,59 @@ export async function appendRationale(ns: string, entry: RationaleEntry): Promis const { dir, file, lock } = fileFor(ns); await mkdir(dir, { recursive: true }); - const line = JSON.stringify(entry) + '\n'; + const serialized = stringifyLosslessJson(entry); + if (serialized === undefined) throw new Error('Rationale entry could not be serialized'); + const line = serialized + '\n'; - let acquired = false; - for (let attempt = 0; attempt <= LOCK_MAX_RETRIES; attempt++) { - try { - // 'wx' = O_WRONLY | O_CREAT | O_EXCL — atomic-create; throws if exists. - const handle = await open(lock, 'wx'); - await handle.close(); - acquired = true; - break; - } catch (err) { - const code = (err as NodeJS.ErrnoException).code; - // EEXIST = lock held. EPERM/EBUSY/EACCES happen on Windows when - // the lock file is mid-deletion by another writer — same intent - // ("contention"), so retry under the same budget. - const retriable = - code === 'EEXIST' || code === 'EPERM' || code === 'EBUSY' || code === 'EACCES'; - if (!retriable) { - // Permission errors at the directory level, ENOSPC, etc. — surface - // immediately. No point retrying since the failure mode isn't - // going to clear itself. - throw err; + await serializeInProcess(lock, async () => { + let acquired = false; + for (let attempt = 0; attempt <= LOCK_MAX_RETRIES; attempt++) { + try { + // 'wx' = O_WRONLY | O_CREAT | O_EXCL — atomic-create; throws if exists. + const handle = await open(lock, 'wx'); + await handle.close(); + acquired = true; + break; + } catch (err) { + const code = (err as NodeJS.ErrnoException).code; + // EEXIST = lock held. EPERM/EBUSY/EACCES happen on Windows when + // the lock file is mid-deletion by another writer — same intent + // ("contention"), so retry under the same budget. + const retriable = + code === 'EEXIST' || code === 'EPERM' || code === 'EBUSY' || code === 'EACCES'; + if (!retriable) { + // Permission errors at the directory level, ENOSPC, etc. — surface + // immediately. No point retrying since the failure mode isn't + // going to clear itself. + throw err; + } + if (attempt === LOCK_MAX_RETRIES) break; + await sleep(LOCK_RETRY_DELAY_MS); } - if (attempt === LOCK_MAX_RETRIES) break; - await sleep(LOCK_RETRY_DELAY_MS); } - } - if (!acquired) { - throw new Error( - `Could not acquire rationale append lock at ${lock} after ${LOCK_MAX_RETRIES} retries (~${ - LOCK_MAX_RETRIES * LOCK_RETRY_DELAY_MS - }ms). Another writer may be stuck.`, - ); - } + if (!acquired) { + throw new Error( + `Could not acquire rationale append lock at ${lock} after ${LOCK_MAX_RETRIES} retries (~${ + LOCK_MAX_RETRIES * LOCK_RETRY_DELAY_MS + }ms). Another writer may be stuck.`, + ); + } - try { - // Append to the JSONL file. Open with 'a' (O_APPEND) so writes are - // append-atomic at the OS level even if multiple FDs were open. - const fh = await open(file, 'a'); try { - await fh.appendFile(line, 'utf8'); + // Append to the JSONL file. Open with 'a' (O_APPEND) so writes are + // append-atomic at the OS level even if multiple FDs were open. + const fh = await open(file, 'a'); + try { + await fh.appendFile(line, 'utf8'); + } finally { + await fh.close(); + } } finally { - await fh.close(); + // Always release the lock — even if the append throws. + await rm(lock, { force: true }); } - } finally { - // Always release the lock — even if the append throws. - await rm(lock, { force: true }); - } + }); } // ── Delete (cleanup on manifest removal) ────────────────────────────────── @@ -243,7 +266,8 @@ export async function readRationale(ns: string): Promise { const line = raw.trim(); if (!line) return; try { - const parsed = JSON.parse(line) as Partial & Record; + const parsed = parseLosslessJson(line) as Partial & + Record; if (!parsed || typeof parsed !== 'object') { // eslint-disable-next-line no-console console.warn(`[rationale] ${file}: line ${lineNumber} parsed to non-object, skipping`); diff --git a/packages/core/src/oscfg/format.test.ts b/packages/core/src/oscfg/format.test.ts index 0f16c33..a4c8453 100644 --- a/packages/core/src/oscfg/format.test.ts +++ b/packages/core/src/oscfg/format.test.ts @@ -2,7 +2,7 @@ // Licensed under the MIT License. import { describe, it, expect } from 'vitest'; -import { resourcesToYaml, parseYamlDocument } from './format'; +import { resourcesToYaml, parseYamlDocument, parseYamlDocumentLossless } from './format'; describe('resourcesToYaml', () => { it('produces valid YAML with schema, name, and resources', () => { @@ -73,3 +73,11 @@ describe('parseYamlDocument', () => { expect(result.count).toBe(3); }); }); + +describe('parseYamlDocumentLossless', () => { + it('preserves QWord integers outside the JavaScript safe range', () => { + const result = parseYamlDocumentLossless('value: 18446744073709551615'); + + expect(result.value).toBe(18446744073709551615n); + }); +}); diff --git a/packages/core/src/oscfg/format.ts b/packages/core/src/oscfg/format.ts index b18439a..89a427c 100644 --- a/packages/core/src/oscfg/format.ts +++ b/packages/core/src/oscfg/format.ts @@ -2,6 +2,7 @@ // Licensed under the MIT License. import yaml from 'js-yaml'; +import { dumpLosslessYaml, parseLosslessYaml } from '../manifest/lossless'; import type { OscfgResource } from './types'; /** @@ -34,7 +35,7 @@ export function resourcesToYaml( }; return ( '# Reconstructed by ConfigForge from oscfg JSON output\n' + - yaml.dump(doc, { lineWidth: 120, noRefs: true, quotingType: '"' }) + dumpLosslessYaml(doc, { lineWidth: 120, noRefs: true, quotingType: '"' }) ); } @@ -43,3 +44,9 @@ export function parseYamlDocument(text: string): Record { if (!parsed || typeof parsed !== 'object') return {}; return parsed as Record; } + +export function parseYamlDocumentLossless(text: string): Record { + const parsed = parseLosslessYaml(text); + if (!parsed || typeof parsed !== 'object') return {}; + return parsed as Record; +} diff --git a/packages/core/src/oscfg/index.ts b/packages/core/src/oscfg/index.ts index 9b409cb..5d076d8 100644 --- a/packages/core/src/oscfg/index.ts +++ b/packages/core/src/oscfg/index.ts @@ -12,12 +12,16 @@ export { applyManifest } from './apply'; export { getNamespaces, getResources, getResourceByName } from './get'; export { createNamespace, deleteNamespace, deleteResource } from './manage'; export { execResource, serializeProperties } from './exec'; -export { resourcesToYaml, parseYamlDocument } from './format'; +export { resourcesToYaml, parseYamlDocument, parseYamlDocumentLossless } from './format'; +export { + canonicalizeRegistryValueType, + normalizeManifestRegistryTypesInYaml, + normalizeRegistryKeyPath, +} from './registry-types'; export { sanitizeNamespace, isValidNamespace } from './naming'; export { compareDesiredActual, normalizePropertiesForCli, - normalizeRegistryKeyPath, summarizeCompliance, } from './compliance'; export type { ComplianceResult, ComplianceStatus, DesiredResource } from './compliance'; diff --git a/packages/core/src/oscfg/registry-types.test.ts b/packages/core/src/oscfg/registry-types.test.ts index ece1ddb..e3d650f 100644 --- a/packages/core/src/oscfg/registry-types.test.ts +++ b/packages/core/src/oscfg/registry-types.test.ts @@ -2,56 +2,127 @@ // Licensed under the MIT License. /** - * PR19: tests for the Win32 -> DSC registry valueType normalizer. + * Registry valueType compatibility tests. * - * The bug it fixes: oscfg's Microsoft.Windows/Registry provider expects - * DSC-style names (Dword, String, MultiString, Binary, QWord, - * ExpandString, None). Microsoft Defender baselines, ConfigManager - * exports, and most group-policy CSVs use the Win32 API names instead - * (REG_DWORD, REG_SZ, ...). Sending those to oscfg fails with - * "The parameter is incorrect. (os error 87)" — every rule silently - * dies on enforce. - * - * The fix: a defensive normalizer in the apply path that translates - * REG_* -> DSC names before the YAML hits the CLI. Exercised here at - * three layers: the leaf string mapper, the manifest-tree walker, and - * the YAML round-trip. + * The current microsoft/osconfig `schema/.document.json` defines only + * `REG_DWORD`/`REG_QWORD` in its integer enum and `REG_MULTI_SZ` in its array + * enum. `docs/resources/windows/Registry.md`, `examples/registry.osc.yaml`, + * and Microsoft Learn set/test/quickstart files also author Registry + * resources with `REG_*` names. Hardware verification additionally found + * that `Dword` can return exit code 0 without applying the value. These tests + * keep compatibility inputs behind that canonical boundary. */ import { describe, expect, it } from 'vitest'; import yaml from 'js-yaml'; +import { + canonicalizeRegistryValueType, + normalizeRegistryKeyPath, +} from './index'; import { normalizeManifestRegistryTypes, normalizeManifestRegistryTypesInYaml, normalizeRegistryValueType, } from './registry-types'; +const RECOGNIZED_REGISTRY_HIVES = [ + 'HKEY_LOCAL_MACHINE', + 'HKEY_CURRENT_USER', + 'HKEY_USERS', + 'HKEY_CLASSES_ROOT', + 'HKEY_CURRENT_CONFIG', + 'HKLM', + 'HKCU', + 'HKU', + 'HKCR', + 'HKCC', +] as const; + +describe('canonicalizeRegistryValueType (public baseline guard helper)', () => { + it.each([ + 'REG_NONE', + 'REG_SZ', + 'REG_EXPAND_SZ', + 'REG_BINARY', + 'REG_DWORD', + 'REG_MULTI_SZ', + 'REG_QWORD', + ])('keeps current upstream type %s byte-for-byte exact', (valueType) => { + expect(canonicalizeRegistryValueType(valueType)).toBe(valueType); + }); + + it.each([ + ['Dword', 'REG_DWORD'], + ['QWord', 'REG_QWORD'], + ['MultiString', 'REG_MULTI_SZ'], + ['String', 'REG_SZ'], + ])('canonicalizes compatibility input %s to %s', (input, expected) => { + expect(canonicalizeRegistryValueType(input)).toBe(expected); + }); + + it('preserves unknown values for the caller to validate', () => { + expect(canonicalizeRegistryValueType('REG_FUTURE')).toBe('REG_FUTURE'); + }); +}); + +describe('normalizeRegistryKeyPath (public baseline guard helper)', () => { + // The dependent repository-wide guard can compare source and normalized + // values. This unit suite intentionally does not rewrite shipped baselines. + it.each(RECOGNIZED_REGISTRY_HIVES)( + 'keeps canonical recognized hive %s byte-for-byte exact', + (hive) => { + const keyPath = `${hive}:\\Software\\Canonical`; + expect(normalizeRegistryKeyPath(keyPath)).toBe(keyPath); + }, + ); + + it.each(RECOGNIZED_REGISTRY_HIVES)( + 'canonicalizes colon-less recognized hive %s', + (hive) => { + expect(normalizeRegistryKeyPath(`${hive}\\Software\\Legacy`)).toBe( + `${hive}:\\Software\\Legacy`, + ); + }, + ); +}); + describe('normalizeRegistryValueType (PR19 leaf mapper)', () => { - it('translates REG_DWORD -> Dword', () => { - expect(normalizeRegistryValueType('REG_DWORD')).toBe('Dword'); + it('normalizes Dword input to REG_DWORD', () => { + expect(normalizeRegistryValueType('Dword')).toBe('REG_DWORD'); }); - it('translates the full Win32 -> DSC table', () => { - expect(normalizeRegistryValueType('REG_NONE')).toBe('None'); - expect(normalizeRegistryValueType('REG_SZ')).toBe('String'); - expect(normalizeRegistryValueType('REG_EXPAND_SZ')).toBe('ExpandString'); - expect(normalizeRegistryValueType('REG_BINARY')).toBe('Binary'); - expect(normalizeRegistryValueType('REG_DWORD')).toBe('Dword'); - expect(normalizeRegistryValueType('REG_DWORD_LITTLE_ENDIAN')).toBe('Dword'); - expect(normalizeRegistryValueType('REG_DWORD_BIG_ENDIAN')).toBe('Dword'); - expect(normalizeRegistryValueType('REG_MULTI_SZ')).toBe('MultiString'); - expect(normalizeRegistryValueType('REG_QWORD')).toBe('QWord'); - expect(normalizeRegistryValueType('REG_QWORD_LITTLE_ENDIAN')).toBe('QWord'); + it('normalizes aliases to the REG_* spellings used by upstream schema and examples', () => { + expect(normalizeRegistryValueType('None')).toBe('REG_NONE'); + expect(normalizeRegistryValueType('REG_NONE')).toBe('REG_NONE'); + expect(normalizeRegistryValueType('String')).toBe('REG_SZ'); + expect(normalizeRegistryValueType('REG_SZ')).toBe('REG_SZ'); + expect(normalizeRegistryValueType('ExpandString')).toBe('REG_EXPAND_SZ'); + expect(normalizeRegistryValueType('REG_EXPAND_SZ')).toBe('REG_EXPAND_SZ'); + expect(normalizeRegistryValueType('Binary')).toBe('REG_BINARY'); + expect(normalizeRegistryValueType('REG_BINARY')).toBe('REG_BINARY'); + expect(normalizeRegistryValueType('Dword')).toBe('REG_DWORD'); + expect(normalizeRegistryValueType('REG_DWORD')).toBe('REG_DWORD'); + expect(normalizeRegistryValueType('REG_DWORD_LITTLE_ENDIAN')).toBe('REG_DWORD'); + expect(normalizeRegistryValueType('REG_DWORD_BIG_ENDIAN')).toBe( + 'REG_DWORD_BIG_ENDIAN', + ); + expect(normalizeRegistryValueType('MultiString')).toBe('REG_MULTI_SZ'); + expect(normalizeRegistryValueType('REG_MULTI_SZ')).toBe('REG_MULTI_SZ'); + expect(normalizeRegistryValueType('QWord')).toBe('REG_QWORD'); + expect(normalizeRegistryValueType('REG_QWORD')).toBe('REG_QWORD'); + expect(normalizeRegistryValueType('REG_QWORD_LITTLE_ENDIAN')).toBe('REG_QWORD'); }); - it('is case-insensitive on the Win32 spellings', () => { - expect(normalizeRegistryValueType('reg_dword')).toBe('Dword'); - expect(normalizeRegistryValueType('Reg_Sz')).toBe('String'); + it('is case-insensitive for known aliases', () => { + expect(normalizeRegistryValueType('dword')).toBe('REG_DWORD'); + expect(normalizeRegistryValueType('reg_dword')).toBe('REG_DWORD'); + expect(normalizeRegistryValueType('Reg_Sz')).toBe('REG_SZ'); }); - it('leaves DSC-style names untouched', () => { - expect(normalizeRegistryValueType('Dword')).toBe('Dword'); - expect(normalizeRegistryValueType('String')).toBe('String'); - expect(normalizeRegistryValueType('MultiString')).toBe('MultiString'); + it('keeps current REG_* input canonical', () => { + expect(normalizeRegistryValueType('REG_DWORD')).toBe('REG_DWORD'); + expect(normalizeRegistryValueType('REG_QWORD')).toBe('REG_QWORD'); + expect(normalizeRegistryValueType('REG_SZ')).toBe('REG_SZ'); + expect(normalizeRegistryValueType('REG_MULTI_SZ')).toBe('REG_MULTI_SZ'); }); it('leaves unknown strings untouched (so the CLI can surface its own error)', () => { @@ -66,7 +137,7 @@ describe('normalizeRegistryValueType (PR19 leaf mapper)', () => { }); describe('normalizeManifestRegistryTypes (PR19 tree walker)', () => { - it('rewrites valueType on a top-level Microsoft.Windows/Registry resource', () => { + it('normalizes Dword on a top-level Microsoft.Windows/Registry resource', () => { const m = { resources: [ { @@ -75,17 +146,17 @@ describe('normalizeManifestRegistryTypes (PR19 tree walker)', () => { properties: { keyPath: 'HKLM:\\Software\\X', valueName: 'V', - valueType: 'REG_DWORD', + valueType: 'Dword', value: 1, }, }, ], }; const out = normalizeManifestRegistryTypes(m); - expect(out.resources[0].properties.valueType).toBe('Dword'); + expect(out.resources[0].properties.valueType).toBe('REG_DWORD'); }); - it('rewrites valueType inside a Microsoft.OSConfig/Test wrapper (Defender baseline shape)', () => { + it('keeps REG_DWORD inside a Microsoft.OSConfig/Test wrapper', () => { const m = { resources: [ { @@ -108,10 +179,10 @@ describe('normalizeManifestRegistryTypes (PR19 tree walker)', () => { }; const out = normalizeManifestRegistryTypes(m); const inner = out.resources[0].properties.resource.properties; - expect(inner.valueType).toBe('Dword'); + expect(inner.valueType).toBe('REG_DWORD'); }); - it('rewrites valueType inside a Microsoft.OSConfig/Group container', () => { + it('normalizes compatibility aliases inside a Microsoft.OSConfig/Group container', () => { const m = { resources: [ { @@ -121,11 +192,11 @@ describe('normalizeManifestRegistryTypes (PR19 tree walker)', () => { resources: [ { type: 'Microsoft.Windows/Registry', - properties: { keyPath: 'X', valueName: 'V', valueType: 'REG_SZ', value: 'hi' }, + properties: { keyPath: 'X', valueName: 'V', valueType: 'String', value: 'hi' }, }, { type: 'Microsoft.Windows/Registry', - properties: { keyPath: 'Y', valueName: 'W', valueType: 'REG_MULTI_SZ', value: ['a'] }, + properties: { keyPath: 'Y', valueName: 'W', valueType: 'MultiString', value: ['a'] }, }, ], }, @@ -133,8 +204,10 @@ describe('normalizeManifestRegistryTypes (PR19 tree walker)', () => { ], }; const out = normalizeManifestRegistryTypes(m); - expect(out.resources[0].properties.resources[0].properties.valueType).toBe('String'); - expect(out.resources[0].properties.resources[1].properties.valueType).toBe('MultiString'); + expect(out.resources[0].properties.resources[0].properties.valueType).toBe('REG_SZ'); + expect(out.resources[0].properties.resources[1].properties.valueType).toBe( + 'REG_MULTI_SZ', + ); }); it('does not mutate the input', () => { @@ -167,17 +240,139 @@ describe('normalizeManifestRegistryTypes (PR19 tree walker)', () => { expect(normalizeManifestRegistryTypes('not an object' as unknown)).toBe('not an object'); }); - it('does not stack-overflow on pathologically deep nesting', () => { - let nested: Record = { type: 'Microsoft.Windows/Registry', properties: { valueType: 'REG_DWORD' } }; + it('normalizes Registry resources through pathologically deep nesting', () => { + let nested: Record = { + type: 'Microsoft.Windows/Registry', + properties: { valueType: 'Dword' }, + }; for (let i = 0; i < 200; i++) { nested = { type: 'Microsoft.OSConfig/Group', properties: { resources: [nested] } }; } - expect(() => normalizeManifestRegistryTypes(nested)).not.toThrow(); + + const normalized = normalizeManifestRegistryTypes(nested); + let current = normalized; + for (let i = 0; i < 200; i++) { + current = ( + current.properties as { resources: Record[] } + ).resources[0]; + } + expect( + (current.properties as { valueType: string }).valueType, + ).toBe('REG_DWORD'); + }); +}); + +describe('normalizeManifestRegistryTypes — Registry keyPath', () => { + it('normalizes a direct Registry resource while preserving hive casing', () => { + const manifest = { + resources: [ + { + name: 'direct', + type: 'Microsoft.Windows/Registry', + properties: { + keyPath: 'hkey_local_machine\\Software\\Vendor', + valueName: 'Enabled', + valueType: 'Dword', + value: 1, + }, + }, + ], + }; + + const output = normalizeManifestRegistryTypes(manifest); + + expect(output.resources[0].properties.keyPath).toBe( + 'hkey_local_machine:\\Software\\Vendor', + ); + expect(manifest.resources[0].properties.keyPath).toBe( + 'hkey_local_machine\\Software\\Vendor', + ); + }); + + it('normalizes Registry nested inside a Test resource', () => { + const manifest = { + resources: [ + { + name: 'test', + type: 'Microsoft.OSConfig/Test', + properties: { + resource: { + type: 'Microsoft.Windows/Registry', + properties: { keyPath: 'HKLM\\Software\\Test' }, + }, + }, + }, + ], + }; + + const output = normalizeManifestRegistryTypes(manifest); + + expect(output.resources[0].properties.resource.properties.keyPath).toBe( + 'HKLM:\\Software\\Test', + ); + }); + + it('normalizes Registry through nested Group containers', () => { + const manifest = { + resources: [ + { + name: 'outer', + type: 'Microsoft.OSConfig/Group', + properties: { + resources: [ + { + name: 'inner', + type: 'Microsoft.OSConfig/Group', + properties: { + resources: [ + { + name: 'registry', + type: 'Microsoft.Windows/Registry', + properties: { keyPath: 'HKCU\\Software\\Nested' }, + }, + ], + }, + }, + ], + }, + }, + ], + }; + + const output = normalizeManifestRegistryTypes(manifest); + + expect( + output.resources[0].properties.resources[0].properties.resources[0].properties + .keyPath, + ).toBe('HKCU:\\Software\\Nested'); + }); + + it('preserves already-canonical and unknown paths verbatim', () => { + expect(normalizeRegistryKeyPath('HKLM:\\Software\\Canonical')).toBe( + 'HKLM:\\Software\\Canonical', + ); + expect(normalizeRegistryKeyPath('CUSTOM_HIVE\\Software\\Unknown')).toBe( + 'CUSTOM_HIVE\\Software\\Unknown', + ); + }); + + it('does not rewrite keyPath-shaped fields on non-Registry resources', () => { + const manifest = { + resources: [ + { + name: 'custom', + type: 'Contoso/Custom', + properties: { keyPath: 'HKLM\\MustRemainUnchanged' }, + }, + ], + }; + + expect(normalizeManifestRegistryTypes(manifest)).toEqual(manifest); }); }); describe('normalizeManifestRegistryTypesInYaml (PR19 YAML round-trip)', () => { - it('rewrites REG_DWORD inside a Defender-shaped baseline', () => { + it('keeps REG_DWORD canonical inside a Test resource', () => { const input = `resources: - name: AllowDatagramProcessingOnWinServer type: Microsoft.OSConfig/Test @@ -192,8 +387,8 @@ describe('normalizeManifestRegistryTypesInYaml (PR19 YAML round-trip)', () => { `; const out = normalizeManifestRegistryTypesInYaml(input); const doc = yaml.load(out) as { resources: Array<{ properties: { resource: { properties: { valueType: string } } } }> }; - expect(doc.resources[0].properties.resource.properties.valueType).toBe('Dword'); - expect(out).not.toContain('REG_DWORD'); + expect(doc.resources[0].properties.resource.properties.valueType).toBe('REG_DWORD'); + expect(out).toContain('REG_DWORD'); }); it('fast-paths YAML that does not mention REG_ (returns input unchanged)', () => { @@ -206,6 +401,46 @@ describe('normalizeManifestRegistryTypesInYaml (PR19 YAML round-trip)', () => { expect(normalizeManifestRegistryTypesInYaml(input)).toBe(input); }); + it('preserves aliases, arbitrary fields, and exact QWord values', () => { + const input = `customTopLevel: + retained: true +resources: + - ®istry + name: direct + type: Microsoft.Windows/Registry + customResourceField: keep-me + properties: + keyPath: HKEY_LOCAL_MACHINE\\Software\\Alias + valueName: LargeValue + valueType: REG_QWORD + value: 18446744073709551615 + customProperty: keep-me-too + - *registry +`; + + const output = normalizeManifestRegistryTypesInYaml(input); + const doc = yaml.load(output) as { + customTopLevel: { retained: boolean }; + resources: Array<{ + customResourceField: string; + properties: { + keyPath: string; + customProperty: string; + }; + }>; + }; + + expect(doc.customTopLevel.retained).toBe(true); + expect(doc.resources[0].customResourceField).toBe('keep-me'); + expect(doc.resources[0].properties.customProperty).toBe('keep-me-too'); + expect(doc.resources[0].properties.keyPath).toBe( + 'HKEY_LOCAL_MACHINE:\\Software\\Alias', + ); + expect(output).toMatch(/&ref_\d+/); + expect(output).toMatch(/\*ref_\d+/); + expect(output).toContain('18446744073709551615'); + }); + it('returns input unchanged when YAML fails to parse', () => { const broken = `not: valid: yaml: at all: [`; expect(normalizeManifestRegistryTypesInYaml(broken)).toBe(broken); diff --git a/packages/core/src/oscfg/registry-types.ts b/packages/core/src/oscfg/registry-types.ts index ec9b2ad..8be0396 100644 --- a/packages/core/src/oscfg/registry-types.ts +++ b/packages/core/src/oscfg/registry-types.ts @@ -2,56 +2,114 @@ // Licensed under the MIT License. /** - * Normalize Windows registry value-type strings before they're sent to - * `oscfg`'s `Microsoft.Windows/Registry` provider. + * Normalize Windows registry properties before they're sent to `oscfg`'s + * `Microsoft.Windows/Registry` provider. * - * The `oscfg` CLI uses DSC-style names (`Dword`, `String`, `MultiString`, - * `Binary`, `QWord`, `ExpandString`, `None`). Many real-world inputs — - * Microsoft Defender baselines, ConfigurationManager exports, - * group-policy CSVs — use the Windows API names instead (`REG_DWORD`, - * `REG_SZ`, `REG_MULTI_SZ`, `REG_BINARY`, `REG_QWORD`, `REG_EXPAND_SZ`, - * `REG_NONE`). Sending those API names to oscfg fails with - * "The parameter is incorrect. (os error 87)" — every rule silently - * dies on enforce. + * The current microsoft/osconfig `schema/.document.json` defines only + * `REG_DWORD`/`REG_QWORD` in its integer enum and `REG_MULTI_SZ` in its + * array enum. Its `docs/resources/windows/Registry.md`, + * `examples/registry.osc.yaml`, and Microsoft Learn set/test/quickstart + * files also use the `REG_*` spellings exclusively. * - * This helper translates between the two spellings, leaving any - * already-DSC-spelled value untouched. It also accepts and preserves - * unknown values (returns them as-is) so the CLI can surface its own - * error message rather than us masking it. + * Hardware verification across current OSConfig releases also showed that + * the provider can return exit code 0 for a compatibility alias such as + * `Dword` without changing the registry value. ConfigForge therefore accepts + * known aliases only as an input compatibility feature and emits the current + * upstream `REG_*` form before execution. + * + * Unknown values are preserved so the CLI can surface its own validation + * error rather than ConfigForge masking it. + * + * The Registry provider also requires a colon after recognized hive + * tokens. It can accept an apply command while leaving an uncolonized + * keyPath unchanged, so the same apply boundary canonicalizes both + * properties before the manifest reaches OSConfig. * * @internal */ -/** Maps Win32 REG_* names to the DSC-style names oscfg accepts. */ -const REG_TO_DSC: Readonly> = { - REG_NONE: 'None', - REG_SZ: 'String', - REG_EXPAND_SZ: 'ExpandString', - REG_BINARY: 'Binary', - REG_DWORD: 'Dword', - REG_DWORD_LITTLE_ENDIAN: 'Dword', - REG_DWORD_BIG_ENDIAN: 'Dword', - REG_MULTI_SZ: 'MultiString', - REG_QWORD: 'QWord', - REG_QWORD_LITTLE_ENDIAN: 'QWord', +import { dumpLosslessYaml, parseLosslessYaml } from '../manifest/lossless'; + +/** Maps accepted aliases to the canonical valueType spellings used by OSConfig. */ +const REGISTRY_VALUE_TYPE_ALIASES: Readonly> = { + NONE: 'REG_NONE', + REG_NONE: 'REG_NONE', + STRING: 'REG_SZ', + REG_SZ: 'REG_SZ', + EXPANDSTRING: 'REG_EXPAND_SZ', + REG_EXPAND_SZ: 'REG_EXPAND_SZ', + BINARY: 'REG_BINARY', + REG_BINARY: 'REG_BINARY', + DWORD: 'REG_DWORD', + REG_DWORD: 'REG_DWORD', + REG_DWORD_LITTLE_ENDIAN: 'REG_DWORD', + MULTISTRING: 'REG_MULTI_SZ', + REG_MULTI_SZ: 'REG_MULTI_SZ', + QWORD: 'REG_QWORD', + REG_QWORD: 'REG_QWORD', + REG_QWORD_LITTLE_ENDIAN: 'REG_QWORD', }; +/** Registry hive tokens accepted by the OSConfig Registry provider. */ +const HIVE_PREFIXES = new Set([ + 'HKEY_LOCAL_MACHINE', + 'HKEY_CURRENT_USER', + 'HKEY_USERS', + 'HKEY_CLASSES_ROOT', + 'HKEY_CURRENT_CONFIG', + 'HKLM', + 'HKCU', + 'HKU', + 'HKCR', + 'HKCC', +]); + +/** + * Return the canonical upstream `REG_*` spelling for a Registry `valueType`. + * + * Current canonical values remain byte-for-byte unchanged. Known compatibility + * aliases are normalized case-insensitively. Unknown values are preserved so + * callers can defer validation to OSConfig. + * + * Repository guards can compare the returned value with the source value to + * detect legacy aliases without rewriting shipped baselines. + */ +export function canonicalizeRegistryValueType(valueType: string): string { + return REGISTRY_VALUE_TYPE_ALIASES[valueType.toUpperCase()] ?? valueType; +} + /** - * Normalize a single `valueType` string. Case-insensitive on the input - * for the REG_* spellings (some baselines emit lower-case `reg_dword`). - * Returns the input unchanged if it's already a DSC name or doesn't - * match a known REG_* alias. + * Normalize a single `valueType` string to the documented `REG_*` form. + * Matching is case-insensitive because imported baselines are not always + * consistent about casing. */ export function normalizeRegistryValueType(input: unknown): unknown { if (typeof input !== 'string') return input; - const upper = input.toUpperCase(); - if (upper in REG_TO_DSC) return REG_TO_DSC[upper]; - return input; + return canonicalizeRegistryValueType(input); } /** - * Walk a manifest object and normalize every `valueType` string found - * under any `Microsoft.Windows/Registry` resource — including those + * Add the colon required after a recognized registry hive token. + * + * Hive spelling and casing are intentionally preserved. Already-canonical + * and unknown paths are returned verbatim so this helper only changes the + * provider syntax known to be required by OSConfig. + * + * Repository guards can compare the returned path with the source path to + * detect a colon-less recognized hive without rewriting the baseline. + */ +export function normalizeRegistryKeyPath(keyPath: string): string { + if (typeof keyPath !== 'string' || keyPath.length === 0) return keyPath; + const firstSegmentEnd = keyPath.indexOf('\\'); + const head = firstSegmentEnd === -1 ? keyPath : keyPath.slice(0, firstSegmentEnd); + if (head.endsWith(':') || !HIVE_PREFIXES.has(head.toUpperCase())) return keyPath; + const rest = firstSegmentEnd === -1 ? '' : keyPath.slice(firstSegmentEnd); + return `${head}:${rest}`; +} + +/** + * Walk a manifest object and normalize every `valueType` and `keyPath` + * found under any `Microsoft.Windows/Registry` resource — including those * nested inside `Microsoft.OSConfig/Test` wrappers and * `Microsoft.OSConfig/Group` containers. * @@ -61,45 +119,71 @@ export function normalizeRegistryValueType(input: unknown): unknown { */ export function normalizeManifestRegistryTypes(manifest: T): T { if (manifest === null || typeof manifest !== 'object') return manifest; - // Cheap deep clone: manifests are pure JSON-y data after YAML parse. const clone: unknown = structuredClone(manifest); - walk(clone, 0); + walk(clone); return clone as T; } -const MAX_DEPTH = 50; +const MAX_VISITED_NODES = 100_000; -function walk(node: unknown, depth: number): void { - if (depth > MAX_DEPTH) return; - if (Array.isArray(node)) { - for (const item of node) walk(item, depth + 1); - return; - } - if (!node || typeof node !== 'object') return; - const obj = node as Record; - // If this object IS a Microsoft.Windows/Registry resource, normalize - // its `properties.valueType`. - if (obj.type === 'Microsoft.Windows/Registry') { - const props = (obj.properties ?? obj.Properties) as Record | undefined; - if (props && 'valueType' in props) { - props.valueType = normalizeRegistryValueType(props.valueType); +function walk(root: unknown): boolean { + let changed = false; + const pending: unknown[] = [root]; + const seen = new WeakSet(); + let visitedNodes = 0; + + while (pending.length > 0 && visitedNodes < MAX_VISITED_NODES) { + const node = pending.pop(); + if (!node || typeof node !== 'object' || seen.has(node)) continue; + seen.add(node); + visitedNodes += 1; + + if (Array.isArray(node)) { + pending.push(...node); + continue; + } + + const obj = node as Record; + if (obj.type === 'Microsoft.Windows/Registry') { + const rawProperties = obj.properties ?? obj.Properties; + if ( + rawProperties && + typeof rawProperties === 'object' && + !Array.isArray(rawProperties) + ) { + const props = rawProperties as Record; + if ('valueType' in props) { + const normalizedValueType = normalizeRegistryValueType(props.valueType); + if (normalizedValueType !== props.valueType) { + props.valueType = normalizedValueType; + changed = true; + } + } + if (typeof props.keyPath === 'string') { + const normalizedKeyPath = normalizeRegistryKeyPath(props.keyPath); + if (normalizedKeyPath !== props.keyPath) { + props.keyPath = normalizedKeyPath; + changed = true; + } + } + } } + + // Traverse every value. This handles Test wrappers + // (`properties.resource.properties.valueType`) and Group wrappers + // (`properties.resources[].properties.valueType`) without enumerating + // each container shape. + pending.push(...Object.values(obj)); } - // Recurse into every value — this handles Test wrappers - // (`properties.resource.properties.valueType`) and Group wrappers - // (`properties.resources[].properties.valueType`) without us having - // to enumerate the wrapper shapes. Cheap because manifests are - // tiny relative to the registry of types we'd otherwise have to know. - for (const v of Object.values(obj)) walk(v, depth + 1); + + return changed; } /** * Normalize a YAML string containing a manifest. Round-trips through - * `yaml.load` / `yaml.dump`, which means comments and exotic YAML tags - * are lost. That's acceptable for the apply path (oscfg only cares - * about the value tree, not formatting), but callers that need to - * preserve verbatim YAML should call `normalizeManifestRegistryTypes` - * on the parsed object instead. + * `yaml.load` / `yaml.dump` only when a Registry property changes. The + * lossless integer schema prevents QWord values from being rounded, and + * reference tracking preserves YAML aliases. * * Returns the original string unchanged if parsing fails — we'd rather * let oscfg surface its own YAML error than mask it here. @@ -107,19 +191,19 @@ function walk(node: unknown, depth: number): void { * @internal */ export function normalizeManifestRegistryTypesInYaml(yamlText: string): string { - // eslint-disable-next-line @typescript-eslint/no-require-imports - const yaml = require('js-yaml') as typeof import('js-yaml'); let doc: unknown; try { - doc = yaml.load(yamlText); + doc = parseLosslessYaml(yamlText); } catch { return yamlText; } - // Fast path: if the text doesn't even mention REG_, skip the round-trip. - if (!/REG_/i.test(yamlText)) return yamlText; - const normalized = normalizeManifestRegistryTypes(doc); + const changed = walk(doc); + if (!changed) return yamlText; try { - return yaml.dump(normalized, { lineWidth: -1, noRefs: true }); + return dumpLosslessYaml(doc, { + lineWidth: -1, + noRefs: false, + }); } catch { return yamlText; } diff --git a/public/_baselines/ws2022-domain-controller.osc.yaml b/public/_baselines/ws2022-domain-controller.osc.yaml index cb1fbea..f38034b 100644 --- a/public/_baselines/ws2022-domain-controller.osc.yaml +++ b/public/_baselines/ws2022-domain-controller.osc.yaml @@ -4,2811 +4,2624 @@ resources: type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/AccountLockoutPolicy - type: string - value: ResetAccountLockoutCounterAfter:15, AccountLockoutDuration:15, AccountLockoutThreshold:3 - schema: {} + name: LockoutDuration + value: 15 + expression: 'true' + template: The value {value} is informational for this control. + - name: AccountLockoutPolicy_LockoutThreshold + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutThreshold + value: 3 + expression: 'true' + template: The value {value} is informational for this control. + - name: AccountLockoutPolicy_LockoutReset + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutReset + value: 15 + expression: 'true' + template: The value {value} is informational for this control. - name: AllowAnonymousSIDOrNameTranslation type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/NetworkAccess_AllowAnonymousSIDOrNameTranslation - type: integer - value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + name: EnableAnonymousNameTranslation + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: AllowedToFormatAndEjectRemovableMedia type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon valueName: AllocateDASD - valueType: String + valueType: REG_SZ value: '0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: AllowICMPRedirectsToOverrideOSPFGeneratedRoutes type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters valueName: EnableICMPRedirect - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: AllowLocalSystemNULLSessionFallback type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 valueName: AllowNullSessionFallback - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: AllowLocalSystemToUseComputerIdentityForNTLM type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: UseMachineId - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AllowSystemToBeShutDownWithoutHavingToLogOn type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: ShutdownWithoutLogon - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netbt\Parameters + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\Netbt\Parameters valueName: NoNameReleaseOnDemand - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AllowUIAccessApplicationsToPromptForElevation type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: EnableUIADesktopToggle - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: AmountOfIdleTimeRequiredBeforeSuspendingSession type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: AutoDisconnect - valueType: Dword + valueType: REG_DWORD value: 15 - schema: - minimum: 1 - maximum: 15 + expression: (value != null && value >= 1 && value <= 15) + template: The value {value} must be between 1 and 15. - name: ApplicationManagementMSIAllowUserControlOverInstall type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Installer valueName: EnableUserControl - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: AppRuntimeAllowMicrosoftAccountsToBeOptional type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: MSAOptional - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AuditAccountLockout type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditAccountLockout - type: integer + subcategory: '{0CCE9217-69AE-11D9-BED3-505054503030}' value: 2 - schema: - minimum: 2 + expression: (value != null && value >= 2) + template: The value {value} must be greater than or equal to 2. - name: AuditAuthenticationPolicyChange type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditAuthenticationPolicyChange - type: integer + subcategory: '{0CCE9230-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditAuthorizationPolicyChange type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditAuthorizationPolicyChange - type: integer + subcategory: '{0CCE9231-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditChangeCategoryOther type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditOtherPolicyChangeEvents - type: integer + subcategory: '{0CCE9234-69AE-11D9-BED3-505054503030}' value: 2 - schema: - minimum: 2 + expression: (value != null && value >= 2) + template: The value {value} must be greater than or equal to 2. - name: AuditComputerAccountManagement type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditComputerAccountManagement - type: integer + subcategory: '{0CCE9236-69AE-11D9-BED3-505054503030}' value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AuditDetailedFileShare type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditDetailedFileShare - type: integer + subcategory: '{0CCE9244-69AE-11D9-BED3-505054503030}' value: 2 - schema: - minimum: 2 + expression: (value != null && value >= 2) + template: The value {value} must be greater than or equal to 2. - name: AuditDirectoryServiceAccess type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/DSAccess_AuditDirectoryServiceAccess - type: integer + subcategory: '{0CCE923B-69AE-11D9-BED3-505054503030}' value: 2 - schema: - minimum: 2 + expression: (value != null && value >= 2) + template: The value {value} must be greater than or equal to 2. - name: AuditDirectoryServiceChanges type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/DSAccess_AuditDirectoryServiceChanges - type: integer + subcategory: '{0CCE923C-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditDirectoryServiceReplication type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/DSAccess_AuditDirectoryServiceReplication - type: integer + subcategory: '{0CCE923D-69AE-11D9-BED3-505054503030}' value: 0 - schema: - minimum: 0 + expression: (value != null && value >= 0) + template: The value {value} must be greater than or equal to 0. - name: AuditDistributionGroupManagement type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditDistributionGroupManagement - type: integer + subcategory: '{0CCE9238-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditFileShare type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditFileShare - type: integer + subcategory: '{0CCE9224-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditGroupMembership type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditGroupMembership - type: integer + subcategory: '{0CCE9249-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditIPsecDriver type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/System_AuditIPsecDriver - type: integer + subcategory: '{0CCE9213-69AE-11D9-BED3-505054503030}' value: 3 - schema: - minimum: 3 + expression: (value != null && value >= 3) + template: The value {value} must be greater than or equal to 3. - name: AuditKerberosAuthenticationService type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogon_AuditKerberosAuthenticationService - type: integer + subcategory: '{0CCE9242-69AE-11D9-BED3-505054503030}' value: 3 - schema: - minimum: 3 + expression: (value != null && value >= 3) + template: The value {value} must be greater than or equal to 3. - name: AuditLogoff type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditLogoff - type: integer + subcategory: '{0CCE9216-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditLogon type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditLogon - type: integer + subcategory: '{0CCE9215-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditMPSSVCRuleLevelPolicyChange type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange - type: integer + subcategory: '{0CCE9232-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditOtherAccountManagementEvents type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditOtherAccountManagementEvents - type: integer + subcategory: '{0CCE923A-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditOtherLogonLogoffEvents type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents - type: integer + subcategory: '{0CCE921C-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditOtherObjectAccessEvents type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditOtherObjectAccessEvents - type: integer + subcategory: '{0CCE9227-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditOtherSystemEvents type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/System_AuditOtherSystemEvents - type: integer + subcategory: '{0CCE9214-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditPnPExternalDevice type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/DetailedTracking_AuditPNPActivity - type: integer + subcategory: '{0CCE9248-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditPolicyChange type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditPolicyChange - type: integer + subcategory: '{0CCE922F-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditProcessCreatedOrStarted type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/DetailedTracking_AuditProcessCreation - type: integer + subcategory: '{0CCE922B-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditRemovableStorage type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditRemovableStorage - type: integer + subcategory: '{0CCE9245-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditSecurityGroupManagement type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditSecurityGroupManagement - type: integer + subcategory: '{0CCE9237-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditSecurityStateChange type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/System_AuditSecurityStateChange - type: integer + subcategory: '{0CCE9210-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditSecuritySystemExtension type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/System_AuditSecuritySystemExtension - type: integer + subcategory: '{0CCE9211-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditSensitivePrivilegeUse type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PrivilegeUse_AuditSensitivePrivilegeUse - type: integer + subcategory: '{0CCE9228-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditSettingsIncludeCmdLine type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit valueName: ProcessCreationIncludeCmdLine_Enabled - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AuditSpecialLogon type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditSpecialLogon - type: integer + subcategory: '{0CCE921B-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditSystemIntegrity type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/System_AuditSystemIntegrity - type: integer + subcategory: '{0CCE9212-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditUserAccountManagement type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditUserAccountManagement - type: integer + subcategory: '{0CCE9235-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AutoplayDisallowAutoplayForNonVolumeDevices type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer valueName: NoAutoplayfornonVolume - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AutoplaySetDefaultAutoRunBehavior type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer valueName: NoAutorun - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AutoplayTurnOffAutoPlay type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer valueName: NoDriveTypeAutoRun - valueType: Dword + valueType: REG_DWORD value: 255 - schema: - oneOf: - - const: 255 - - type: 'null' + expression: ((((value == 255)) || ((value == null)))) + template: The value {value} must be one of 255, (not set). - name: BehaviorOfTheElevationPromptForAdministrators type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: ConsentPromptBehaviorAdmin - valueType: Dword + valueType: REG_DWORD value: 2 - schema: - minimum: 1 - maximum: 2 + expression: (value != null && value >= 1 && value <= 2) + template: The value {value} must be between 1 and 2. - name: BehaviorOfTheElevationPromptForStandardUsers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: ConsentPromptBehaviorUser - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: ConfigureSMBV1Server type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters valueName: SMB1 - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ConnectivityDisableDownloadingOfPrintDriversOverHTTP type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Printers valueName: DisableWebPnPDownload - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: ConnectivityProhibitInstallationAndConfigurationOfNetworkBridge type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Network Connections + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Network Connections valueName: NC_AllowNetBridge_NLA - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: CredentialProvidersAllowPINLogon type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System valueName: AllowDomainPINLogon - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: CredentialsUIDisablePasswordReveal type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredUI + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CredUI valueName: DisablePasswordReveal - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: CredentialsUIEnumerateAdministrators type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI valueName: EnumerateAdministrators - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: CryptographyAllowedKerberosEncryptionTypes type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters valueName: SupportedEncryptionTypes - valueType: Dword + valueType: REG_DWORD value: 2147483640 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: CryptographyForceStrongKeyProtection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Cryptography valueName: ForceKeyProtection - valueType: Dword + valueType: REG_DWORD value: 2 - schema: - oneOf: - - const: 2 - - type: 'null' + expression: ((((value == 2)) || ((value == null)))) + template: The value {value} must be one of 2, (not set). - name: DetectApplicationInstallationsAndPromptForElevation type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: EnableInstallerDetection - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: DeviceInstallationPreventDeviceMetadataFromNetwork type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Device Metadata + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata valueName: PreventDeviceMetadataFromNetwork - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: DeviceLockClearTextPassword type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/ClearTextPassword - type: integer - value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + name: EnablePasswordReversibleEncryption + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: DeviceLockMaximumPasswordAge type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/MaximumPasswordAge - type: integer + name: MaximumPasswordAge value: 42 - schema: - minimum: 1 - maximum: 70 + expression: (value != null && value >= 1 && value <= 70) + template: The value {value} must be between 1 and 70. - name: DeviceLockMinDevicePasswordLength type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/MinimumPasswordLength - type: integer + name: MinimumPasswordLength value: 14 - schema: - minimum: 14 + expression: (value != null && value >= 14) + template: The value {value} must be greater than or equal to 14. - name: DeviceLockMinimumPasswordAge type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/MinimumPasswordAge - type: integer + name: MinimumPasswordAge value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: DeviceLockPasswordComplexity type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/PasswordComplexity - type: integer - value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + name: EnforcePasswordComplexity + value: true + expression: ((((value == true)) || ((value == null)))) + template: The value {value} must be one of true, (not set). - name: DeviceLockPasswordHistorySize type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/PasswordHistorySize - type: integer + name: PasswordHistoryLength value: 24 - schema: - minimum: 24 + expression: (value != null && value >= 24) + template: The value {value} must be greater than or equal to 24. - name: DigitallyEncryptOrSignSecureChannelDataAlways type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters valueName: RequireSignOrSeal - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: DigitallyEncryptSecureChannelDataWhenPossible type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters valueName: SealSecureChannel - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: DigitallySignCommunicationsAlwaysClient type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters valueName: RequireSecuritySignature - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: DigitallySignCommunicationsAlwaysServer type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: RequireSecuritySignature - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: DigitallySignCommunicationsIfClientAgrees type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: EnableSecuritySignature - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - minimum: 0 - maximum: 1 + expression: (value != null && value >= 0 && value <= 1) + template: The value {value} must be between 0 and 1. - name: DigitallySignCommunicationsIfServerAgrees type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters valueName: EnableSecuritySignature - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: DigitallySignSecureChannelDataWhenPossible type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters valueName: SignSecureChannel - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: DisableLocalAccountPasswordChanges type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters valueName: DisablePasswordChange - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: DisconnectClientsWhenLogonHoursExpire type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: EnableForcedLogoff - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: DoNotDisplayLastSignedIn type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: DontDisplayLastUserName - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: DoNotRequireCTRLALTDEL type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: DisableCAD - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: EnableGuestAccountStatus type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus - type: integer - value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + name: EnableGuestAccount + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: EnableStructuredExceptionHandlingOverwriteProtection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel valueName: DisableExceptionChainValidation - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: EventLogChannelSecurityLogRetention type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security valueName: Retention - valueType: String + valueType: REG_SZ value: '0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: EventLogChannelSetupLogMaxSize type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup valueName: MaxSize - valueType: Dword + valueType: REG_DWORD value: 32768 - schema: - minimum: 32768 + expression: (value != null && value >= 32768) + template: The value {value} must be greater than or equal to 32768. - name: EventLogChannelSetupLogRetention type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup valueName: Retention - valueType: String + valueType: REG_SZ value: '0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: EventLogChannelSystemLogRetention type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System valueName: Retention - valueType: String + valueType: REG_SZ value: '0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: EventLogPercentageThresholdSecurityEventLogMaximumSizeReached type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Eventlog\Security valueName: WarningLevel - valueType: Dword + valueType: REG_DWORD value: 90 - schema: - maximum: 90 + expression: (value != null && value <= 90) + template: The value {value} must be less than or equal to 90. - name: EventLogServiceControlEventLogBehavior type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application valueName: Retention - valueType: String + valueType: REG_SZ value: '0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: EventLogServiceSpecifyMaximumFileSizeApplicationLog type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application valueName: MaxSize - valueType: Dword + valueType: REG_DWORD value: 32768 - schema: - minimum: 32768 + expression: (value != null && value >= 32768) + template: The value {value} must be greater than or equal to 32768. - name: EventLogServiceSpecifyMaximumFileSizeSecurityLog type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security valueName: MaxSize - valueType: Dword + valueType: REG_DWORD value: 196608 - schema: - minimum: 196608 + expression: (value != null && value >= 196608) + template: The value {value} must be greater than or equal to 196608. - name: EventLogServiceSpecifyMaximumFileSizeSystemLog type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System valueName: MaxSize - valueType: Dword + valueType: REG_DWORD value: 32768 - schema: - minimum: 32768 + expression: (value != null && value >= 32768) + template: The value {value} must be greater than or equal to 32768. - name: ExperienceAllowWindowsConsumerFeatures type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CloudContent valueName: DisableWindowsConsumerFeatures - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ExperienceDisableConsumerAccountStateContent type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CloudContent valueName: DisableConsumerAccountStateContent - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: ExperienceDoNotShowFeedbackNotifications type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DataCollection valueName: DoNotShowFeedbackNotifications - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FileExplorerTurnOffHeapTerminationOnCorruption type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer valueName: NoHeapTerminationOnCorruption - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: FirewallDomainProfileApplyLocalConnectionSecurityRules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: AllowLocalIPsecPolicyMerge - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallDomainProfileApplyLocalFirewallRules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: AllowLocalPolicyMerge - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: FirewallDomainProfileDisplayNotification type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: DisableNotifications - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallDomainProfileInboundConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: DefaultInboundAction - valueType: Dword - schema: - const: 1 + valueType: REG_DWORD + expression: (value == 1) + template: The value {value} must be 1. - name: FirewallDomainProfileLogDroppedPackets type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging valueName: LogDroppedPackets - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallDomainProfileLogFileMaxSize type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging valueName: LogFileSize - valueType: Dword + valueType: REG_DWORD value: 16384 - schema: - minimum: 16384 + expression: (value != null && value >= 16384) + template: The value {value} must be greater than or equal to 16384. - name: FirewallDomainProfileLogFileName type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging valueName: LogFilePath - valueType: String + valueType: REG_SZ value: '%SystemRoot%\System32\logfiles\firewall\domainfw.log' - schema: - oneOf: - - const: '%SystemRoot%\System32\logfiles\firewall\domainfw.log' - - type: 'null' + expression: ((((value == "%SystemRoot%\\System32\\logfiles\\firewall\\domainfw.log")) || ((value == null)))) + template: The value {value} must be one of "%SystemRoot%\\System32\\logfiles\\firewall\\domainfw.log", (not set). - name: FirewallDomainProfileLogSuccessfulConnections type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging valueName: LogSuccessfulConnections - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallDomainProfileOutboundConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: DefaultOutboundAction - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: FirewallDomainProfileState type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: EnableFirewall - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallDomainProfileUnicastResponse type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\DomainProfile + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: DisableUnicastResponsesToMulticastBroadcast - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: FirewallPrivateProfileApplyLocalConnectionSecurityRules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: AllowLocalIPsecPolicyMerge - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPrivateProfileApplyLocalFirewallRules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: AllowLocalPolicyMerge - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: FirewallPrivateProfileDisplayNotification type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: DisableNotifications - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPrivateProfileInboundConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: DefaultInboundAction - valueType: Dword - schema: - const: 1 + valueType: REG_DWORD + expression: (value == 1) + template: The value {value} must be 1. - name: FirewallPrivateProfileLogDroppedPackets type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging valueName: LogDroppedPackets - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPrivateProfileLogFileMaxSize type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging valueName: LogFileSize - valueType: Dword + valueType: REG_DWORD value: 16384 - schema: - minimum: 16384 + expression: (value != null && value >= 16384) + template: The value {value} must be greater than or equal to 16384. - name: FirewallPrivateProfileLogFileName type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging valueName: LogFilePath - valueType: String + valueType: REG_SZ value: '%SystemRoot%\System32\logfiles\firewall\privatefw.log' - schema: - oneOf: - - const: '%SystemRoot%\System32\logfiles\firewall\privatefw.log' - - type: 'null' + expression: ((((value == "%SystemRoot%\\System32\\logfiles\\firewall\\privatefw.log")) || ((value == null)))) + template: The value {value} must be one of "%SystemRoot%\\System32\\logfiles\\firewall\\privatefw.log", (not set). - name: FirewallPrivateProfileLogSuccessfulConnections type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging valueName: LogSuccessfulConnections - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPrivateProfileOutboundConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: DefaultOutboundAction - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: FirewallPrivateProfileState type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: EnableFirewall - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPrivateProfileUnicastResponse type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: DisableUnicastResponsesToMulticastBroadcast - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: FirewallPublicProfileApplyLocalConnectionSecurityRules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: AllowLocalIPsecPolicyMerge - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPublicProfileApplyLocalFirewallRules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: AllowLocalPolicyMerge - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: FirewallPublicProfileDisplayNotification type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: DisableNotifications - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPublicProfileInboundConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: DefaultInboundAction - valueType: Dword - schema: - const: 1 + valueType: REG_DWORD + expression: (value == 1) + template: The value {value} must be 1. - name: FirewallPublicProfileLogDroppedPackets type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging valueName: LogDroppedPackets - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPublicProfileLogFileMaxSize type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging valueName: LogFileSize - valueType: Dword + valueType: REG_DWORD value: 16384 - schema: - minimum: 16384 + expression: (value != null && value >= 16384) + template: The value {value} must be greater than or equal to 16384. - name: FirewallPublicProfileLogFileName type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging valueName: LogFilePath - valueType: String + valueType: REG_SZ value: '%SystemRoot%\System32\logfiles\firewall\publicfw.log' - schema: - oneOf: - - const: '%SystemRoot%\System32\logfiles\firewall\publicfw.log' - - type: 'null' + expression: ((((value == "%SystemRoot%\\System32\\logfiles\\firewall\\publicfw.log")) || ((value == null)))) + template: The value {value} must be one of "%SystemRoot%\\System32\\logfiles\\firewall\\publicfw.log", (not set). - name: FirewallPublicProfileLogSuccessfulConnections type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging valueName: LogSuccessfulConnections - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPublicProfileOutboundConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: DefaultOutboundAction - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: FirewallPublicProfileState type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: EnableFirewall - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPublicProfileUnicastResponse type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: DisableUnicastResponsesToMulticastBroadcast - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: SCENoApplyLegacyAuditPolicy - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: GroupPolicyDisableBackgroundPolicy type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\Software\Microsoft\Windows\CurrentVersion\Policies\System valueName: DisableBkGndGroupPolicy - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: GroupPolicyEnableCDP type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System valueName: EnableCdp - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: GroupPolicyNoBackgroundPolicy type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2} + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2} valueName: NoBackgroundPolicy - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: GroupPolicyNoGPOListChanges type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2} + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2} valueName: NoGPOListChanges - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: ICMNC_ExitOnISP type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard valueName: ExitOnMSICW - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: IPSourceRoutingProtectionLevel type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\Tcpip\Parameters valueName: DisableIPSourceRouting - valueType: Dword + valueType: REG_DWORD value: 2 - schema: - oneOf: - - const: 2 - - type: 'null' + expression: ((((value == 2)) || ((value == null)))) + template: The value {value} must be one of 2, (not set). - name: IPv6SourceRoutingProtectionLevel type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip6\Parameters + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\Tcpip6\Parameters valueName: DisableIPSourceRouting - valueType: Dword + valueType: REG_DWORD value: 2 - schema: - oneOf: - - const: 2 - - type: 'null' + expression: ((((value == 2)) || ((value == null)))) + template: The value {value} must be one of 2, (not set). - name: LANManagerAuthenticationLevel type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: LmCompatibilityLevel - valueType: Dword + valueType: REG_DWORD value: 5 - schema: - oneOf: - - const: 5 - - type: 'null' + expression: ((((value == 5)) || ((value == null)))) + template: The value {value} must be one of 5, (not set). - name: LDAPClientSigningRequirements type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LDAP + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LDAP valueName: LDAPClientIntegrity - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - minimum: 1 - maximum: 2 + expression: (value != null && value >= 1 && value <= 2) + template: The value {value} must be between 1 and 2. - name: LetEveryonePermissionsApplyToAnonymousUsers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: EveryoneIncludesAnonymous - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: LimitBlankPasswordUse - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: LogonBlockUserFromShowingAccountDetailsOnSignin type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows\System valueName: BlockUserFromShowingAccountDetailsOnSignin - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: LogonDontEnumerateConnectedUsers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows\System valueName: DontEnumerateConnectedUsers - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: LsaNoLMHash type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: NoLMHash - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: MachineInactivityLimit type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: InactivityTimeoutSecs - valueType: Dword + valueType: REG_DWORD value: 900 - schema: - minimum: 1 - maximum: 900 + expression: (value != null && value >= 1 && value <= 900) + template: The value {value} must be between 1 and 900. - name: MaximumMachineAccountPasswordAge type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\Netlogon\Parameters valueName: MaximumPasswordAge - valueType: Dword + valueType: REG_DWORD value: 30 - schema: - minimum: 1 - maximum: 30 + expression: (value != null && value >= 1 && value <= 30) + template: The value {value} must be between 1 and 30. - name: MessageTextUserLogon type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: LegalNoticeText - valueType: String - schema: {} + valueType: REG_SZ + expression: 'true' + template: The value {value} is informational for this control. - name: MessageTextUserLogonTitle type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: LegalNoticeCaption - valueType: String - schema: {} + valueType: REG_SZ + expression: 'true' + template: The value {value} is informational for this control. - name: MinimumSessionSecurityForNTLMSSPBasedClients type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 valueName: NTLMMinClientSec - valueType: Dword + valueType: REG_DWORD value: 537395200 - schema: - oneOf: - - const: 537395200 - - type: 'null' + expression: ((((value == 537395200)) || ((value == null)))) + template: The value {value} must be one of 537395200, (not set). - name: MinimumSessionSecurityForNTLMSSPBasedServers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 valueName: NTLMMinServerSec - valueType: Dword + valueType: REG_DWORD value: 537395200 - schema: - oneOf: - - const: 537395200 - - type: 'null' + expression: ((((value == 537395200)) || ((value == null)))) + template: The value {value} must be one of 537395200, (not set). - name: NetBTNodeTypeConfiguration type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters valueName: NodeType - valueType: Dword + valueType: REG_DWORD value: 2 - schema: - oneOf: - - const: 2 - - type: 'null' + expression: ((((value == 2)) || ((value == null)))) + template: The value {value} must be one of 2, (not set). - name: NetworkConnectionsNC_ShowSharedAccessUI type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Network Connections + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Network Connections valueName: NC_ShowSharedAccessUI - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: NetworkProviderHardenedPathsNETLOGON type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths valueName: \\*\NETLOGON - valueType: Dword - value: - - RequireMutualAuthentication=1 - - RequireIntegrity=1 - schema: {} + valueType: REG_SZ + value: RequireMutualAuthentication=1, RequireIntegrity=1 + expression: 'true' + template: The value {value} is informational for this control. - name: NetworkProviderHardenedPathsSYSVOL type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths valueName: \\*\SYSVOL - valueType: Dword - value: - - RequireMutualAuthentication=1 - - RequireIntegrity=1 - schema: {} + valueType: REG_SZ + value: RequireMutualAuthentication=1, RequireIntegrity=1 + expression: 'true' + template: The value {value} is informational for this control. - name: OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: EnableSecureUIAPaths - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: PowerShellExecutionPolicyEnableTranscripting type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription valueName: EnableTranscripting - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers valueName: AddPrinterDrivers - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: PrintersRestrictDriverInstallationToAdministrators type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint valueName: RestrictDriverInstallationToAdministrators - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: PrivacyAllowInputPersonalization type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\InputPersonalization + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\InputPersonalization valueName: AllowInputPersonalization - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: PromptUserToChangePasswordBeforeExpiration type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon + keyPath: HKEY_LOCAL_MACHINE:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon valueName: PasswordExpiryWarning - valueType: Dword + valueType: REG_DWORD value: 14 - schema: - minimum: 5 - maximum: 14 + expression: (value != null && value >= 5 && value <= 14) + template: The value {value} must be between 5 and 14. - name: RDPPortNumber type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp valueName: PortNumber - valueType: Dword + valueType: REG_DWORD value: 3389 - schema: - oneOf: - - const: 3389 - - type: 'null' + expression: ((((value == 3389)) || ((value == null)))) + template: The value {value} must be one of 3389, (not set). - name: RemoteAssistanceSolicitedRemoteAssistance type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: fAllowToGetHelp - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: RemoteAssistanceUnsolicitedRemoteAssistance type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: fAllowUnsolicited - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemoteDesktopServicesClientConnectionEncryptionLevel type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: MinEncryptionLevel - valueType: Dword + valueType: REG_DWORD value: 3 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemoteDesktopServicesDoNotAllowDriveRedirection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: fDisableCdm - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RemoteDesktopServicesDoNotAllowPasswordSaving type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: DisablePasswordSaving - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RemoteDesktopServicesPromptForPasswordUponConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: fPromptForPassword - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RemoteDesktopServicesRequireSecureRPCCommunication type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: fEncryptRPCTraffic - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RemotelyAccessibleRegistryPaths type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths valueName: Machine - valueType: Dword + valueType: REG_MULTI_SZ value: - System\CurrentControlSet\Control\ProductOptions - System\CurrentControlSet\Control\Server Applications - Software\Microsoft\Windows NT\CurrentVersion - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemoteManagementAllowBasicAuthentication_Client type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client valueName: AllowBasic - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemoteManagementAllowUnencryptedTraffic_Client type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client valueName: AllowUnencryptedTraffic - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemoteManagementDisallowDigestAuthentication type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client valueName: AllowDigest - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: RemoteManagementDisallowStoringOfRunAsCredentials type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service valueName: DisableRunAs - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RenameAdministratorAccount type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount - type: string - schema: {} + name: AdministratorAccountName + expression: 'true' + template: The value {value} is informational for this control. - name: RenameGuestAccount type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount - type: string - schema: {} + name: GuestAccountName + expression: 'true' + template: The value {value} is informational for this control. - name: RequireCaseInsensitivityForNonWindowsSubsystems type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Kernel + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Control\Session Manager\Kernel valueName: ObCaseInsensitive - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RequireStrongSessionKey type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters valueName: RequireStrongKey - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RestrictAnonymousAccessToNamedPipesAndShares type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: RestrictNullSessAccess - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RSSDisableEnclosureDownload type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds valueName: DisableEnclosureDownload - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RunAllAdministratorsInAdminApprovalMode type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: EnableLUA - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: SafeDllSearchMode type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Session Manager valueName: SafeDllSearchMode - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: SearchAllowIndexingEncryptedStoresOrItems type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Windows Search valueName: AllowIndexingEncryptedStoresOrItems - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SendUnencryptedPasswordToThirdPartySMBServers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters valueName: EnablePlainTextPassword - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SharesThatCanBeAccessedAnonymously type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: NullSessionShares - valueType: Dword + valueType: REG_MULTI_SZ value: [] - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SharingAndSecurityModelForLocalAccounts type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: ForceGuest - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ShellDataExecutionPrevention type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer valueName: NoDataExecutionPrevention - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ShutdownSystemImmediatelyIfUnableToLogSecurityAudits type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: CrashOnAuditFail - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SmartScreenEnableSmartScreenInShell type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System valueName: EnableSmartScreen - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: StrengthenDefaultPermissionsOfInternalSystemObjects type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Session Manager valueName: ProtectionMode - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: SwitchToTheSecureDesktopWhenPromptingForElevation type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: PromptOnSecureDesktop - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: SystemAllowTelemetry type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DataCollection valueName: AllowTelemetry - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - minimum: 0 - maximum: 1 + expression: (value != null && value >= 0 && value <= 1) + template: The value {value} must be between 0 and 1. - name: SystemBootStartDriverInitialization type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\EarlyLaunch + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Policies\EarlyLaunch valueName: DriverLoadPolicy - valueType: Dword + valueType: REG_DWORD value: 3 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SystemLogonCacheSize type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon valueName: CachedLogonsCount - valueType: String + valueType: REG_SZ value: '4' - schema: - minimum: 0 - maximum: 4 + expression: (value != null && value.matches("^-?[0-9]+$") && int(value) >= 0 && int(value) <= 4) + template: The value {value} must be between 0 and 4. - name: SystemMinimizeInternetConnections type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy valueName: fMinimizeConnections - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SystemWindowsSearchService type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Wsearch + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\Wsearch valueName: Start - valueType: Dword + valueType: REG_DWORD value: 4 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: TerminalServerTS_TEMP_DELETE type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: DeleteTempDirsOnExit - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: TerminalServerTS_TEMP_PER_SESSION type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: PerSessionTempDir - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: TerminalServerTS_USER_AUTHENTICATION_POLICY type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: UserAuthentication - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UseAdminApprovalMode type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: FilterAdministratorToken - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: UserRightsAccessCredentialManagerAsTrustedCaller type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/AccessCredentialManagerAsTrustedCaller - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeTrustedCredManAccessPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsActAsPartOfTheOperatingSystem type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ActAsPartOfTheOperatingSystem - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeTcbPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsAdjustMemoryQuotasForProcess type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/AdjustMemoryQuotasForProcess - type: array + name: SeIncreaseQuotaPrivilege value: - '*S-1-5-32-544' - '*S-1-5-19' - '*S-1-5-20' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsAllowLogOnThroughRemoteDesktop type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/AllowLogOnThroughRemoteDesktop - type: array + name: SeRemoteInteractiveLogonRight value: - '*S-1-5-32-544' - '*S-1-5-32-555' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsChangeTimeZone type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ChangeTimeZone - type: array + name: SeTimeZonePrivilege value: - '*S-1-5-32-544' - '*S-1-5-19' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsCreateGlobalObjects type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/CreateGlobalObjects - type: array + name: SeCreateGlobalPrivilege value: - '*S-1-5-32-544' - '*S-1-5-6' - '*S-1-5-19' - '*S-1-5-20' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsCreatePageFile type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/CreatePageFile - type: array + name: SeCreatePagefilePrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsCreatePermanentSharedObjects type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/CreatePermanentSharedObjects - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeCreatePermanentPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsCreateSymbolicLinks type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/CreateSymbolicLinks - type: array + name: SeCreateSymbolicLinkPrivilege value: - '*S-1-5-32-544' - '*S-1-5-83-0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsCreateToken type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/CreateToken - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeCreateTokenPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsDenyAccessFromNetwork type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/DenyAccessFromNetwork - type: array + name: SeDenyNetworkLogonRight value: - '*S-1-5-32-546' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsDenyLocalLogOn type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/DenyLocalLogOn - type: array + name: SeDenyInteractiveLogonRight value: - '*S-1-5-32-546' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsDenyLogOnAsBatchJob type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/DenyLogOnAsBatchJob - type: array + name: SeDenyBatchLogonRight value: - '*S-1-5-32-546' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsDenyLogOnAsService type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/DenyLogOnAsService - type: array + name: SeDenyServiceLogonRight value: - '*S-1-5-32-546' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsGenerateSecurityAudits type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/GenerateSecurityAudits - type: array + name: SeAuditPrivilege value: - '*S-1-5-19' - '*S-1-5-20' - '*S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsIncreaseSchedulingPriority type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/IncreaseSchedulingPriority - type: array + name: SeIncreaseBasePriorityPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsLoadUnloadDeviceDrivers type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/LoadUnloadDeviceDrivers - type: array + name: SeLoadDriverPrivilege value: - '*S-1-5-32-544' - '*S-1-5-32-550' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsLockMemory type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/LockMemory - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeLockMemoryPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsManageAuditingAndSecurityLog type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ManageAuditingAndSecurityLog - type: array + name: SeSecurityPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsManageVolume type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ManageVolume - type: array + name: SeManageVolumePrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsModifyFirmwareEnvironment type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ModifyFirmwareEnvironment - type: array + name: SeSystemEnvironmentPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsModifyObjectLabel type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ModifyObjectLabel - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeRelabelPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsProfileSingleProcess type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ProfileSingleProcess - type: array + name: SeProfileSingleProcessPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsProfileSystemPerformance type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ProfileSystemPerformance - type: array + name: SeSystemProfilePrivilege value: - '*S-1-5-32-544' - '*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsRemoteShutdown type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/RemoteShutdown - type: array + name: SeRemoteShutdownPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsReplaceProcessLevelToken type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ReplaceProcessLevelToken - type: array + name: SeAssignPrimaryTokenPrivilege value: - '*S-1-5-19' - '*S-1-5-20' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsShutDownTheSystem type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ShutDownTheSystem - type: array + name: SeShutdownPrivilege value: - '*S-1-5-32-544' - '*S-1-5-32-551' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsTakeOwnership type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/TakeOwnership - type: array + name: SeTakeOwnershipPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: VirtualizeFileAndRegistryWriteFailuresToPerUserLocations type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: EnableVirtualization - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsDefenderDisableAntiSpyware type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows Defender valueName: DisableAntiSpyware - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: WindowsDefenderExploitGuardASRExploitGuard_ASR_Rules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR valueName: ExploitGuard_ASR_Rules - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsDefenderExploitGuardNetworkProtectionEnableNetworkProtection type: Microsoft.OSConfig/Test properties: @@ -2816,213 +2629,190 @@ resources: type: Microsoft.Windows/Registry properties: keyPath: >- - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network + HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection valueName: EnableNetworkProtection - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsDefenderPUAProtection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender valueName: PUAProtection - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsDefenderRealTimeProtectionDisableBehaviorMonitoring type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection valueName: DisableBehaviorMonitoring - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: WindowsDefenderRealTimeProtectionDisableIOAVProtection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection valueName: DisableIOAVProtection - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: WindowsDefenderRealTimeProtectionDisableRealtimeMonitoring type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection valueName: DisableRealtimeMonitoring - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: WindowsDefenderRealTimeProtectionDisableScriptScanning type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection valueName: DisableScriptScanning - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: WindowsDefenderScanDisableEmailScanning type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan valueName: DisableEmailScanning - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: WindowsDefenderScanDisableRemovableDriveScanning type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan valueName: DisableRemovableDriveScanning - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: WindowsDefenderSecurityCenterAppBrowserProtectionDisallowExploitProtectionOverride type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection valueName: DisallowExploitProtectionOverride - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsDefenderSpyNetLocalSettingOverrideSpynetReporting type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet valueName: LocalSettingOverrideSpynetReporting - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: WindowsDefenderSpyNetSubmitSamplesConsent type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet valueName: SubmitSamplesConsent - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsExplorerShellProtocolProtectedModeTitle_2 type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer valueName: PreXPSP2ShellProtocolBehavior - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: WindowsLogonAllowAutomaticRestartSignOn type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: DisableAutomaticRestartSignOn - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsLogonDisableLockScreenAppNotifications type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System valueName: DisableLockScreenAppNotifications - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsLogonDontDisplayNetworkSelectionUI type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System valueName: DontDisplayNetworkSelectionUI - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsPowerShellTurnOnPowerShellScriptBlockLogging type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging valueName: EnableScriptBlockLogging - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). diff --git a/public/_baselines/ws2022-domain-member.osc.yaml b/public/_baselines/ws2022-domain-member.osc.yaml index 46798f2..1bd00b0 100644 --- a/public/_baselines/ws2022-domain-member.osc.yaml +++ b/public/_baselines/ws2022-domain-member.osc.yaml @@ -4,2110 +4,1951 @@ resources: type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/AccountLockoutPolicy - type: string - value: ResetAccountLockoutCounterAfter:15, AccountLockoutDuration:15, AccountLockoutThreshold:3 - schema: {} + name: LockoutDuration + value: 15 + expression: 'true' + template: The value {value} is informational for this control. + - name: AccountLockoutPolicy_LockoutThreshold + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutThreshold + value: 3 + expression: 'true' + template: The value {value} is informational for this control. + - name: AccountLockoutPolicy_LockoutReset + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutReset + value: 15 + expression: 'true' + template: The value {value} is informational for this control. - name: AllowAnonymousSIDOrNameTranslation type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/NetworkAccess_AllowAnonymousSIDOrNameTranslation - type: integer - value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + name: EnableAnonymousNameTranslation + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: AllowedToFormatAndEjectRemovableMedia type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon valueName: AllocateDASD - valueType: String + valueType: REG_SZ value: '0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: AllowICMPRedirectsToOverrideOSPFGeneratedRoutes type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters valueName: EnableICMPRedirect - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: AllowLocalSystemNULLSessionFallback type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 valueName: AllowNullSessionFallback - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: AllowLocalSystemToUseComputerIdentityForNTLM type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: UseMachineId - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AllowSystemToBeShutDownWithoutHavingToLogOn type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: ShutdownWithoutLogon - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netbt\Parameters + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\Netbt\Parameters valueName: NoNameReleaseOnDemand - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AllowUIAccessApplicationsToPromptForElevation type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: EnableUIADesktopToggle - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: AmountOfIdleTimeRequiredBeforeSuspendingSession type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: AutoDisconnect - valueType: Dword + valueType: REG_DWORD value: 15 - schema: - minimum: 1 - maximum: 15 + expression: (value != null && value >= 1 && value <= 15) + template: The value {value} must be between 1 and 15. - name: ApplicationManagementMSIAllowUserControlOverInstall type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Installer valueName: EnableUserControl - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ApplicationManagementMSIAlwaysInstallWithElevatedPrivileges type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Installer valueName: AlwaysInstallElevated - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: AppRuntimeAllowMicrosoftAccountsToBeOptional type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: MSAOptional - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AuditAccountLockout type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditAccountLockout - type: integer + subcategory: '{0CCE9217-69AE-11D9-BED3-505054503030}' value: 2 - schema: - minimum: 2 + expression: (value != null && value >= 2) + template: The value {value} must be greater than or equal to 2. - name: AuditAuthenticationPolicyChange type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditAuthenticationPolicyChange - type: integer + subcategory: '{0CCE9230-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditAuthorizationPolicyChange type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditAuthorizationPolicyChange - type: integer + subcategory: '{0CCE9231-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditChangeCategoryOther type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditOtherPolicyChangeEvents - type: integer + subcategory: '{0CCE9234-69AE-11D9-BED3-505054503030}' value: 2 - schema: - minimum: 2 + expression: (value != null && value >= 2) + template: The value {value} must be greater than or equal to 2. - name: AuditCredentialValidation type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogon_AuditCredentialValidation - type: integer + subcategory: '{0CCE923F-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditDetailedFileShare type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditDetailedFileShare - type: integer + subcategory: '{0CCE9244-69AE-11D9-BED3-505054503030}' value: 2 - schema: - minimum: 2 + expression: (value != null && value >= 2) + template: The value {value} must be greater than or equal to 2. - name: AuditFileShare type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditFileShare - type: integer + subcategory: '{0CCE9224-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditGroupMembership type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditGroupMembership - type: integer + subcategory: '{0CCE9249-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditIPsecDriver type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/System_AuditIPsecDriver - type: integer + subcategory: '{0CCE9213-69AE-11D9-BED3-505054503030}' value: 3 - schema: - minimum: 3 + expression: (value != null && value >= 3) + template: The value {value} must be greater than or equal to 3. - name: AuditLogoff type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditLogoff - type: integer + subcategory: '{0CCE9216-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditLogon type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditLogon - type: integer + subcategory: '{0CCE9215-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditMPSSVCRuleLevelPolicyChange type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange - type: integer + subcategory: '{0CCE9232-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditOtherLogonLogoffEvents type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents - type: integer + subcategory: '{0CCE921C-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditOtherObjectAccessEvents type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditOtherObjectAccessEvents - type: integer + subcategory: '{0CCE9227-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditOtherSystemEvents type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/System_AuditOtherSystemEvents - type: integer + subcategory: '{0CCE9214-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditPnPExternalDevice type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/DetailedTracking_AuditPNPActivity - type: integer + subcategory: '{0CCE9248-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditPolicyChange type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditPolicyChange - type: integer + subcategory: '{0CCE922F-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditProcessCreatedOrStarted type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/DetailedTracking_AuditProcessCreation - type: integer + subcategory: '{0CCE922B-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditRemovableStorage type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditRemovableStorage - type: integer + subcategory: '{0CCE9245-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditSecurityGroupManagement type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditSecurityGroupManagement - type: integer + subcategory: '{0CCE9237-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditSecurityStateChange type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/System_AuditSecurityStateChange - type: integer + subcategory: '{0CCE9210-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditSecuritySystemExtension type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/System_AuditSecuritySystemExtension - type: integer + subcategory: '{0CCE9211-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditSensitivePrivilegeUse type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PrivilegeUse_AuditSensitivePrivilegeUse - type: integer + subcategory: '{0CCE9228-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditSettingsIncludeCmdLine type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit valueName: ProcessCreationIncludeCmdLine_Enabled - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AuditSpecialLogon type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditSpecialLogon - type: integer + subcategory: '{0CCE921B-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditSystemIntegrity type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/System_AuditSystemIntegrity - type: integer + subcategory: '{0CCE9212-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditUserAccountManagement type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditUserAccountManagement - type: integer + subcategory: '{0CCE9235-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AutoplayDisallowAutoplayForNonVolumeDevices type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer valueName: NoAutoplayfornonVolume - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AutoplaySetDefaultAutoRunBehavior type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer valueName: NoAutorun - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AutoplayTurnOffAutoPlay type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer valueName: NoDriveTypeAutoRun - valueType: Dword + valueType: REG_DWORD value: 255 - schema: - oneOf: - - const: 255 - - type: 'null' + expression: ((((value == 255)) || ((value == null)))) + template: The value {value} must be one of 255, (not set). - name: BehaviorOfTheElevationPromptForAdministrators type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: ConsentPromptBehaviorAdmin - valueType: Dword + valueType: REG_DWORD value: 2 - schema: - minimum: 1 - maximum: 2 + expression: (value != null && value >= 1 && value <= 2) + template: The value {value} must be between 1 and 2. - name: BehaviorOfTheElevationPromptForStandardUsers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: ConsentPromptBehaviorUser - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: ClearVirtualMemoryPageFile type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Control\Session Manager\Memory Management valueName: ClearPageFileAtShutdown - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ConfigureSMBV1Server type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters valueName: SMB1 - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ConnectivityDisableDownloadingOfPrintDriversOverHTTP type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Printers valueName: DisableWebPnPDownload - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: ConnectivityProhibitInstallationAndConfigurationOfNetworkBridge type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Network Connections + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Network Connections valueName: NC_AllowNetBridge_NLA - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: CredentialProvidersAllowPINLogon type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System valueName: AllowDomainPINLogon - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: CredentialsUIDisablePasswordReveal type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredUI + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CredUI valueName: DisablePasswordReveal - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: CredentialsUIEnumerateAdministrators type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI valueName: EnumerateAdministrators - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: CryptographyAllowedKerberosEncryptionTypes type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters valueName: SupportedEncryptionTypes - valueType: Dword + valueType: REG_DWORD value: 2147483640 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: CryptographyForceStrongKeyProtection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Cryptography valueName: ForceKeyProtection - valueType: Dword + valueType: REG_DWORD value: 2 - schema: - oneOf: - - const: 2 - - type: 'null' + expression: ((((value == 2)) || ((value == null)))) + template: The value {value} must be one of 2, (not set). - name: DetectApplicationInstallationsAndPromptForElevation type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: EnableInstallerDetection - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: DeviceInstallationPreventDeviceMetadataFromNetwork type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Device Metadata + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata valueName: PreventDeviceMetadataFromNetwork - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: DeviceLockClearTextPassword type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/ClearTextPassword - type: integer - value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + name: EnablePasswordReversibleEncryption + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: DeviceLockMaximumPasswordAge type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/MaximumPasswordAge - type: integer + name: MaximumPasswordAge value: 42 - schema: - minimum: 1 - maximum: 70 + expression: (value != null && value >= 1 && value <= 70) + template: The value {value} must be between 1 and 70. - name: DeviceLockMinDevicePasswordLength type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/MinimumPasswordLength - type: integer + name: MinimumPasswordLength value: 14 - schema: - minimum: 14 + expression: (value != null && value >= 14) + template: The value {value} must be greater than or equal to 14. - name: DeviceLockMinimumPasswordAge type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/MinimumPasswordAge - type: integer + name: MinimumPasswordAge value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: DeviceLockPasswordComplexity type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/PasswordComplexity - type: integer - value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + name: EnforcePasswordComplexity + value: true + expression: ((((value == true)) || ((value == null)))) + template: The value {value} must be one of true, (not set). - name: DeviceLockPasswordHistorySize type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/PasswordHistorySize - type: integer + name: PasswordHistoryLength value: 24 - schema: - minimum: 24 + expression: (value != null && value >= 24) + template: The value {value} must be greater than or equal to 24. - name: DigitallyEncryptOrSignSecureChannelDataAlways type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters valueName: RequireSignOrSeal - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: DigitallyEncryptSecureChannelDataWhenPossible type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters valueName: SealSecureChannel - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: DigitallySignCommunicationsAlwaysClient type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters valueName: RequireSecuritySignature - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: DigitallySignCommunicationsAlwaysServer type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: RequireSecuritySignature - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: DigitallySignCommunicationsIfClientAgrees type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: EnableSecuritySignature - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - minimum: 0 - maximum: 1 + expression: (value != null && value >= 0 && value <= 1) + template: The value {value} must be between 0 and 1. - name: DigitallySignCommunicationsIfServerAgrees type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters valueName: EnableSecuritySignature - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: DigitallySignSecureChannelDataWhenPossible type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters valueName: SignSecureChannel - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: DisableLocalAccountPasswordChanges type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters valueName: DisablePasswordChange - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: DisconnectClientsWhenLogonHoursExpire type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: EnableForcedLogoff - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: DnsClientTurn_Off_Multicast type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient valueName: EnableMulticast - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: DoNotAllowAnonymousEnumerationOfSAMAccounts type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: RestrictAnonymousSAM - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: DoNotAllowAnonymousEnumerationOfSamAccountsAndShares type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: RestrictAnonymous - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: DoNotDisplayLastSignedIn type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: DontDisplayLastUserName - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: DoNotRequireCTRLALTDEL type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: DisableCAD - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: EnableGuestAccountStatus type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus - type: integer - value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + name: EnableGuestAccount + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: EnableStructuredExceptionHandlingOverwriteProtection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel valueName: DisableExceptionChainValidation - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: EventLogChannelSecurityLogRetention type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security valueName: Retention - valueType: String + valueType: REG_SZ value: '0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: EventLogChannelSetupLogMaxSize type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup valueName: MaxSize - valueType: Dword + valueType: REG_DWORD value: 32768 - schema: - minimum: 32768 + expression: (value != null && value >= 32768) + template: The value {value} must be greater than or equal to 32768. - name: EventLogChannelSetupLogRetention type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup valueName: Retention - valueType: String + valueType: REG_SZ value: '0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: EventLogChannelSystemLogRetention type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System valueName: Retention - valueType: String + valueType: REG_SZ value: '0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: EventLogPercentageThresholdSecurityEventLogMaximumSizeReached type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Eventlog\Security valueName: WarningLevel - valueType: Dword + valueType: REG_DWORD value: 90 - schema: - maximum: 90 + expression: (value != null && value <= 90) + template: The value {value} must be less than or equal to 90. - name: EventLogServiceControlEventLogBehavior type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application valueName: Retention - valueType: String + valueType: REG_SZ value: '0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: EventLogServiceSpecifyMaximumFileSizeApplicationLog type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application valueName: MaxSize - valueType: Dword + valueType: REG_DWORD value: 32768 - schema: - minimum: 32768 + expression: (value != null && value >= 32768) + template: The value {value} must be greater than or equal to 32768. - name: EventLogServiceSpecifyMaximumFileSizeSecurityLog type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security valueName: MaxSize - valueType: Dword + valueType: REG_DWORD value: 196608 - schema: - minimum: 196608 + expression: (value != null && value >= 196608) + template: The value {value} must be greater than or equal to 196608. - name: EventLogServiceSpecifyMaximumFileSizeSystemLog type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System valueName: MaxSize - valueType: Dword + valueType: REG_DWORD value: 32768 - schema: - minimum: 32768 + expression: (value != null && value >= 32768) + template: The value {value} must be greater than or equal to 32768. - name: ExperienceAllowWindowsConsumerFeatures type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CloudContent valueName: DisableWindowsConsumerFeatures - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ExperienceDisableConsumerAccountStateContent type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CloudContent valueName: DisableConsumerAccountStateContent - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: ExperienceDoNotShowFeedbackNotifications type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DataCollection valueName: DoNotShowFeedbackNotifications - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FileExplorerTurnOffHeapTerminationOnCorruption type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer valueName: NoHeapTerminationOnCorruption - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: FirewallDomainProfileApplyLocalConnectionSecurityRules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: AllowLocalIPsecPolicyMerge - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallDomainProfileApplyLocalFirewallRules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: AllowLocalPolicyMerge - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: FirewallDomainProfileDisplayNotification type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: DisableNotifications - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallDomainProfileInboundConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: DefaultInboundAction - valueType: Dword - schema: - const: 1 + valueType: REG_DWORD + expression: (value == 1) + template: The value {value} must be 1. - name: FirewallDomainProfileLogDroppedPackets type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging valueName: LogDroppedPackets - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallDomainProfileLogFileMaxSize type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging valueName: LogFileSize - valueType: Dword + valueType: REG_DWORD value: 16384 - schema: - minimum: 16384 + expression: (value != null && value >= 16384) + template: The value {value} must be greater than or equal to 16384. - name: FirewallDomainProfileLogFileName type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging valueName: LogFilePath - valueType: String + valueType: REG_SZ value: '%SystemRoot%\System32\logfiles\firewall\domainfw.log' - schema: - oneOf: - - const: '%SystemRoot%\System32\logfiles\firewall\domainfw.log' - - type: 'null' + expression: ((((value == "%SystemRoot%\\System32\\logfiles\\firewall\\domainfw.log")) || ((value == null)))) + template: The value {value} must be one of "%SystemRoot%\\System32\\logfiles\\firewall\\domainfw.log", (not set). - name: FirewallDomainProfileLogSuccessfulConnections type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging valueName: LogSuccessfulConnections - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallDomainProfileOutboundConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: DefaultOutboundAction - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: FirewallDomainProfileState type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: EnableFirewall - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallDomainProfileUnicastResponse type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\DomainProfile + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: DisableUnicastResponsesToMulticastBroadcast - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: FirewallPrivateProfileApplyLocalConnectionSecurityRules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: AllowLocalIPsecPolicyMerge - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPrivateProfileApplyLocalFirewallRules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: AllowLocalPolicyMerge - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: FirewallPrivateProfileDisplayNotification type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: DisableNotifications - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPrivateProfileInboundConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: DefaultInboundAction - valueType: Dword - schema: - const: 1 + valueType: REG_DWORD + expression: (value == 1) + template: The value {value} must be 1. - name: FirewallPrivateProfileLogDroppedPackets type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging valueName: LogDroppedPackets - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPrivateProfileLogFileMaxSize type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging valueName: LogFileSize - valueType: Dword + valueType: REG_DWORD value: 16384 - schema: - minimum: 16384 + expression: (value != null && value >= 16384) + template: The value {value} must be greater than or equal to 16384. - name: FirewallPrivateProfileLogFileName type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging valueName: LogFilePath - valueType: String + valueType: REG_SZ value: '%SystemRoot%\System32\logfiles\firewall\privatefw.log' - schema: - oneOf: - - const: '%SystemRoot%\System32\logfiles\firewall\privatefw.log' - - type: 'null' + expression: ((((value == "%SystemRoot%\\System32\\logfiles\\firewall\\privatefw.log")) || ((value == null)))) + template: The value {value} must be one of "%SystemRoot%\\System32\\logfiles\\firewall\\privatefw.log", (not set). - name: FirewallPrivateProfileLogSuccessfulConnections type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging valueName: LogSuccessfulConnections - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPrivateProfileOutboundConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: DefaultOutboundAction - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: FirewallPrivateProfileState type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: EnableFirewall - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPrivateProfileUnicastResponse type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: DisableUnicastResponsesToMulticastBroadcast - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: FirewallPublicProfileApplyLocalConnectionSecurityRules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: AllowLocalIPsecPolicyMerge - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPublicProfileApplyLocalFirewallRules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: AllowLocalPolicyMerge - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: FirewallPublicProfileDisplayNotification type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: DisableNotifications - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPublicProfileInboundConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: DefaultInboundAction - valueType: Dword - schema: - const: 1 + valueType: REG_DWORD + expression: (value == 1) + template: The value {value} must be 1. - name: FirewallPublicProfileLogDroppedPackets type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging valueName: LogDroppedPackets - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPublicProfileLogFileMaxSize type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging valueName: LogFileSize - valueType: Dword + valueType: REG_DWORD value: 16384 - schema: - minimum: 16384 + expression: (value != null && value >= 16384) + template: The value {value} must be greater than or equal to 16384. - name: FirewallPublicProfileLogFileName type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging valueName: LogFilePath - valueType: String + valueType: REG_SZ value: '%SystemRoot%\System32\logfiles\firewall\publicfw.log' - schema: - oneOf: - - const: '%SystemRoot%\System32\logfiles\firewall\publicfw.log' - - type: 'null' + expression: ((((value == "%SystemRoot%\\System32\\logfiles\\firewall\\publicfw.log")) || ((value == null)))) + template: The value {value} must be one of "%SystemRoot%\\System32\\logfiles\\firewall\\publicfw.log", (not set). - name: FirewallPublicProfileLogSuccessfulConnections type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging valueName: LogSuccessfulConnections - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPublicProfileOutboundConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: DefaultOutboundAction - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: FirewallPublicProfileState type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: EnableFirewall - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPublicProfileUnicastResponse type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: DisableUnicastResponsesToMulticastBroadcast - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: SCENoApplyLegacyAuditPolicy - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: GroupPolicyDisableBackgroundPolicy type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\Software\Microsoft\Windows\CurrentVersion\Policies\System valueName: DisableBkGndGroupPolicy - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: GroupPolicyEnableCDP type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System valueName: EnableCdp - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: GroupPolicyNoBackgroundPolicy type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2} + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2} valueName: NoBackgroundPolicy - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: GroupPolicyNoGPOListChanges type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2} + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2} valueName: NoGPOListChanges - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: ICMNC_ExitOnISP type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard valueName: ExitOnMSICW - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: IPSourceRoutingProtectionLevel type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\Tcpip\Parameters valueName: DisableIPSourceRouting - valueType: Dword + valueType: REG_DWORD value: 2 - schema: - oneOf: - - const: 2 - - type: 'null' + expression: ((((value == 2)) || ((value == null)))) + template: The value {value} must be one of 2, (not set). - name: IPv6SourceRoutingProtectionLevel type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip6\Parameters + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\Tcpip6\Parameters valueName: DisableIPSourceRouting - valueType: Dword + valueType: REG_DWORD value: 2 - schema: - oneOf: - - const: 2 - - type: 'null' + expression: ((((value == 2)) || ((value == null)))) + template: The value {value} must be one of 2, (not set). - name: LANManagerAuthenticationLevel type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: LmCompatibilityLevel - valueType: Dword + valueType: REG_DWORD value: 5 - schema: - oneOf: - - const: 5 - - type: 'null' + expression: ((((value == 5)) || ((value == null)))) + template: The value {value} must be one of 5, (not set). - name: LanmanWorkstationEnableInsecureGuestLogons type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation valueName: AllowInsecureGuestAuth - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: LDAPClientSigningRequirements type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LDAP + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LDAP valueName: LDAPClientIntegrity - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - minimum: 1 - maximum: 2 + expression: (value != null && value >= 1 && value <= 2) + template: The value {value} must be between 1 and 2. - name: LetEveryonePermissionsApplyToAnonymousUsers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: EveryoneIncludesAnonymous - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: LimitBlankPasswordUse - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: LogonBlockUserFromShowingAccountDetailsOnSignin type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows\System valueName: BlockUserFromShowingAccountDetailsOnSignin - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: LogonDontEnumerateConnectedUsers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows\System valueName: DontEnumerateConnectedUsers - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: LsaFIPSAlgorithmPolicySTE type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy valueName: STE - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: LsaNoLMHash type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: NoLMHash - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: MachineInactivityLimit type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: InactivityTimeoutSecs - valueType: Dword + valueType: REG_DWORD value: 900 - schema: - minimum: 1 - maximum: 900 + expression: (value != null && value >= 1 && value <= 900) + template: The value {value} must be between 1 and 900. - name: MaximumMachineAccountPasswordAge type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\Netlogon\Parameters valueName: MaximumPasswordAge - valueType: Dword + valueType: REG_DWORD value: 30 - schema: - minimum: 1 - maximum: 30 + expression: (value != null && value >= 1 && value <= 30) + template: The value {value} must be between 1 and 30. - name: MessageTextUserLogon type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: LegalNoticeText - valueType: String - schema: {} + valueType: REG_SZ + expression: 'true' + template: The value {value} is informational for this control. - name: MessageTextUserLogonTitle type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: LegalNoticeCaption - valueType: String - schema: {} + valueType: REG_SZ + expression: 'true' + template: The value {value} is informational for this control. - name: MinimumSessionSecurityForNTLMSSPBasedClients type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 valueName: NTLMMinClientSec - valueType: Dword + valueType: REG_DWORD value: 537395200 - schema: - oneOf: - - const: 537395200 - - type: 'null' + expression: ((((value == 537395200)) || ((value == null)))) + template: The value {value} must be one of 537395200, (not set). - name: MinimumSessionSecurityForNTLMSSPBasedServers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 valueName: NTLMMinServerSec - valueType: Dword + valueType: REG_DWORD value: 537395200 - schema: - oneOf: - - const: 537395200 - - type: 'null' + expression: ((((value == 537395200)) || ((value == null)))) + template: The value {value} must be one of 537395200, (not set). - name: NetBTNodeTypeConfiguration type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters valueName: NodeType - valueType: Dword + valueType: REG_DWORD value: 2 - schema: - oneOf: - - const: 2 - - type: 'null' + expression: ((((value == 2)) || ((value == null)))) + template: The value {value} must be one of 2, (not set). - name: NetworkConnectionsNC_ShowSharedAccessUI type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Network Connections + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Network Connections valueName: NC_ShowSharedAccessUI - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: NetworkProviderHardenedPathsNETLOGON type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths valueName: \\*\NETLOGON - valueType: Dword - value: - - RequireMutualAuthentication=1 - - RequireIntegrity=1 - schema: {} + valueType: REG_SZ + value: RequireMutualAuthentication=1, RequireIntegrity=1 + expression: 'true' + template: The value {value} is informational for this control. - name: NetworkProviderHardenedPathsSYSVOL type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths valueName: \\*\SYSVOL - valueType: Dword - value: - - RequireMutualAuthentication=1 - - RequireIntegrity=1 - schema: {} + valueType: REG_SZ + value: RequireMutualAuthentication=1, RequireIntegrity=1 + expression: 'true' + template: The value {value} is informational for this control. - name: OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: EnableSecureUIAPaths - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: PowerShellExecutionPolicyEnableTranscripting type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription valueName: EnableTranscripting - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers valueName: AddPrinterDrivers - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: PrintersRestrictDriverInstallationToAdministrators type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint valueName: RestrictDriverInstallationToAdministrators - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: PrivacyAllowInputPersonalization type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\InputPersonalization + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\InputPersonalization valueName: AllowInputPersonalization - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: PromptUserToChangePasswordBeforeExpiration type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon + keyPath: HKEY_LOCAL_MACHINE:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon valueName: PasswordExpiryWarning - valueType: Dword + valueType: REG_DWORD value: 14 - schema: - minimum: 5 - maximum: 14 + expression: (value != null && value >= 5 && value <= 14) + template: The value {value} must be between 5 and 14. - name: RDPPortNumber type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp valueName: PortNumber - valueType: Dword + valueType: REG_DWORD value: 3389 - schema: - oneOf: - - const: 3389 - - type: 'null' + expression: ((((value == 3389)) || ((value == null)))) + template: The value {value} must be one of 3389, (not set). - name: RemoteAssistanceSolicitedRemoteAssistance type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: fAllowToGetHelp - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: RemoteAssistanceUnsolicitedRemoteAssistance type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: fAllowUnsolicited - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemoteDesktopServicesClientConnectionEncryptionLevel type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: MinEncryptionLevel - valueType: Dword + valueType: REG_DWORD value: 3 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemoteDesktopServicesDoNotAllowDriveRedirection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: fDisableCdm - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RemoteDesktopServicesDoNotAllowPasswordSaving type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: DisablePasswordSaving - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RemoteDesktopServicesPromptForPasswordUponConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: fPromptForPassword - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RemoteDesktopServicesRequireSecureRPCCommunication type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: fEncryptRPCTraffic - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RemotelyAccessibleRegistryPaths type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths valueName: Machine - valueType: Dword + valueType: REG_MULTI_SZ value: - System\CurrentControlSet\Control\ProductOptions - System\CurrentControlSet\Control\Server Applications - Software\Microsoft\Windows NT\CurrentVersion - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemotelyAccessibleRegistryPathsAndSubpaths type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths valueName: Machine - valueType: Dword + valueType: REG_MULTI_SZ value: - System\CurrentControlSet\Control\Print\Printers - System\CurrentControlSet\Services\Eventlog @@ -2120,894 +1961,860 @@ resources: - System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration - Software\Microsoft\Windows NT\CurrentVersion\Perflib - System\CurrentControlSet\Services\SysmonLog - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemoteManagementAllowBasicAuthentication_Client type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client valueName: AllowBasic - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemoteManagementAllowUnencryptedTraffic_Client type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client valueName: AllowUnencryptedTraffic - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemoteManagementDisallowDigestAuthentication type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client valueName: AllowDigest - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: RemoteManagementDisallowStoringOfRunAsCredentials type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service valueName: DisableRunAs - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RenameAdministratorAccount type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount - type: string - schema: {} + name: AdministratorAccountName + expression: 'true' + template: The value {value} is informational for this control. - name: RenameGuestAccount type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount - type: string - schema: {} + name: GuestAccountName + expression: 'true' + template: The value {value} is informational for this control. - name: RequireCaseInsensitivityForNonWindowsSubsystems type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Kernel + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Control\Session Manager\Kernel valueName: ObCaseInsensitive - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RequireStrongSessionKey type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters valueName: RequireStrongKey - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RestrictAnonymousAccessToNamedPipesAndShares type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: RestrictNullSessAccess - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RestrictClientsAllowedToMakeRemoteCallsToSAM type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: RestrictRemoteSAM - valueType: String + valueType: REG_SZ value: O:BAG:BAD:(A;;RC;;;BA) - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RSSDisableEnclosureDownload type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds valueName: DisableEnclosureDownload - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RunAllAdministratorsInAdminApprovalMode type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: EnableLUA - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: SafeDllSearchMode type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Session Manager valueName: SafeDllSearchMode - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: SearchAllowIndexingEncryptedStoresOrItems type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Windows Search valueName: AllowIndexingEncryptedStoresOrItems - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SendUnencryptedPasswordToThirdPartySMBServers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters valueName: EnablePlainTextPassword - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ServerSPNTargetNameValidationLevel type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\LanManServer\Parameters valueName: SMBServerNameHardeningLevel - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: SharesThatCanBeAccessedAnonymously type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: NullSessionShares - valueType: Dword + valueType: REG_MULTI_SZ value: [] - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SharingAndSecurityModelForLocalAccounts type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: ForceGuest - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ShellDataExecutionPrevention type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer valueName: NoDataExecutionPrevention - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ShutdownSystemImmediatelyIfUnableToLogSecurityAudits type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: CrashOnAuditFail - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SmartScreenEnableSmartScreenInShell type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System valueName: EnableSmartScreen - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: StrengthenDefaultPermissionsOfInternalSystemObjects type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Session Manager valueName: ProtectionMode - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: SwitchToTheSecureDesktopWhenPromptingForElevation type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: PromptOnSecureDesktop - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: SystemAllowTelemetry type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DataCollection valueName: AllowTelemetry - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - minimum: 0 - maximum: 1 + expression: (value != null && value >= 0 && value <= 1) + template: The value {value} must be between 0 and 1. - name: SystemBootStartDriverInitialization type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\EarlyLaunch + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Policies\EarlyLaunch valueName: DriverLoadPolicy - valueType: Dword + valueType: REG_DWORD value: 3 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SystemEnableSoftwareRestrictionPolicies type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers valueName: AuthenticodeEnabled - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: SystemLogonCacheSize type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon valueName: CachedLogonsCount - valueType: String + valueType: REG_SZ value: '4' - schema: - minimum: 0 - maximum: 4 + expression: (value != null && value.matches("^-?[0-9]+$") && int(value) >= 0 && int(value) <= 4) + template: The value {value} must be between 0 and 4. - name: SystemMinimizeInternetConnections type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy valueName: fMinimizeConnections - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SystemWindowsSearchService type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Wsearch + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\Wsearch valueName: Start - valueType: Dword + valueType: REG_DWORD value: 4 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: TerminalServerTS_TEMP_DELETE type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: DeleteTempDirsOnExit - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: TerminalServerTS_TEMP_PER_SESSION type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: PerSessionTempDir - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: TerminalServerTS_USER_AUTHENTICATION_POLICY type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: UserAuthentication - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: TurnOff_Windows_Error_Reporting type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\AppCompat valueName: DisableInventory - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: UseAdminApprovalMode type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: FilterAdministratorToken - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: UserRightsAccessCredentialManagerAsTrustedCaller type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/AccessCredentialManagerAsTrustedCaller - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeTrustedCredManAccessPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsAccessFromNetwork type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/AccessFromNetwork - type: array + name: SeNetworkLogonRight value: - '*S-1-5-32-544' - '*S-1-5-11' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsActAsPartOfTheOperatingSystem type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ActAsPartOfTheOperatingSystem - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeTcbPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsAdjustMemoryQuotasForProcess type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/AdjustMemoryQuotasForProcess - type: array + name: SeIncreaseQuotaPrivilege value: - '*S-1-5-32-544' - '*S-1-5-19' - '*S-1-5-20' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsAllowLocalLogOn type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/AllowLocalLogOn - type: array + name: SeInteractiveLogonRight value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsAllowLogOnThroughRemoteDesktop type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/AllowLogOnThroughRemoteDesktop - type: array + name: SeRemoteInteractiveLogonRight value: - '*S-1-5-32-544' - '*S-1-5-32-555' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsBackupFilesAndDirectories type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/BackupFilesAndDirectories - type: array + name: SeBackupPrivilege value: - '*S-1-5-32-544' - '*S-1-5-32-551' - '*S-1-5-32-549' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsBypassTraverseChecking type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/BypassTraverseChecking - type: array + name: SeChangeNotifyPrivilege value: - '*S-1-5-32-544' - '*S-1-5-11' - '*S-1-5-32-551' - '*S-1-5-19' - '*S-1-5-20' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsChangeSystemTime type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ChangeSystemTime - type: array + name: SeSystemtimePrivilege value: - '*S-1-5-32-544' - '*S-1-5-32-549' - '*S-1-5-19' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsChangeTimeZone type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ChangeTimeZone - type: array + name: SeTimeZonePrivilege value: - '*S-1-5-32-544' - '*S-1-5-19' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsCreateGlobalObjects type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/CreateGlobalObjects - type: array + name: SeCreateGlobalPrivilege value: - '*S-1-5-32-544' - '*S-1-5-6' - '*S-1-5-19' - '*S-1-5-20' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsCreatePageFile type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/CreatePageFile - type: array + name: SeCreatePagefilePrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsCreatePermanentSharedObjects type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/CreatePermanentSharedObjects - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeCreatePermanentPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsCreateSymbolicLinks type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/CreateSymbolicLinks - type: array + name: SeCreateSymbolicLinkPrivilege value: - '*S-1-5-32-544' - '*S-1-5-83-0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsCreateToken type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/CreateToken - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeCreateTokenPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsDenyAccessFromNetwork type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/DenyAccessFromNetwork - type: array + name: SeDenyNetworkLogonRight value: - '*S-1-5-32-546' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsDenyLocalLogOn type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/DenyLocalLogOn - type: array + name: SeDenyInteractiveLogonRight value: - '*S-1-5-32-546' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsDenyLogOnAsBatchJob type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/DenyLogOnAsBatchJob - type: array + name: SeDenyBatchLogonRight value: - '*S-1-5-32-546' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsDenyLogOnAsService type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/DenyLogOnAsService - type: array + name: SeDenyServiceLogonRight value: - '*S-1-5-32-546' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsEnableDelegation type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/EnableDelegation - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeEnableDelegationPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsGenerateSecurityAudits type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/GenerateSecurityAudits - type: array + name: SeAuditPrivilege value: - '*S-1-5-19' - '*S-1-5-20' - '*S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsIncreaseProcessWorkingSet type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/IncreaseProcessWorkingSet - type: array + name: SeIncreaseWorkingSetPrivilege value: - '*S-1-5-32-544' - '*S-1-5-19' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsIncreaseSchedulingPriority type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/IncreaseSchedulingPriority - type: array + name: SeIncreaseBasePriorityPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsLoadUnloadDeviceDrivers type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/LoadUnloadDeviceDrivers - type: array + name: SeLoadDriverPrivilege value: - '*S-1-5-32-544' - '*S-1-5-32-550' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsLockMemory type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/LockMemory - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeLockMemoryPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsManageAuditingAndSecurityLog type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ManageAuditingAndSecurityLog - type: array + name: SeSecurityPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsManageVolume type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ManageVolume - type: array + name: SeManageVolumePrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsModifyFirmwareEnvironment type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ModifyFirmwareEnvironment - type: array + name: SeSystemEnvironmentPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsModifyObjectLabel type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ModifyObjectLabel - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeRelabelPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsProfileSingleProcess type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ProfileSingleProcess - type: array + name: SeProfileSingleProcessPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsProfileSystemPerformance type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ProfileSystemPerformance - type: array + name: SeSystemProfilePrivilege value: - '*S-1-5-32-544' - '*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsRemoteShutdown type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/RemoteShutdown - type: array + name: SeRemoteShutdownPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsReplaceProcessLevelToken type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ReplaceProcessLevelToken - type: array + name: SeAssignPrimaryTokenPrivilege value: - '*S-1-5-19' - '*S-1-5-20' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsRestoreFilesAndDirectories type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/RestoreFilesAndDirectories - type: array + name: SeRestorePrivilege value: - '*S-1-5-32-544' - '*S-1-5-32-551' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsShutDownTheSystem type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ShutDownTheSystem - type: array + name: SeShutdownPrivilege value: - '*S-1-5-32-544' - '*S-1-5-32-551' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsTakeOwnership type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/TakeOwnership - type: array + name: SeTakeOwnershipPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: VirtualizeFileAndRegistryWriteFailuresToPerUserLocations type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: EnableVirtualization - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsDefenderDisableAntiSpyware type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows Defender valueName: DisableAntiSpyware - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: WindowsDefenderExploitGuardASRExploitGuard_ASR_Rules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR valueName: ExploitGuard_ASR_Rules - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsDefenderExploitGuardNetworkProtectionEnableNetworkProtection type: Microsoft.OSConfig/Test properties: @@ -3015,224 +2822,202 @@ resources: type: Microsoft.Windows/Registry properties: keyPath: >- - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network + HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection valueName: EnableNetworkProtection - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsDefenderPUAProtection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender valueName: PUAProtection - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsDefenderRealTimeProtectionDisableBehaviorMonitoring type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection valueName: DisableBehaviorMonitoring - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: WindowsDefenderRealTimeProtectionDisableIOAVProtection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection valueName: DisableIOAVProtection - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: WindowsDefenderRealTimeProtectionDisableRealtimeMonitoring type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection valueName: DisableRealtimeMonitoring - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: WindowsDefenderRealTimeProtectionDisableScriptScanning type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection valueName: DisableScriptScanning - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: WindowsDefenderScanDisableEmailScanning type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan valueName: DisableEmailScanning - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: WindowsDefenderScanDisableRemovableDriveScanning type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan valueName: DisableRemovableDriveScanning - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: WindowsDefenderSecurityCenterAppBrowserProtectionDisallowExploitProtectionOverride type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection valueName: DisallowExploitProtectionOverride - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsDefenderSpyNetLocalSettingOverrideSpynetReporting type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet valueName: LocalSettingOverrideSpynetReporting - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: WindowsDefenderSpyNetSubmitSamplesConsent type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet valueName: SubmitSamplesConsent - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsExplorerShellProtocolProtectedModeTitle_2 type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer valueName: PreXPSP2ShellProtocolBehavior - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: WindowsLogonAllowAutomaticRestartSignOn type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: DisableAutomaticRestartSignOn - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsLogonDisableLockScreenAppNotifications type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System valueName: DisableLockScreenAppNotifications - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsLogonDontDisplayNetworkSelectionUI type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System valueName: DontDisplayNetworkSelectionUI - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsLogonEnumerateLocalUsersOnDomainJoinedComputers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System valueName: EnumerateLocalUsers - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: WindowsPowerShellTurnOnPowerShellScriptBlockLogging type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging valueName: EnableScriptBlockLogging - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). diff --git a/public/_baselines/ws2022-workgroup-member.osc.yaml b/public/_baselines/ws2022-workgroup-member.osc.yaml index 9fad6ff..8fc4fd5 100644 --- a/public/_baselines/ws2022-workgroup-member.osc.yaml +++ b/public/_baselines/ws2022-workgroup-member.osc.yaml @@ -4,1553 +4,1442 @@ resources: type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/AccountLockoutPolicy - type: string - value: ResetAccountLockoutCounterAfter:15, AccountLockoutDuration:15, AccountLockoutThreshold:3 - schema: {} + name: LockoutDuration + value: 15 + expression: 'true' + template: The value {value} is informational for this control. + - name: AccountLockoutPolicy_LockoutThreshold + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutThreshold + value: 3 + expression: 'true' + template: The value {value} is informational for this control. + - name: AccountLockoutPolicy_LockoutReset + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutReset + value: 15 + expression: 'true' + template: The value {value} is informational for this control. - name: AllowedToFormatAndEjectRemovableMedia type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon valueName: AllocateDASD - valueType: String + valueType: REG_SZ value: '0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: AllowICMPRedirectsToOverrideOSPFGeneratedRoutes type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters valueName: EnableICMPRedirect - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: AllowLocalSystemNULLSessionFallback type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 valueName: AllowNullSessionFallback - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: AllowLocalSystemToUseComputerIdentityForNTLM type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: UseMachineId - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AllowSystemToBeShutDownWithoutHavingToLogOn type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: ShutdownWithoutLogon - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: AllowUIAccessApplicationsToPromptForElevation type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: EnableUIADesktopToggle - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: AmountOfIdleTimeRequiredBeforeSuspendingSession type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: AutoDisconnect - valueType: Dword + valueType: REG_DWORD value: 15 - schema: - minimum: 1 - maximum: 15 + expression: (value != null && value >= 1 && value <= 15) + template: The value {value} must be between 1 and 15. - name: ApplicationManagementMSIAllowUserControlOverInstall type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Installer valueName: EnableUserControl - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ApplicationManagementMSIAlwaysInstallWithElevatedPrivileges type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Installer valueName: AlwaysInstallElevated - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: AppRuntimeAllowMicrosoftAccountsToBeOptional type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: MSAOptional - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AuditAccountLockout type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditAccountLockout - type: integer + subcategory: '{0CCE9217-69AE-11D9-BED3-505054503030}' value: 2 - schema: - minimum: 2 + expression: (value != null && value >= 2) + template: The value {value} must be greater than or equal to 2. - name: AuditAuthenticationPolicyChange type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditAuthenticationPolicyChange - type: integer + subcategory: '{0CCE9230-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditAuthorizationPolicyChange type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditAuthorizationPolicyChange - type: integer + subcategory: '{0CCE9231-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditChangeCategoryOther type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditOtherPolicyChangeEvents - type: integer + subcategory: '{0CCE9234-69AE-11D9-BED3-505054503030}' value: 2 - schema: - minimum: 2 + expression: (value != null && value >= 2) + template: The value {value} must be greater than or equal to 2. - name: AuditCredentialValidation type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogon_AuditCredentialValidation - type: integer + subcategory: '{0CCE923F-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditDetailedFileShare type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditDetailedFileShare - type: integer + subcategory: '{0CCE9244-69AE-11D9-BED3-505054503030}' value: 2 - schema: - minimum: 2 + expression: (value != null && value >= 2) + template: The value {value} must be greater than or equal to 2. - name: AuditFileShare type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditFileShare - type: integer + subcategory: '{0CCE9224-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditGroupMembership type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditGroupMembership - type: integer + subcategory: '{0CCE9249-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditIPsecDriver type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/System_AuditIPsecDriver - type: integer + subcategory: '{0CCE9213-69AE-11D9-BED3-505054503030}' value: 3 - schema: - minimum: 3 + expression: (value != null && value >= 3) + template: The value {value} must be greater than or equal to 3. - name: AuditLogoff type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditLogoff - type: integer + subcategory: '{0CCE9216-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditLogon type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditLogon - type: integer + subcategory: '{0CCE9215-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditMPSSVCRuleLevelPolicyChange type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange - type: integer + subcategory: '{0CCE9232-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditOtherLogonLogoffEvents type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents - type: integer + subcategory: '{0CCE921C-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditOtherObjectAccessEvents type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditOtherObjectAccessEvents - type: integer + subcategory: '{0CCE9227-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditOtherSystemEvents type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/System_AuditOtherSystemEvents - type: integer + subcategory: '{0CCE9214-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditPnPExternalDevice type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/DetailedTracking_AuditPNPActivity - type: integer + subcategory: '{0CCE9248-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditPolicyChange type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditPolicyChange - type: integer + subcategory: '{0CCE922F-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditProcessCreatedOrStarted type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/DetailedTracking_AuditProcessCreation - type: integer + subcategory: '{0CCE922B-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditRemovableStorage type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditRemovableStorage - type: integer + subcategory: '{0CCE9245-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditSecurityGroupManagement type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditSecurityGroupManagement - type: integer + subcategory: '{0CCE9237-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditSecurityStateChange type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/System_AuditSecurityStateChange - type: integer + subcategory: '{0CCE9210-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditSecuritySystemExtension type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/System_AuditSecuritySystemExtension - type: integer + subcategory: '{0CCE9211-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditSensitivePrivilegeUse type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/PrivilegeUse_AuditSensitivePrivilegeUse - type: integer + subcategory: '{0CCE9228-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditSettingsIncludeCmdLine type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit valueName: ProcessCreationIncludeCmdLine_Enabled - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AuditSpecialLogon type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditSpecialLogon - type: integer + subcategory: '{0CCE921B-69AE-11D9-BED3-505054503030}' value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: AuditSystemIntegrity type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/System_AuditSystemIntegrity - type: integer + subcategory: '{0CCE9212-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AuditUserAccountManagement type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AuditPolicy properties: - path: ./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditUserAccountManagement - type: integer + subcategory: '{0CCE9235-69AE-11D9-BED3-505054503030}' value: 3 - schema: - oneOf: - - const: 3 - - type: 'null' + expression: ((((value == 3)) || ((value == null)))) + template: The value {value} must be one of 3, (not set). - name: AutoplayDisallowAutoplayForNonVolumeDevices type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer valueName: NoAutoplayfornonVolume - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AutoplaySetDefaultAutoRunBehavior type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer valueName: NoAutorun - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: AutoplayTurnOffAutoPlay type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer valueName: NoDriveTypeAutoRun - valueType: Dword + valueType: REG_DWORD value: 255 - schema: - oneOf: - - const: 255 - - type: 'null' + expression: ((((value == 255)) || ((value == null)))) + template: The value {value} must be one of 255, (not set). - name: BehaviorOfTheElevationPromptForAdministrators type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: ConsentPromptBehaviorAdmin - valueType: Dword + valueType: REG_DWORD value: 2 - schema: - minimum: 1 - maximum: 2 + expression: (value != null && value >= 1 && value <= 2) + template: The value {value} must be between 1 and 2. - name: BehaviorOfTheElevationPromptForStandardUsers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: ConsentPromptBehaviorUser - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: ClearVirtualMemoryPageFile type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Control\Session Manager\Memory Management valueName: ClearPageFileAtShutdown - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ConfigureSMBV1Server type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters valueName: SMB1 - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ConnectivityDisableDownloadingOfPrintDriversOverHTTP type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Printers valueName: DisableWebPnPDownload - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: ConnectivityProhibitInstallationAndConfigurationOfNetworkBridge type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Network Connections + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Network Connections valueName: NC_AllowNetBridge_NLA - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: CredentialProvidersAllowPINLogon type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System valueName: AllowDomainPINLogon - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: CredentialsUIDisablePasswordReveal type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredUI + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CredUI valueName: DisablePasswordReveal - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: CredentialsUIEnumerateAdministrators type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI valueName: EnumerateAdministrators - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: CryptographyAllowedKerberosEncryptionTypes type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters valueName: SupportedEncryptionTypes - valueType: Dword + valueType: REG_DWORD value: 2147483640 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: CryptographyForceStrongKeyProtection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Cryptography valueName: ForceKeyProtection - valueType: Dword + valueType: REG_DWORD value: 2 - schema: - oneOf: - - const: 2 - - type: 'null' + expression: ((((value == 2)) || ((value == null)))) + template: The value {value} must be one of 2, (not set). - name: DetectApplicationInstallationsAndPromptForElevation type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: EnableInstallerDetection - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: DeviceLockClearTextPassword type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/ClearTextPassword - type: integer - value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + name: EnablePasswordReversibleEncryption + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: DeviceLockMaximumPasswordAge type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/MaximumPasswordAge - type: integer + name: MaximumPasswordAge value: 42 - schema: - minimum: 1 - maximum: 70 + expression: (value != null && value >= 1 && value <= 70) + template: The value {value} must be between 1 and 70. - name: DeviceLockMinDevicePasswordLength type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/MinimumPasswordLength - type: integer + name: MinimumPasswordLength value: 14 - schema: - minimum: 14 + expression: (value != null && value >= 14) + template: The value {value} must be greater than or equal to 14. - name: DeviceLockMinimumPasswordAge type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/MinimumPasswordAge - type: integer + name: MinimumPasswordAge value: 1 - schema: - minimum: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: DeviceLockPasswordComplexity type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/PasswordComplexity - type: integer - value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + name: EnforcePasswordComplexity + value: true + expression: ((((value == true)) || ((value == null)))) + template: The value {value} must be one of true, (not set). - name: DeviceLockPasswordHistorySize type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/DeviceLock/PasswordHistorySize - type: integer + name: PasswordHistoryLength value: 24 - schema: - minimum: 24 + expression: (value != null && value >= 24) + template: The value {value} must be greater than or equal to 24. - name: DigitallySignCommunicationsAlwaysClient type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters valueName: RequireSecuritySignature - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: DigitallySignCommunicationsAlwaysServer type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: RequireSecuritySignature - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: DigitallySignCommunicationsIfClientAgrees type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: EnableSecuritySignature - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - minimum: 0 - maximum: 1 + expression: (value != null && value >= 0 && value <= 1) + template: The value {value} must be between 0 and 1. - name: DigitallySignCommunicationsIfServerAgrees type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters valueName: EnableSecuritySignature - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: DisconnectClientsWhenLogonHoursExpire type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: EnableForcedLogoff - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: DnsClientTurn_Off_Multicast type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient valueName: EnableMulticast - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: DoNotAllowAnonymousEnumerationOfSAMAccounts type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: RestrictAnonymousSAM - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: DoNotAllowAnonymousEnumerationOfSamAccountsAndShares type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: RestrictAnonymous - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: DoNotDisplayLastSignedIn type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: DontDisplayLastUserName - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: DoNotRequireCTRLALTDEL type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: DisableCAD - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: EnabledNTPClient type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient valueName: Enabled - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: EnableGuestAccountStatus type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus - type: integer - value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + name: EnableGuestAccount + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: EventLogChannelSecurityLogRetention type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security valueName: Retention - valueType: String + valueType: REG_SZ value: '0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: EventLogChannelSetupLogMaxSize type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup valueName: MaxSize - valueType: Dword + valueType: REG_DWORD value: 32768 - schema: - minimum: 32768 + expression: (value != null && value >= 32768) + template: The value {value} must be greater than or equal to 32768. - name: EventLogChannelSetupLogRetention type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup valueName: Retention - valueType: String + valueType: REG_SZ value: '0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: EventLogChannelSystemLogRetention type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System valueName: Retention - valueType: String + valueType: REG_SZ value: '0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: EventLogServiceControlEventLogBehavior type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application valueName: Retention - valueType: String + valueType: REG_SZ value: '0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: EventLogServiceSpecifyMaximumFileSizeApplicationLog type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application valueName: MaxSize - valueType: Dword + valueType: REG_DWORD value: 32768 - schema: - minimum: 32768 + expression: (value != null && value >= 32768) + template: The value {value} must be greater than or equal to 32768. - name: EventLogServiceSpecifyMaximumFileSizeSecurityLog type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security valueName: MaxSize - valueType: Dword + valueType: REG_DWORD value: 196608 - schema: - minimum: 196608 + expression: (value != null && value >= 196608) + template: The value {value} must be greater than or equal to 196608. - name: EventLogServiceSpecifyMaximumFileSizeSystemLog type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System valueName: MaxSize - valueType: Dword + valueType: REG_DWORD value: 32768 - schema: - minimum: 32768 + expression: (value != null && value >= 32768) + template: The value {value} must be greater than or equal to 32768. - name: ExperienceAllowWindowsConsumerFeatures type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CloudContent valueName: DisableWindowsConsumerFeatures - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ExperienceDoNotShowFeedbackNotifications type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DataCollection valueName: DoNotShowFeedbackNotifications - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FileExplorerTurnOffHeapTerminationOnCorruption type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer valueName: NoHeapTerminationOnCorruption - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: FirewallDomainProfileLogDroppedPackets type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging valueName: LogDroppedPackets - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallDomainProfileState type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: EnableFirewall - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPrivateProfileApplyLocalConnectionSecurityRules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: AllowLocalIPsecPolicyMerge - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPrivateProfileApplyLocalFirewallRules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: AllowLocalPolicyMerge - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: FirewallPrivateProfileDisplayNotification type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: DisableNotifications - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPrivateProfileOutboundConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: DefaultOutboundAction - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: FirewallPrivateProfileState type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: EnableFirewall - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPrivateProfileUnicastResponse type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: DisableUnicastResponsesToMulticastBroadcast - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: FirewallPublicProfileApplyLocalFirewallRules type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: AllowLocalPolicyMerge - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: FirewallPublicProfileDisplayNotification type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: DisableNotifications - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPublicProfileLogFileMaxSize type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging valueName: LogFileSize - valueType: Dword + valueType: REG_DWORD value: 16384 - schema: - minimum: 16384 + expression: (value != null && value >= 16384) + template: The value {value} must be greater than or equal to 16384. - name: FirewallPublicProfileLogSuccessfulConnections type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging valueName: LogSuccessfulConnections - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPublicProfileOutboundConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: DefaultOutboundAction - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: FirewallPublicProfileState type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: EnableFirewall - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPublicProfileUnicastResponse type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PublicProfile + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: DisableUnicastResponsesToMulticastBroadcast - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: SCENoApplyLegacyAuditPolicy - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: GroupPolicyEnableCDP type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System valueName: EnableCdp - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ICMNC_ExitOnISP type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard valueName: ExitOnMSICW - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: LANManagerAuthenticationLevel type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: LmCompatibilityLevel - valueType: Dword + valueType: REG_DWORD value: 5 - schema: - oneOf: - - const: 5 - - type: 'null' + expression: ((((value == 5)) || ((value == null)))) + template: The value {value} must be one of 5, (not set). - name: LanmanWorkstationEnableInsecureGuestLogons type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation valueName: AllowInsecureGuestAuth - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: LDAPClientSigningRequirements type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LDAP + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LDAP valueName: LDAPClientIntegrity - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - minimum: 1 - maximum: 2 + expression: (value != null && value >= 1 && value <= 2) + template: The value {value} must be between 1 and 2. - name: LetEveryonePermissionsApplyToAnonymousUsers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: EveryoneIncludesAnonymous - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: LimitBlankPasswordUse - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: LogonBlockUserFromShowingAccountDetailsOnSignin type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows\System valueName: BlockUserFromShowingAccountDetailsOnSignin - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: LsaNoLMHash type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: NoLMHash - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: MachineInactivityLimit type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: InactivityTimeoutSecs - valueType: Dword + valueType: REG_DWORD value: 900 - schema: - minimum: 1 - maximum: 900 + expression: (value != null && value >= 1 && value <= 900) + template: The value {value} must be between 1 and 900. - name: MinimumSessionSecurityForNTLMSSPBasedClients type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 valueName: NTLMMinClientSec - valueType: Dword + valueType: REG_DWORD value: 537395200 - schema: - oneOf: - - const: 537395200 - - type: 'null' + expression: ((((value == 537395200)) || ((value == null)))) + template: The value {value} must be one of 537395200, (not set). - name: MinimumSessionSecurityForNTLMSSPBasedServers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 valueName: NTLMMinServerSec - valueType: Dword + valueType: REG_DWORD value: 537395200 - schema: - oneOf: - - const: 537395200 - - type: 'null' + expression: ((((value == 537395200)) || ((value == null)))) + template: The value {value} must be one of 537395200, (not set). - name: NetworkConnectionsNC_ShowSharedAccessUI type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Network Connections + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Network Connections valueName: NC_ShowSharedAccessUI - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: EnableSecureUIAPaths - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers valueName: AddPrinterDrivers - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: PrivacyAllowInputPersonalization type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\InputPersonalization + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\InputPersonalization valueName: AllowInputPersonalization - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: PromptUserToChangePasswordBeforeExpiration type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon + keyPath: HKEY_LOCAL_MACHINE:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon valueName: PasswordExpiryWarning - valueType: Dword + valueType: REG_DWORD value: 14 - schema: - minimum: 5 - maximum: 14 + expression: (value != null && value >= 5 && value <= 14) + template: The value {value} must be between 5 and 14. - name: RDPPortNumber type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp valueName: PortNumber - valueType: Dword + valueType: REG_DWORD value: 3389 - schema: - oneOf: - - const: 3389 - - type: 'null' + expression: ((((value == 3389)) || ((value == null)))) + template: The value {value} must be one of 3389, (not set). - name: RemoteAssistanceSolicitedRemoteAssistance type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: fAllowToGetHelp - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: RemoteAssistanceUnsolicitedRemoteAssistance type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: fAllowUnsolicited - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemoteDesktopServicesClientConnectionEncryptionLevel type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: MinEncryptionLevel - valueType: Dword + valueType: REG_DWORD value: 3 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemoteDesktopServicesDoNotAllowPasswordSaving type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: DisablePasswordSaving - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RemoteDesktopServicesPromptForPasswordUponConnection type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: fPromptForPassword - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RemoteDesktopServicesRequireSecureRPCCommunication type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: fEncryptRPCTraffic - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RemotelyAccessibleRegistryPaths type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths valueName: Machine - valueType: Dword + valueType: REG_MULTI_SZ value: - System\CurrentControlSet\Control\ProductOptions - System\CurrentControlSet\Control\Server Applications - Software\Microsoft\Windows NT\CurrentVersion - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemotelyAccessibleRegistryPathsAndSubpaths type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths valueName: Machine - valueType: Dword + valueType: REG_MULTI_SZ value: - System\CurrentControlSet\Control\Print\Printers - System\CurrentControlSet\Services\Eventlog @@ -1563,930 +1452,894 @@ resources: - System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration - Software\Microsoft\Windows NT\CurrentVersion\Perflib - System\CurrentControlSet\Services\SysmonLog - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemoteManagementAllowBasicAuthentication_Client type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client valueName: AllowBasic - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemoteManagementAllowUnencryptedTraffic_Client type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client valueName: AllowUnencryptedTraffic - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RemoteManagementDisallowDigestAuthentication type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client valueName: AllowDigest - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: RemoteManagementDisallowStoringOfRunAsCredentials type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service valueName: DisableRunAs - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RenameGuestAccount type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/AccountPolicy properties: - path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount - type: string - schema: {} + name: GuestAccountName + expression: 'true' + template: The value {value} is informational for this control. - name: RequireCaseInsensitivityForNonWindowsSubsystems type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Kernel + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Control\Session Manager\Kernel valueName: ObCaseInsensitive - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RestrictAnonymousAccessToNamedPipesAndShares type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: RestrictNullSessAccess - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RestrictClientsAllowedToMakeRemoteCallsToSAM type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: RestrictRemoteSAM - valueType: String + valueType: REG_SZ value: O:BAG:BAD:(A;;RC;;;BA) - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: RSSDisableEnclosureDownload type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds valueName: DisableEnclosureDownload - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: RunAllAdministratorsInAdminApprovalMode type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: EnableLUA - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: SearchAllowIndexingEncryptedStoresOrItems type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Windows Search valueName: AllowIndexingEncryptedStoresOrItems - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SendUnencryptedPasswordToThirdPartySMBServers type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters valueName: EnablePlainTextPassword - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SharesThatCanBeAccessedAnonymously type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters valueName: NullSessionShares - valueType: Dword + valueType: REG_MULTI_SZ value: [] - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SharingAndSecurityModelForLocalAccounts type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: ForceGuest - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ShellDataExecutionPrevention type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer valueName: NoDataExecutionPrevention - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: ShutdownSystemImmediatelyIfUnableToLogSecurityAudits type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa valueName: CrashOnAuditFail - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SmartScreenEnableSmartScreenInShell type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System valueName: EnableSmartScreen - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: StrengthenDefaultPermissionsOfInternalSystemObjects type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Session Manager valueName: ProtectionMode - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: SwitchToTheSecureDesktopWhenPromptingForElevation type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: PromptOnSecureDesktop - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: SystemAllowTelemetry type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DataCollection valueName: AllowTelemetry - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - minimum: 0 - maximum: 1 + expression: (value != null && value >= 0 && value <= 1) + template: The value {value} must be between 0 and 1. - name: SystemBootStartDriverInitialization type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\EarlyLaunch + keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Policies\EarlyLaunch valueName: DriverLoadPolicy - valueType: Dword + valueType: REG_DWORD value: 3 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SystemEnableSoftwareRestrictionPolicies type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers + keyPath: HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers valueName: AuthenticodeEnabled - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: SystemLogonCacheSize type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon valueName: CachedLogonsCount - valueType: String + valueType: REG_SZ value: '4' - schema: - minimum: 0 - maximum: 4 + expression: (value != null && value.matches("^-?[0-9]+$") && int(value) >= 0 && int(value) <= 4) + template: The value {value} must be between 0 and 4. - name: SystemMinimizeInternetConnections type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy valueName: fMinimizeConnections - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: SystemWindowsSearchService type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Wsearch + keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\Wsearch valueName: Start - valueType: Dword + valueType: REG_DWORD value: 4 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: TerminalServerTS_TEMP_DELETE type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: DeleteTempDirsOnExit - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: TerminalServerTS_TEMP_PER_SESSION type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: PerSessionTempDir - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: TerminalServerTS_USER_AUTHENTICATION_POLICY type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services valueName: UserAuthentication - valueType: Dword + valueType: REG_DWORD value: 1 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UseAdminApprovalMode type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: FilterAdministratorToken - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: UserRightsAccessCredentialManagerAsTrustedCaller type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/AccessCredentialManagerAsTrustedCaller - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeTrustedCredManAccessPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsAccessFromNetwork type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/AccessFromNetwork - type: array + name: SeNetworkLogonRight value: - '*S-1-5-32-544' - '*S-1-5-11' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsActAsPartOfTheOperatingSystem type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ActAsPartOfTheOperatingSystem - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeTcbPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsAllowLocalLogOn type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/AllowLocalLogOn - type: array + name: SeInteractiveLogonRight value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsAllowLogOnThroughRemoteDesktop type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/AllowLogOnThroughRemoteDesktop - type: array + name: SeRemoteInteractiveLogonRight value: - '*S-1-5-32-544' - '*S-1-5-32-555' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsBackupFilesAndDirectories type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/BackupFilesAndDirectories - type: array + name: SeBackupPrivilege value: - '*S-1-5-32-544' - '*S-1-5-32-551' - '*S-1-5-32-549' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsBypassTraverseChecking type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/BypassTraverseChecking - type: array + name: SeChangeNotifyPrivilege value: - '*S-1-5-32-544' - '*S-1-5-11' - '*S-1-5-32-551' - '*S-1-5-19' - '*S-1-5-20' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsChangeSystemTime type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ChangeSystemTime - type: array + name: SeSystemtimePrivilege value: - '*S-1-5-32-544' - '*S-1-5-32-549' - '*S-1-5-19' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsChangeTimeZone type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ChangeTimeZone - type: array + name: SeTimeZonePrivilege value: - '*S-1-5-32-544' - '*S-1-5-19' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsCreateGlobalObjects type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/CreateGlobalObjects - type: array + name: SeCreateGlobalPrivilege value: - '*S-1-5-32-544' - '*S-1-5-6' - '*S-1-5-19' - '*S-1-5-20' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsCreatePageFile type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/CreatePageFile - type: array + name: SeCreatePagefilePrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsCreatePermanentSharedObjects type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/CreatePermanentSharedObjects - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeCreatePermanentPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsCreateSymbolicLinks type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/CreateSymbolicLinks - type: array + name: SeCreateSymbolicLinkPrivilege value: - '*S-1-5-32-544' - '*S-1-5-83-0' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsCreateToken type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/CreateToken - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeCreateTokenPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsDenyAccessFromNetwork type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/DenyAccessFromNetwork - type: array + name: SeDenyNetworkLogonRight value: - '*S-1-5-32-546' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsDenyLocalLogOn type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/DenyLocalLogOn - type: array + name: SeDenyInteractiveLogonRight value: - '*S-1-5-32-546' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsDenyLogOnAsBatchJob type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/DenyLogOnAsBatchJob - type: array + name: SeDenyBatchLogonRight value: - '*S-1-5-32-546' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsDenyLogOnAsService type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/DenyLogOnAsService - type: array + name: SeDenyServiceLogonRight value: - '*S-1-5-32-546' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsDenyRemoteDesktopServicesLogOn type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/DenyRemoteDesktopServicesLogOn - type: array + name: SeDenyRemoteInteractiveLogonRight value: - '*S-1-5-32-546' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsEnableDelegation type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/EnableDelegation - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeEnableDelegationPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsGenerateSecurityAudits type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/GenerateSecurityAudits - type: array + name: SeAuditPrivilege value: - '*S-1-5-19' - '*S-1-5-20' - '*S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsIncreaseProcessWorkingSet type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/IncreaseProcessWorkingSet - type: array + name: SeIncreaseWorkingSetPrivilege value: - '*S-1-5-32-544' - '*S-1-5-19' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsIncreaseSchedulingPriority type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/IncreaseSchedulingPriority - type: array + name: SeIncreaseBasePriorityPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsLoadUnloadDeviceDrivers type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/LoadUnloadDeviceDrivers - type: array + name: SeLoadDriverPrivilege value: - '*S-1-5-32-544' - '*S-1-5-32-550' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsLockMemory type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/LockMemory - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeLockMemoryPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsManageAuditingAndSecurityLog type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ManageAuditingAndSecurityLog - type: array + name: SeSecurityPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsManageVolume type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ManageVolume - type: array + name: SeManageVolumePrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsModifyFirmwareEnvironment type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ModifyFirmwareEnvironment - type: array + name: SeSystemEnvironmentPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsModifyObjectLabel type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ModifyObjectLabel - type: string - value: '' - schema: - oneOf: - - const: '' - - type: 'null' + name: SeRelabelPrivilege + value: [] + expression: value == null || value.size() == 0 + template: The value {value} must be unassigned (no principals). - name: UserRightsProfileSingleProcess type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ProfileSingleProcess - type: array + name: SeProfileSingleProcessPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsProfileSystemPerformance type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ProfileSystemPerformance - type: array + name: SeSystemProfilePrivilege value: - '*S-1-5-32-544' - '*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsRemoteShutdown type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/RemoteShutdown - type: array + name: SeRemoteShutdownPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsReplaceProcessLevelToken type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ReplaceProcessLevelToken - type: array + name: SeAssignPrimaryTokenPrivilege value: - '*S-1-5-19' - '*S-1-5-20' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsRestoreFilesAndDirectories type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/RestoreFilesAndDirectories - type: array + name: SeRestorePrivilege value: - '*S-1-5-32-544' - '*S-1-5-32-551' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsShutDownTheSystem type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/ShutDownTheSystem - type: array + name: SeShutdownPrivilege value: - '*S-1-5-32-544' - '*S-1-5-32-551' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: UserRightsTakeOwnership type: Microsoft.OSConfig/Test properties: resource: - type: Microsoft.Windows/CSP + type: Microsoft.Windows/UserRightsAssignment properties: - path: ./Vendor/MSFT/Policy/Result/UserRights/TakeOwnership - type: array + name: SeTakeOwnershipPrivilege value: - '*S-1-5-32-544' - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: VirtualizeFileAndRegistryWriteFailuresToPerUserLocations type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: EnableVirtualization - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsDefenderRealTimeProtectionDisableBehaviorMonitoring type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection valueName: DisableBehaviorMonitoring - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: WindowsDefenderScanDisableEmailScanning type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan valueName: DisableEmailScanning - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: WindowsDefenderScanDisableRemovableDriveScanning type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan valueName: DisableRemovableDriveScanning - valueType: Dword + valueType: REG_DWORD value: 0 - schema: - oneOf: - - const: 0 - - type: 'null' + expression: ((((value == 0)) || ((value == null)))) + template: The value {value} must be one of 0, (not set). - name: WindowsDefenderSpyNetLocalSettingOverrideSpynetReporting type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet valueName: LocalSettingOverrideSpynetReporting - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: WindowsDefenderSpyNetSubmitSamplesConsent type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet valueName: SubmitSamplesConsent - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsExplorerShellProtocolProtectedModeTitle_2 type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer valueName: PreXPSP2ShellProtocolBehavior - valueType: Dword + valueType: REG_DWORD value: 0 - schema: {} + expression: 'true' + template: The value {value} is informational for this control. - name: WindowsLogonAllowAutomaticRestartSignOn type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System valueName: DisableAutomaticRestartSignOn - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsLogonDisableLockScreenAppNotifications type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System valueName: DisableLockScreenAppNotifications - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsLogonDontDisplayNetworkSelectionUI type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System valueName: DontDisplayNetworkSelectionUI - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: WindowsPowerShellTurnOnPowerShellScriptBlockLogging type: Microsoft.OSConfig/Test properties: resource: type: Microsoft.Windows/Registry properties: - keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging + keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging valueName: EnableScriptBlockLogging - valueType: Dword + valueType: REG_DWORD value: 1 - schema: - oneOf: - - const: 1 - - type: 'null' + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). diff --git a/scripts/new-machine-configuration-package.ps1 b/scripts/new-machine-configuration-package.ps1 new file mode 100644 index 0000000..e8f3e5c --- /dev/null +++ b/scripts/new-machine-configuration-package.ps1 @@ -0,0 +1,134 @@ +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. + +#requires -Version 7.1 + +[CmdletBinding()] +param( + [Parameter(Mandatory)] + [string]$Name, + + [Parameter(Mandatory)] + [ValidateScript({ Test-Path $_ -PathType Leaf })] + [string]$Configuration, + + [Parameter(Mandatory)] + [ValidateSet('Audit', 'AuditAndSet')] + [string]$Type, + + [Parameter(Mandatory)] + [string]$Path, + + [version]$Version = '1.0.0', + + [ValidateRange(15, 1440)] + [int]$FrequencyMinutes = 15 +) + +$ErrorActionPreference = 'Stop' +$ProgressPreference = 'SilentlyContinue' + +Import-Module GuestConfiguration -ErrorAction Stop + +$outputDirectory = New-Item -ItemType Directory -Path $Path -Force +$package = New-GuestConfigurationPackage ` + -Name $Name ` + -Configuration (Get-Item $Configuration) ` + -Version $Version.ToString() ` + -Type $Type ` + -FrequencyMinutes $FrequencyMinutes ` + -Path $outputDirectory ` + -Force + +if ($Type -eq 'AuditAndSet') { + $vulnerableCall = + 'Invoke-Native exec resource --correlation-id $(Get-CorrelationId) ' + + '--correlation-group $this.CorrelationGroup --mode set --name $this.Name ' + + '--type $this.type --properties $ResourceProperties' + $fixedCall = + 'Invoke-Native exec resource --correlation-id $(Get-CorrelationId) ' + + '--correlation-group $this.CorrelationGroup --mode set --name $this.Name ' + + '--type $this.type --properties ' + + '(ConvertTo-Json -InputObject $ResourceProperties -Compress -Depth 32)' + $targets = @( + 'Modules\Microsoft.OSConfig\classes\OSConfig.ps1', + 'Modules\Microsoft.OSConfig\Microsoft.OSConfig.psm1' + ) + $temporaryDirectory = Join-Path ` + ([IO.Path]::GetTempPath()) ` + "configforge-machine-configuration-$([guid]::NewGuid().ToString('N'))" + + try { + Expand-Archive -Path $package.Path -DestinationPath $temporaryDirectory + $encoding = [Text.UTF8Encoding]::new($false) + + foreach ($relativePath in $targets) { + $target = Join-Path $temporaryDirectory $relativePath + if (-not (Test-Path $target -PathType Leaf)) { + throw "The Machine Configuration package is missing $relativePath." + } + + $content = [IO.File]::ReadAllText($target) + $vulnerableCount = [regex]::Matches( + $content, + [regex]::Escape($vulnerableCall) + ).Count + $fixedCount = [regex]::Matches( + $content, + [regex]::Escape($fixedCall) + ).Count + + if ($vulnerableCount -eq 1 -and $fixedCount -eq 0) { + [IO.File]::WriteAllText( + $target, + $content.Replace($vulnerableCall, $fixedCall), + $encoding + ) + } elseif ($vulnerableCount -ne 0 -or $fixedCount -ne 1) { + throw ( + "Unsupported Microsoft.OSConfig Set wrapper in ${relativePath}: " + + "vulnerable=$vulnerableCount fixed=$fixedCount." + ) + } + } + + $marker = [ordered]@{ + patch = 'Microsoft.OSConfig.SetJsonSerialization' + reason = + 'The 1.4.3 DSC Set wrapper passes a PSCustomObject to a String[] ' + + 'native boundary. ConfigForge serializes it as compressed JSON.' + targets = $targets + } + $marker | + ConvertTo-Json -Depth 4 | + Set-Content ` + -Path (Join-Path $temporaryDirectory 'ConfigForge.compatibility.json') ` + -Encoding utf8NoBOM + + Remove-Item -LiteralPath $package.Path -Force + Add-Type -AssemblyName System.IO.Compression.FileSystem + [IO.Compression.ZipFile]::CreateFromDirectory( + $temporaryDirectory, + $package.Path, + [IO.Compression.CompressionLevel]::Optimal, + $false + ) + } finally { + if (Test-Path $temporaryDirectory) { + Remove-Item -LiteralPath $temporaryDirectory -Recurse -Force + } + } +} + +[pscustomobject]@{ + PSTypeName = 'ConfigForge.MachineConfigurationPackage' + Name = $package.Name + Path = $package.Path + Type = $Type + Version = $Version.ToString() + CompatibilityPatch = if ($Type -eq 'AuditAndSet') { + 'Microsoft.OSConfig.SetJsonSerialization' + } else { + $null + } +} diff --git a/scripts/new-machine-configuration-package.test.mjs b/scripts/new-machine-configuration-package.test.mjs new file mode 100644 index 0000000..fddd65b --- /dev/null +++ b/scripts/new-machine-configuration-package.test.mjs @@ -0,0 +1,40 @@ +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. + +import { readFile } from 'node:fs/promises'; +import path from 'node:path'; +import { fileURLToPath } from 'node:url'; +import { describe, expect, it } from 'vitest'; + +const here = path.dirname(fileURLToPath(import.meta.url)); +const scriptPath = path.join(here, 'new-machine-configuration-package.ps1'); + +describe('Machine Configuration package compatibility helper', () => { + it('patches both copies of the Microsoft.OSConfig Set wrapper', async () => { + const script = await readFile(scriptPath, 'utf8'); + + expect(script).toContain( + 'Modules\\Microsoft.OSConfig\\classes\\OSConfig.ps1', + ); + expect(script).toContain( + 'Modules\\Microsoft.OSConfig\\Microsoft.OSConfig.psm1', + ); + expect(script).toContain( + '(ConvertTo-Json -InputObject $ResourceProperties -Compress -Depth 32)', + ); + expect(script).toContain( + "patch = 'Microsoft.OSConfig.SetJsonSerialization'", + ); + }); + + it('fails closed when the wrapper shape is unknown', async () => { + const script = await readFile(scriptPath, 'utf8'); + + expect(script).toContain( + 'Unsupported Microsoft.OSConfig Set wrapper', + ); + expect(script).toContain( + 'vulnerable=$vulnerableCount fixed=$fixedCount', + ); + }); +}); diff --git a/scripts/release-metadata.test.mjs b/scripts/release-metadata.test.mjs index 43c1447..fab79ae 100644 --- a/scripts/release-metadata.test.mjs +++ b/scripts/release-metadata.test.mjs @@ -177,8 +177,8 @@ describe('public release metadata', () => { expect(contributing).toContain('creates immutable release tags and draft'); expect(support).toContain('The current repository maintainer is'); expect(readme).toContain('for ownership, active-branch, review, release, and cherry-pick guidance'); - expect(security).toContain('v0.3.98'); - expect(security).toContain('mac-v0.3.98-author.1'); + expect(security).toContain('v0.3.101'); + expect(security).toContain('mac-v0.3.101-author.1'); expect(security).toContain('Microsoft Security Response Center'); expect(security).toContain('Microsoft OSConfig project'); expect(support).toContain('best-effort basis'); diff --git a/scripts/ship-mac.ps1 b/scripts/ship-mac.ps1 index c0a9340..91988e2 100644 --- a/scripts/ship-mac.ps1 +++ b/scripts/ship-mac.ps1 @@ -21,7 +21,7 @@ because we forgot step 1 on an earlier author release and had to retry). .PARAMETER Tag - The release tag, e.g. "mac-v0.3.98-author.1". Must already exist as a + The release tag, e.g. "mac-v0.3.101-author.1". Must already exist as a git tag on the mac-author-build branch and be pushed to origin. .PARAMETER ReleaseTitle @@ -35,10 +35,10 @@ Optional path to a release-notes file. Cannot be combined with -Notes. .EXAMPLE - .\scripts\ship-mac.ps1 -Tag mac-v0.3.98-author.1 + .\scripts\ship-mac.ps1 -Tag mac-v0.3.101-author.1 .EXAMPLE - .\scripts\ship-mac.ps1 -Tag mac-v0.3.98-author.1 -NotesFile .\apps\desktop\build\release-notes-author.md + .\scripts\ship-mac.ps1 -Tag mac-v0.3.101-author.1 -NotesFile .\apps\desktop\build\release-notes-author.md #> [CmdletBinding()] diff --git a/scripts/ws2022-baseline-repair/README.md b/scripts/ws2022-baseline-repair/README.md new file mode 100644 index 0000000..58a0aa3 --- /dev/null +++ b/scripts/ws2022-baseline-repair/README.md @@ -0,0 +1,194 @@ +# WS2022 baseline repair + +Deterministic, evidence-backed repair of the three bundled Windows Server 2022 +security baselines in `public/_baselines/`: + +- `ws2022-domain-member.osc.yaml` +- `ws2022-domain-controller.osc.yaml` +- `ws2022-workgroup-member.osc.yaml` + +## Why + +The WS2022 baselines shipped in their original generated form. Roughly 30% of +each profile (71–73 rules) addressed audit policy, user rights and account +policy through `Microsoft.Windows/CSP` at `./Vendor/MSFT/Policy/Result/...`. +That address only resolves through OMA-DM, so on a standalone (non-MDM) server +those settings come back **unread** instead of compliant/non-compliant. The +same profiles also used colon-less registry hive prefixes +(`HKEY_LOCAL_MACHINE\...`), legacy value-type aliases (`Dword`, `String`, +`MultiString`) and ambiguous `schema: {}` compliance blocks. + +WS2025 hit the identical defect and was repaired in PRs #82 and #93 by moving +each control onto a dedicated provider. This change applies the same, already +reviewed, mechanism to WS2022. + +## Conversion policy + +The WS2022 **desired value is authoritative**. Only the *mechanism* and +*addressing* are borrowed from WS2025. Preference order: + +1. `Microsoft.Windows/Registry` when the rule already had a registry donor. +2. `Microsoft.Windows/AuditPolicy` using the exact subcategory GUID. +3. `Microsoft.Windows/UserRightsAssignment` using the exact `Se*` right name. +4. `Microsoft.Windows/AccountPolicy` using the exact policy name. +5. Keep CSP only when no defensible dedicated mapping exists. + +Residual CSP after this change: **0 rules in all three profiles.** + +Ambiguous `schema: {}` blocks are never turned into an invented security +assertion. They become the WS2025 informational form (`expression: 'true'` +with a template that says so). Nothing is left as a silent downgrade: +`conversion-report.json` records every `assertionRestatement` and +`assertionDowngrade`. **After this change `assertionDowngrades` is empty in all +three profiles.** + +### Restored assertions (user rights that must be unassigned) + +7 rules per member profile (6 on the domain controller) carried the scalar +schema `{"oneOf":[{"const":""},{"type":"null"}]}` with a desired value of `""` +— i.e. *"this right must be granted to nobody"*. Because +`Microsoft.Windows/UserRightsAssignment` reads back a **list of principals**, +that scalar schema cannot be applied verbatim; it is restated over the list: + +```yaml +expression: value == null || value.size() == 0 +template: The value {value} must be unassigned (no principals). +``` + +`||` short-circuits in CEL, so `size()` is never applied to an unset value. +`size()` on a `UserRightsAssignment` principal list is already exercised in +this repo (`packages/core/src/import-export/index.test.ts`, `expression: +'value.size() == 2'`). The rules are: + +`UserRightsAccessCredentialManagerAsTrustedCaller`, +`UserRightsActAsPartOfTheOperatingSystem`, +`UserRightsCreatePermanentSharedObjects`, `UserRightsCreateToken`, +`UserRightsEnableDelegation` (member profiles only), `UserRightsLockMemory`, +`UserRightsModifyObjectLabel`. + +`translatePrincipalListSchema()` returns `null` for any other shape, so an +unreviewed schema still surfaces as an explicit downgrade rather than being +silently reinterpreted. + +## Files + +| File | Purpose | +| --- | --- | +| `csp-provider-map.json` | 81 reviewed CSP-path → dedicated-provider mappings, extracted from the WS2025 repair commit. Targets are **address only** — no WS2025 desired values. | +| `schema-expression-map.json` | 49 reviewed legacy-schema → CEL `expression`/`template` translations, keyed by (schema shape, value kind). | +| `conversion-report.json` | Per-rule provenance for the shipped YAML: source values, converted CSP paths, expansions, value reshapes, assertion restatements and downgrades, plus the live smoke result. Committed because CI checks out shallow for most jobs. | +| `derive-maps.mjs` | Regenerates the two mapping tables from the pinned evidence commits (both before *and* after states come from `git show`, never the working tree). Proves the tables are extraction, not invention. | +| `repair-ws2022-baselines.mjs` | The converter. Reads the pre-repair profiles from the pinned source commit and writes `public/_baselines/ws2022-*.osc.yaml` plus `conversion-report.json`. `--check` and `--report` are both read-only. | +| `repair-ws2022-baselines.test.mjs` | Unit coverage for the mapping tables and normalisers. Re-derives every mapping claim from the pinned commits rather than trusting the committed tables. | + +Shipped-YAML assertions (counts, provider payload validity, rule parity, +desired-value preservation) live in +`apps/desktop/src/data/ws2022-baselines.test.ts`. + +## Evidence commits + +Every artifact is loaded with `git show :`. The working +tree is never read, and abbreviated SHAs, branch names and `HEAD` are all +rejected, because they are mutable. `derive-maps.mjs` verifies before it derives +anything that each pinned SHA resolves to itself and is an **ancestor of +`origin/main`**; `repair-ws2022-baselines.test.mjs` asserts the same pins and +the same ancestry. + +| Role | Full SHA | What it provides | +| --- | --- | --- | +| `providerBeforeCommit` | `ab71aaf778a87322899a671e6d06bce0fa40aa2a` | WS2025 in its generated `./Vendor/MSFT/Policy/Result/...` CSP form. | +| `providerAfterCommit` | `50d469c3cf5e16729f1359538b10ef4bc0b6de78` | *fix(baselines): repair WS2025 standalone audits* — CSP moved onto dedicated providers. Source of `csp-provider-map.json`. | +| `schemaBeforeCommit` | `50d469c3cf5e16729f1359538b10ef4bc0b6de78` | Same commit: dedicated providers, legacy `schema:` compliance blocks. | +| `schemaAfterCommit` | `37ab26a74bd7a6aa7f6df9a6ecc0fba3a7521821` | *fix(compliance): preserve CLI Test reasons* — `schema:` replaced by `expression:` + `template:`. Source of `schema-expression-map.json`. | +| `ws2022SourceCommit` | `173177e9eaa34d0b910b44d0749192859831fd50` | Last commit carrying the original generated WS2022 profiles. Pinned conversion input. | + +The overlap is deliberate: `50d469c` is the *after* state for the provider +mapping and the *before* state for the schema translation, which is exactly how +the two reviewed changes were layered onto `main`. + +## Re-running + +```bash +# Verify the mapping tables still match the evidence commits +node scripts/ws2022-baseline-repair/derive-maps.mjs --check + +# Verify the shipped baselines still match the deterministic conversion +node scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs --check + +# Human-readable summary of what the conversion did — READ-ONLY, writes nothing +node scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs --report + +# Regenerate (writes public/_baselines/ws2022-*.osc.yaml + conversion-report.json). +# Writing happens only when neither --check nor --report is given. +node scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs +``` + +Both scripts require full git history (they read the pinned evidence commits). +The vitest suites read committed files for their core assertions; the +evidence-re-derivation tests additionally need history, which is why the CI +`test` job checks out with `fetch-depth: 0`. Those tests skip on a shallow +local clone but are **mandatory whenever `CI` is set**. + +## Result + +| Profile | Rules before → after | CSP before → after | keyPaths normalised | Shape repairs | Assertion restatements | Assertion downgrades | +| --- | --- | --- | --- | --- | --- | --- | +| `ws2022-domain-member` | 257 → 259 | 73 → 0 | 184 | 5 | 7 | 0 | +| `ws2022-domain-controller` | 242 → 244 | 71 → 0 | 171 | 4 | 6 | 0 | +| `ws2022-workgroup-member` | 200 → 202 | 71 → 0 | 129 | 3 | 7 | 0 | + +Per-profile providers after the repair: + +| Profile | Registry | AuditPolicy | UserRightsAssignment | AccountPolicy | +| --- | --- | --- | --- | --- | +| `ws2022-domain-member` | 184 | 26 | 36 | 13 | +| `ws2022-domain-controller` | 171 | 32 | 28 | 13 | +| `ws2022-workgroup-member` | 129 | 26 | 36 | 11 | + +## Live smoke evidence (not native WS2022 validation) + +The `ws2022-workgroup-member` profile was executed with `oscfg` +**1.3.12-preview5** on a +**Windows Server 2025** host — *not* a Windows Server 2022 host: + +| Baseline | Compliant | Non-compliant | Read errors | +| --- | --- | --- | --- | +| Shipped (pre-repair) | 171 | — | **29** | +| Repaired | **200** | 2 | **0** | + +The 29 unreadable settings are exactly the symptom this change removes, and the +2 non-compliant results are genuine findings on that host rather than read +failures. **This is a mechanism check, not a Windows Server 2022 validation:** +the profile ran against a WS2025 machine, so the settings' *values* are not +meaningful for WS2022 and no conclusion about WS2022 support should be drawn +from it. The same numbers are recorded in `conversion-report.json` under +`_provenance.liveSmoke`, with the caveat inline. + +The +2 rule delta per profile is the composite `AccountLockoutPolicy` CSP +string expanding into three separate `AccountPolicy` rules +(`LockoutDuration`, `LockoutThreshold`, `LockoutReset`), matching the WS2025 +suffix convention. + +## Known limitations + +- **OSConfig security baseline support is officially Windows Server 2025 only.** + WS2022 remains best-effort. The repaired profiles use the same providers the + WS2025 baselines ship with, but Microsoft does not support the OSConfig + security baseline scenario on WS2022. +- **No hardware validation was performed on Windows Server 2022.** See "Live + smoke evidence" above: the repaired profile was executed on a Windows Server + **2025** host, which proves the settings become readable but says nothing + about WS2022 behaviour. +- **29 of 36 `UserRightsAssignment` rules are informational** (`expression: + 'true'`) — 22 of 28 on the domain controller. Their source carried an empty + `schema: {}`, so there is no constraint to restate; this matches shipped + WS2025, where all 39 user-rights rules are informational. The remaining + 7/6/7 rules are **not** downgraded: see "Restored assertions" below. +- **`UserRightsDenyAccessFromNetwork` keeps a real desired value but an + informational assertion.** Its source schema was `{}`, so asserting the + principal list would be an invented constraint. +- **The `{maximum: N}` CEL form has no golden WS2025 precedent.** It is the + symmetric counterpart of the reviewed `{minimum: N}` form. +- **A small number of Registry rules carry no desired value** (read-only or + informational upstream). Their addressing is repaired; their assertion stays + informational. diff --git a/scripts/ws2022-baseline-repair/conversion-report.json b/scripts/ws2022-baseline-repair/conversion-report.json new file mode 100644 index 0000000..4a84ce7 --- /dev/null +++ b/scripts/ws2022-baseline-repair/conversion-report.json @@ -0,0 +1,4672 @@ +{ + "_provenance": { + "description": "Per-profile provenance for the WS2022 Policy CSP repair. Committed so the shipped baselines can be validated without git history (CI checks out shallow).", + "sourceCommit": "173177e9eaa34d0b910b44d0749192859831fd50", + "source": "173177e9eaa34d0b910b44d0749192859831fd50:public/_baselines/ws2022-*.osc.yaml", + "regenerate": "node scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs", + "verify": "node scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs --check", + "liveSmoke": { + "profile": "ws2022-workgroup-member.osc.yaml", + "host": "Windows Server 2025 (not Windows Server 2022)", + "oscfgVersion": "1.3.12-preview5", + "shipped": { + "compliant": 171, + "readErrors": 29 + }, + "repaired": { + "compliant": 200, + "nonCompliant": 2, + "readErrors": 0 + }, + "caveat": "Executed on Windows Server 2025 hardware, so it demonstrates that the repaired provider addressing reads on a standalone machine. It is NOT native Windows Server 2022 validation, and the 2 non-compliant results are genuine findings on that host rather than read failures." + } + }, + "profiles": [ + { + "profile": "ws2022-domain-member.osc.yaml", + "sourceRules": 257, + "outputRules": 259, + "sourceCsp": 73, + "convertedCsp": 73, + "residualCsp": [], + "keyPathNormalized": 184, + "providerCounts": { + "Microsoft.Windows/AccountPolicy": 13, + "Microsoft.Windows/Registry": 184, + "Microsoft.Windows/AuditPolicy": 26, + "Microsoft.Windows/UserRightsAssignment": 36 + }, + "expansions": [ + { + "name": "AccountLockoutPolicy", + "into": [ + "AccountLockoutPolicy", + "AccountLockoutPolicy_LockoutThreshold", + "AccountLockoutPolicy_LockoutReset" + ] + } + ], + "registryShapeRepairs": [ + { + "name": "NetworkProviderHardenedPathsNETLOGON", + "from": { + "valueType": "REG_DWORD", + "value": [ + "RequireMutualAuthentication=1", + "RequireIntegrity=1" + ] + }, + "to": { + "valueType": "REG_SZ", + "value": "RequireMutualAuthentication=1, RequireIntegrity=1" + }, + "evidence": "ws2025-member-server:NetworkProviderHardenedPathsNETLOGON" + }, + { + "name": "NetworkProviderHardenedPathsSYSVOL", + "from": { + "valueType": "REG_DWORD", + "value": [ + "RequireMutualAuthentication=1", + "RequireIntegrity=1" + ] + }, + "to": { + "valueType": "REG_SZ", + "value": "RequireMutualAuthentication=1, RequireIntegrity=1" + }, + "evidence": "ws2025-member-server:NetworkProviderHardenedPathsSYSVOL" + }, + { + "name": "RemotelyAccessibleRegistryPaths", + "from": { + "valueType": "REG_DWORD", + "value": [ + "System\\CurrentControlSet\\Control\\ProductOptions", + "System\\CurrentControlSet\\Control\\Server Applications", + "Software\\Microsoft\\Windows NT\\CurrentVersion" + ] + }, + "to": { + "valueType": "REG_MULTI_SZ", + "value": [ + "System\\CurrentControlSet\\Control\\ProductOptions", + "System\\CurrentControlSet\\Control\\Server Applications", + "Software\\Microsoft\\Windows NT\\CurrentVersion" + ] + }, + "evidence": "ws2025-member-server:RemotelyAccessibleRegistryPaths" + }, + { + "name": "RemotelyAccessibleRegistryPathsAndSubpaths", + "from": { + "valueType": "REG_DWORD", + "value": [ + "System\\CurrentControlSet\\Control\\Print\\Printers", + "System\\CurrentControlSet\\Services\\Eventlog", + "Software\\Microsoft\\OLAP Server", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Print", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows", + "System\\CurrentControlSet\\Control\\ContentIndex", + "System\\CurrentControlSet\\Control\\Terminal Server", + "System\\CurrentControlSet\\Control\\Terminal Server\\UserConfig", + "System\\CurrentControlSet\\Control\\Terminal Server\\DefaultUserConfiguration", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Perflib", + "System\\CurrentControlSet\\Services\\SysmonLog" + ] + }, + "to": { + "valueType": "REG_MULTI_SZ", + "value": [ + "System\\CurrentControlSet\\Control\\Print\\Printers", + "System\\CurrentControlSet\\Services\\Eventlog", + "Software\\Microsoft\\OLAP Server", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Print", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows", + "System\\CurrentControlSet\\Control\\ContentIndex", + "System\\CurrentControlSet\\Control\\Terminal Server", + "System\\CurrentControlSet\\Control\\Terminal Server\\UserConfig", + "System\\CurrentControlSet\\Control\\Terminal Server\\DefaultUserConfiguration", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Perflib", + "System\\CurrentControlSet\\Services\\SysmonLog" + ] + }, + "evidence": "ws2025-member-server:RemotelyAccessibleRegistryPathsAndSubpaths" + }, + { + "name": "SharesThatCanBeAccessedAnonymously", + "from": { + "valueType": "REG_DWORD", + "value": [] + }, + "to": { + "valueType": "REG_MULTI_SZ", + "value": [] + }, + "evidence": "ws2025-member-server:SharesThatCanBeAccessedAnonymously" + } + ], + "assertionRestatements": [ + { + "name": "UserRightsAccessCredentialManagerAsTrustedCaller", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AccessCredentialManagerAsTrustedCaller", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsActAsPartOfTheOperatingSystem", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ActAsPartOfTheOperatingSystem", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsCreatePermanentSharedObjects", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreatePermanentSharedObjects", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsCreateToken", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreateToken", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsEnableDelegation", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/EnableDelegation", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsLockMemory", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/LockMemory", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsModifyObjectLabel", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ModifyObjectLabel", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + } + ], + "assertionDowngrades": [], + "valueChanges": [ + { + "name": "AccountLockoutPolicy", + "from": "ResetAccountLockoutCounterAfter:15, AccountLockoutDuration:15, AccountLockoutThreshold:3", + "to": 15 + }, + { + "name": "AllowAnonymousSIDOrNameTranslation", + "from": 0, + "to": false + }, + { + "name": "DeviceLockClearTextPassword", + "from": 0, + "to": false + }, + { + "name": "DeviceLockPasswordComplexity", + "from": 1, + "to": true + }, + { + "name": "EnableGuestAccountStatus", + "from": 0, + "to": false + }, + { + "name": "NetworkProviderHardenedPathsNETLOGON", + "from": [ + "RequireMutualAuthentication=1", + "RequireIntegrity=1" + ], + "to": "RequireMutualAuthentication=1, RequireIntegrity=1" + }, + { + "name": "NetworkProviderHardenedPathsSYSVOL", + "from": [ + "RequireMutualAuthentication=1", + "RequireIntegrity=1" + ], + "to": "RequireMutualAuthentication=1, RequireIntegrity=1" + }, + { + "name": "UserRightsAccessCredentialManagerAsTrustedCaller", + "from": "", + "to": [] + }, + { + "name": "UserRightsActAsPartOfTheOperatingSystem", + "from": "", + "to": [] + }, + { + "name": "UserRightsCreatePermanentSharedObjects", + "from": "", + "to": [] + }, + { + "name": "UserRightsCreateToken", + "from": "", + "to": [] + }, + { + "name": "UserRightsEnableDelegation", + "from": "", + "to": [] + }, + { + "name": "UserRightsLockMemory", + "from": "", + "to": [] + }, + { + "name": "UserRightsModifyObjectLabel", + "from": "", + "to": [] + } + ], + "conversions": [ + { + "name": "AccountLockoutPolicy", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/AccountLockoutPolicy", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockAccountLockoutPolicy", + "ws2025-member-server:DeviceLockAccountLockoutPolicy", + "ws2025-domain-controller:DeviceLockAccountLockoutPolicy" + ] + }, + { + "name": "AllowAnonymousSIDOrNameTranslation", + "cspPath": "./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/NetworkAccess_AllowAnonymousSIDOrNameTranslation", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:AllowAnonymousSIDOrNameTranslation", + "ws2025-member-server:AllowAnonymousSIDOrNameTranslation", + "ws2025-domain-controller:AllowAnonymousSIDOrNameTranslation" + ] + }, + { + "name": "AuditAccountLockout", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditAccountLockout", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditAccountLockout", + "ws2025-member-server:AuditAccountLockout", + "ws2025-domain-controller:AuditAccountLockout" + ] + }, + { + "name": "AuditAuthenticationPolicyChange", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditAuthenticationPolicyChange", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditAuthenticationPolicyChange", + "ws2025-member-server:AuditAuthenticationPolicyChange", + "ws2025-domain-controller:AuditAuthenticationPolicyChange" + ] + }, + { + "name": "AuditAuthorizationPolicyChange", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditAuthorizationPolicyChange", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditAuthorizationPolicyChange", + "ws2025-member-server:AuditAuthorizationPolicyChange", + "ws2025-domain-controller:AuditAuthorizationPolicyChange" + ] + }, + { + "name": "AuditChangeCategoryOther", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditOtherPolicyChangeEvents", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditOtherPolicyChangeEvents", + "ws2025-member-server:AuditOtherPolicyChangeEvents", + "ws2025-domain-controller:AuditOtherPolicyChangeEvents" + ] + }, + { + "name": "AuditCredentialValidation", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogon_AuditCredentialValidation", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditCredentialValidation", + "ws2025-member-server:AuditCredentialValidation", + "ws2025-domain-controller:AuditCredentialValidation" + ] + }, + { + "name": "AuditDetailedFileShare", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditDetailedFileShare", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditDetailedFileShare", + "ws2025-member-server:AuditDetailedFileShare", + "ws2025-domain-controller:AuditDetailedFileShare" + ] + }, + { + "name": "AuditFileShare", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditFileShare", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditFileShare", + "ws2025-member-server:AuditFileShare", + "ws2025-domain-controller:AuditFileShare" + ] + }, + { + "name": "AuditGroupMembership", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditGroupMembership", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditGroupMembership", + "ws2025-member-server:AuditGroupMembership", + "ws2025-domain-controller:AuditGroupMembership" + ] + }, + { + "name": "AuditIPsecDriver", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditIPsecDriver", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditIPsecDriver", + "ws2025-member-server:AuditIPsecDriver", + "ws2025-domain-controller:AuditIPsecDriver" + ] + }, + { + "name": "AuditLogoff", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditLogoff", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditLogoff", + "ws2025-member-server:AuditLogoff", + "ws2025-domain-controller:AuditLogoff" + ] + }, + { + "name": "AuditLogon", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditLogon", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditLogon", + "ws2025-member-server:AuditLogon", + "ws2025-domain-controller:AuditLogon" + ] + }, + { + "name": "AuditMPSSVCRuleLevelPolicyChange", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditMPSSVCRuleLevelPolicyChange", + "ws2025-member-server:AuditMPSSVCRuleLevelPolicyChange", + "ws2025-domain-controller:AuditMPSSVCRuleLevelPolicyChange" + ] + }, + { + "name": "AuditOtherLogonLogoffEvents", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditOtherLogonLogoffEvents", + "ws2025-member-server:AuditOtherLogonLogoffEvents", + "ws2025-domain-controller:AuditOtherLogonLogoffEvents" + ] + }, + { + "name": "AuditOtherObjectAccessEvents", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditOtherObjectAccessEvents", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditOtherObjectAccessEvents", + "ws2025-member-server:AuditOtherObjectAccessEvents", + "ws2025-domain-controller:AuditOtherObjectAccessEvents" + ] + }, + { + "name": "AuditOtherSystemEvents", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditOtherSystemEvents", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditOtherSystemEvents", + "ws2025-member-server:AuditOtherSystemEvents", + "ws2025-domain-controller:AuditOtherSystemEvents" + ] + }, + { + "name": "AuditPnPExternalDevice", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/DetailedTracking_AuditPNPActivity", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditPnPExternalDevice", + "ws2025-member-server:AuditPnPExternalDevice", + "ws2025-domain-controller:AuditPnPExternalDevice" + ] + }, + { + "name": "AuditPolicyChange", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditPolicyChange", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditPolicyChange", + "ws2025-member-server:AuditPolicyChange", + "ws2025-domain-controller:AuditPolicyChange" + ] + }, + { + "name": "AuditProcessCreatedOrStarted", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/DetailedTracking_AuditProcessCreation", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditProcessCreatedOrStarted", + "ws2025-member-server:AuditProcessCreatedOrStarted", + "ws2025-domain-controller:AuditProcessCreatedOrStarted" + ] + }, + { + "name": "AuditRemovableStorage", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditRemovableStorage", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditRemovableStorage", + "ws2025-member-server:AuditRemovableStorage", + "ws2025-domain-controller:AuditRemovableStorage" + ] + }, + { + "name": "AuditSecurityGroupManagement", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditSecurityGroupManagement", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSecurityGroupManagement", + "ws2025-member-server:AuditSecurityGroupManagement", + "ws2025-domain-controller:AuditSecurityGroupManagement" + ] + }, + { + "name": "AuditSecurityStateChange", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditSecurityStateChange", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSecurityStateChange", + "ws2025-member-server:AuditSecurityStateChange", + "ws2025-domain-controller:AuditSecurityStateChange" + ] + }, + { + "name": "AuditSecuritySystemExtension", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditSecuritySystemExtension", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSecuritySystemExtension", + "ws2025-member-server:AuditSecuritySystemExtension", + "ws2025-domain-controller:AuditSecuritySystemExtension" + ] + }, + { + "name": "AuditSensitivePrivilegeUse", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PrivilegeUse_AuditSensitivePrivilegeUse", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSensitivePrivilegeUse", + "ws2025-member-server:AuditSensitivePrivilegeUse", + "ws2025-domain-controller:AuditSensitivePrivilegeUse" + ] + }, + { + "name": "AuditSpecialLogon", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditSpecialLogon", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSpecialLogon", + "ws2025-member-server:AuditSpecialLogon", + "ws2025-domain-controller:AuditSpecialLogon" + ] + }, + { + "name": "AuditSystemIntegrity", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditSystemIntegrity", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSystemIntegrity", + "ws2025-member-server:AuditSystemIntegrity", + "ws2025-domain-controller:AuditSystemIntegrity" + ] + }, + { + "name": "AuditUserAccountManagement", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditUserAccountManagement", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditUserAccountManagement", + "ws2025-member-server:AuditUserAccountManagement", + "ws2025-domain-controller:AuditUserAccountManagement" + ] + }, + { + "name": "DeviceLockClearTextPassword", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/ClearTextPassword", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockClearTextPassword", + "ws2025-member-server:DeviceLockClearTextPassword", + "ws2025-domain-controller:DeviceLockClearTextPassword" + ] + }, + { + "name": "DeviceLockMaximumPasswordAge", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/MaximumPasswordAge", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockMaximumPasswordAge", + "ws2025-member-server:DeviceLockMaximumPasswordAge", + "ws2025-domain-controller:DeviceLockMaximumPasswordAge" + ] + }, + { + "name": "DeviceLockMinDevicePasswordLength", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/MinimumPasswordLength", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockMinimumPasswordLength", + "ws2025-member-server:DeviceLockMinimumPasswordLength" + ] + }, + { + "name": "DeviceLockMinimumPasswordAge", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/MinimumPasswordAge", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockMinimumPasswordAge", + "ws2025-member-server:DeviceLockMinimumPasswordAge", + "ws2025-domain-controller:DeviceLockMinimumPasswordAge" + ] + }, + { + "name": "DeviceLockPasswordComplexity", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/PasswordComplexity", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockPasswordComplexity", + "ws2025-member-server:DeviceLockPasswordComplexity", + "ws2025-domain-controller:DeviceLockPasswordComplexity" + ] + }, + { + "name": "DeviceLockPasswordHistorySize", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/PasswordHistorySize", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockPasswordHistorySize", + "ws2025-member-server:DeviceLockPasswordHistorySize", + "ws2025-domain-controller:DeviceLockPasswordHistorySize" + ] + }, + { + "name": "EnableGuestAccountStatus", + "cspPath": "./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:EnableGuestAccountStatus", + "ws2025-member-server:EnableGuestAccountStatus", + "ws2025-domain-controller:EnableGuestAccountStatus" + ] + }, + { + "name": "RenameAdministratorAccount", + "cspPath": "./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:RenameAdministratorAccount", + "ws2025-member-server:RenameAdministratorAccount", + "ws2025-domain-controller:RenameAdministratorAccount" + ] + }, + { + "name": "RenameGuestAccount", + "cspPath": "./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:RenameGuestAccount", + "ws2025-member-server:RenameGuestAccount", + "ws2025-domain-controller:RenameGuestAccount" + ] + }, + { + "name": "UserRightsAccessCredentialManagerAsTrustedCaller", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AccessCredentialManagerAsTrustedCaller", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsAccessCredentialManagerAsTrustedCaller", + "ws2025-member-server:UserRightsAccessCredentialManagerAsTrustedCaller", + "ws2025-domain-controller:UserRightsAccessCredentialManagerAsTrustedCaller" + ] + }, + { + "name": "UserRightsAccessFromNetwork", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AccessFromNetwork", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsAccessFromNetwork", + "ws2025-member-server:UserRightsAccessFromNetwork", + "ws2025-domain-controller:UserRightsAccessFromNetwork" + ] + }, + { + "name": "UserRightsActAsPartOfTheOperatingSystem", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ActAsPartOfTheOperatingSystem", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsActAsPartOfTheOperatingSystem", + "ws2025-member-server:UserRightsActAsPartOfTheOperatingSystem", + "ws2025-domain-controller:UserRightsActAsPartOfTheOperatingSystem" + ] + }, + { + "name": "UserRightsAdjustMemoryQuotasForProcess", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AdjustMemoryQuotasForProcess", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsAdjustMemoryQuotasForProcess", + "ws2025-member-server:UserRightsAdjustMemoryQuotasForProcess", + "ws2025-domain-controller:UserRightsAdjustMemoryQuotasForProcess" + ] + }, + { + "name": "UserRightsAllowLocalLogOn", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AllowLocalLogOn", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsAllowLocalLogOn", + "ws2025-member-server:UserRightsAllowLocalLogOn", + "ws2025-domain-controller:UserRightsAllowLocalLogOn" + ] + }, + { + "name": "UserRightsAllowLogOnThroughRemoteDesktop", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AllowLogOnThroughRemoteDesktop", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsAllowLogOnThroughRemoteDesktop", + "ws2025-member-server:UserRightsAllowLogOnThroughRemoteDesktop", + "ws2025-domain-controller:UserRightsAllowLogOnThroughRemoteDesktop" + ] + }, + { + "name": "UserRightsBackupFilesAndDirectories", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/BackupFilesAndDirectories", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsBackupFilesAndDirectories", + "ws2025-member-server:UserRightsBackupFilesAndDirectories", + "ws2025-domain-controller:UserRightsBackupFilesAndDirectories" + ] + }, + { + "name": "UserRightsBypassTraverseChecking", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/BypassTraverseChecking", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsBypassTraverseChecking", + "ws2025-member-server:UserRightsBypassTraverseChecking" + ] + }, + { + "name": "UserRightsChangeSystemTime", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ChangeSystemTime", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsChangeSystemTime", + "ws2025-member-server:UserRightsChangeSystemTime", + "ws2025-domain-controller:UserRightsChangeSystemTime" + ] + }, + { + "name": "UserRightsChangeTimeZone", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ChangeTimeZone", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsChangeTimeZone", + "ws2025-member-server:UserRightsChangeTimeZone", + "ws2025-domain-controller:UserRightsChangeTimeZone" + ] + }, + { + "name": "UserRightsCreateGlobalObjects", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreateGlobalObjects", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsCreateGlobalObjects", + "ws2025-member-server:UserRightsCreateGlobalObjects", + "ws2025-domain-controller:UserRightsCreateGlobalObjects" + ] + }, + { + "name": "UserRightsCreatePageFile", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreatePageFile", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsCreatePageFile", + "ws2025-member-server:UserRightsCreatePageFile", + "ws2025-domain-controller:UserRightsCreatePageFile" + ] + }, + { + "name": "UserRightsCreatePermanentSharedObjects", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreatePermanentSharedObjects", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsCreatePermanentSharedObjects", + "ws2025-member-server:UserRightsCreatePermanentSharedObjects", + "ws2025-domain-controller:UserRightsCreatePermanentSharedObjects" + ] + }, + { + "name": "UserRightsCreateSymbolicLinks", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreateSymbolicLinks", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsCreateSymbolicLinks", + "ws2025-member-server:UserRightsCreateSymbolicLinks", + "ws2025-domain-controller:UserRightsCreateSymbolicLinks" + ] + }, + { + "name": "UserRightsCreateToken", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreateToken", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsCreateToken", + "ws2025-member-server:UserRightsCreateToken", + "ws2025-domain-controller:UserRightsCreateToken" + ] + }, + { + "name": "UserRightsDenyAccessFromNetwork", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyAccessFromNetwork", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyAccessFromNetwork", + "ws2025-member-server:UserRightsDenyAccessFromNetwork", + "ws2025-domain-controller:UserRightsDenyAccessFromNetwork" + ] + }, + { + "name": "UserRightsDenyLocalLogOn", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyLocalLogOn", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyLocalLogOn", + "ws2025-member-server:UserRightsDenyLocalLogOn", + "ws2025-domain-controller:UserRightsDenyLocalLogOn" + ] + }, + { + "name": "UserRightsDenyLogOnAsBatchJob", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyLogOnAsBatchJob", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyLogOnAsBatchJob", + "ws2025-member-server:UserRightsDenyLogOnAsBatchJob", + "ws2025-domain-controller:UserRightsDenyLogOnAsBatchJob" + ] + }, + { + "name": "UserRightsDenyLogOnAsService", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyLogOnAsService", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyLogOnAsService", + "ws2025-member-server:UserRightsDenyLogOnAsService", + "ws2025-domain-controller:UserRightsDenyLogOnAsService" + ] + }, + { + "name": "UserRightsEnableDelegation", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/EnableDelegation", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsEnableDelegation", + "ws2025-member-server:UserRightsEnableDelegation", + "ws2025-domain-controller:UserRightsEnableDelegation" + ] + }, + { + "name": "UserRightsGenerateSecurityAudits", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/GenerateSecurityAudits", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsGenerateSecurityAudits", + "ws2025-member-server:UserRightsGenerateSecurityAudits", + "ws2025-domain-controller:UserRightsGenerateSecurityAudits" + ] + }, + { + "name": "UserRightsIncreaseProcessWorkingSet", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/IncreaseProcessWorkingSet", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsIncreaseProcessWorkingSet", + "ws2025-member-server:UserRightsIncreaseProcessWorkingSet" + ] + }, + { + "name": "UserRightsIncreaseSchedulingPriority", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/IncreaseSchedulingPriority", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsIncreaseSchedulingPriority", + "ws2025-member-server:UserRightsIncreaseSchedulingPriority", + "ws2025-domain-controller:UserRightsIncreaseSchedulingPriority" + ] + }, + { + "name": "UserRightsLoadUnloadDeviceDrivers", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/LoadUnloadDeviceDrivers", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsLoadUnloadDeviceDrivers", + "ws2025-member-server:UserRightsLoadUnloadDeviceDrivers", + "ws2025-domain-controller:UserRightsLoadUnloadDeviceDrivers" + ] + }, + { + "name": "UserRightsLockMemory", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/LockMemory", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsLockMemory", + "ws2025-member-server:UserRightsLockMemory", + "ws2025-domain-controller:UserRightsLockMemory" + ] + }, + { + "name": "UserRightsManageAuditingAndSecurityLog", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ManageAuditingAndSecurityLog", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsManageAuditingAndSecurityLog", + "ws2025-member-server:UserRightsManageAuditingAndSecurityLog", + "ws2025-domain-controller:UserRightsManageAuditingAndSecurityLog" + ] + }, + { + "name": "UserRightsManageVolume", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ManageVolume", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsManageVolume", + "ws2025-member-server:UserRightsManageVolume", + "ws2025-domain-controller:UserRightsManageVolume" + ] + }, + { + "name": "UserRightsModifyFirmwareEnvironment", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ModifyFirmwareEnvironment", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsModifyFirmwareEnvironment", + "ws2025-member-server:UserRightsModifyFirmwareEnvironment", + "ws2025-domain-controller:UserRightsModifyFirmwareEnvironment" + ] + }, + { + "name": "UserRightsModifyObjectLabel", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ModifyObjectLabel", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsModifyObjectLabel", + "ws2025-member-server:UserRightsModifyObjectLabel", + "ws2025-domain-controller:UserRightsModifyObjectLabel" + ] + }, + { + "name": "UserRightsProfileSingleProcess", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ProfileSingleProcess", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsProfileSingleProcess", + "ws2025-member-server:UserRightsProfileSingleProcess", + "ws2025-domain-controller:UserRightsProfileSingleProcess" + ] + }, + { + "name": "UserRightsProfileSystemPerformance", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ProfileSystemPerformance", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsProfileSystemPerformance", + "ws2025-member-server:UserRightsProfileSystemPerformance", + "ws2025-domain-controller:UserRightsProfileSystemPerformance" + ] + }, + { + "name": "UserRightsRemoteShutdown", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/RemoteShutdown", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsRemoteShutdown", + "ws2025-member-server:UserRightsRemoteShutdown", + "ws2025-domain-controller:UserRightsRemoteShutdown" + ] + }, + { + "name": "UserRightsReplaceProcessLevelToken", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ReplaceProcessLevelToken", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsReplaceProcessLevelToken", + "ws2025-member-server:UserRightsReplaceProcessLevelToken", + "ws2025-domain-controller:UserRightsReplaceProcessLevelToken" + ] + }, + { + "name": "UserRightsRestoreFilesAndDirectories", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/RestoreFilesAndDirectories", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsRestoreFilesAndDirectories", + "ws2025-member-server:UserRightsRestoreFilesAndDirectories", + "ws2025-domain-controller:UserRightsRestoreFilesAndDirectories" + ] + }, + { + "name": "UserRightsShutDownTheSystem", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ShutDownTheSystem", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsShutDownTheSystem", + "ws2025-member-server:UserRightsShutDownTheSystem", + "ws2025-domain-controller:UserRightsShutDownTheSystem" + ] + }, + { + "name": "UserRightsTakeOwnership", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/TakeOwnership", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsTakeOwnership", + "ws2025-member-server:UserRightsTakeOwnership", + "ws2025-domain-controller:UserRightsTakeOwnership" + ] + } + ], + "sourceRuleNames": [ + "AccountLockoutPolicy", + "AllowAnonymousSIDOrNameTranslation", + "AllowedToFormatAndEjectRemovableMedia", + "AllowICMPRedirectsToOverrideOSPFGeneratedRoutes", + "AllowLocalSystemNULLSessionFallback", + "AllowLocalSystemToUseComputerIdentityForNTLM", + "AllowSystemToBeShutDownWithoutHavingToLogOn", + "AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers", + "AllowUIAccessApplicationsToPromptForElevation", + "AmountOfIdleTimeRequiredBeforeSuspendingSession", + "ApplicationManagementMSIAllowUserControlOverInstall", + "ApplicationManagementMSIAlwaysInstallWithElevatedPrivileges", + "AppRuntimeAllowMicrosoftAccountsToBeOptional", + "AuditAccountLockout", + "AuditAuthenticationPolicyChange", + "AuditAuthorizationPolicyChange", + "AuditChangeCategoryOther", + "AuditCredentialValidation", + "AuditDetailedFileShare", + "AuditFileShare", + "AuditGroupMembership", + "AuditIPsecDriver", + "AuditLogoff", + "AuditLogon", + "AuditMPSSVCRuleLevelPolicyChange", + "AuditOtherLogonLogoffEvents", + "AuditOtherObjectAccessEvents", + "AuditOtherSystemEvents", + "AuditPnPExternalDevice", + "AuditPolicyChange", + "AuditProcessCreatedOrStarted", + "AuditRemovableStorage", + "AuditSecurityGroupManagement", + "AuditSecurityStateChange", + "AuditSecuritySystemExtension", + "AuditSensitivePrivilegeUse", + "AuditSettingsIncludeCmdLine", + "AuditSpecialLogon", + "AuditSystemIntegrity", + "AuditUserAccountManagement", + "AutoplayDisallowAutoplayForNonVolumeDevices", + "AutoplaySetDefaultAutoRunBehavior", + "AutoplayTurnOffAutoPlay", + "BehaviorOfTheElevationPromptForAdministrators", + "BehaviorOfTheElevationPromptForStandardUsers", + "ClearVirtualMemoryPageFile", + "ConfigureSMBV1Server", + "ConnectivityDisableDownloadingOfPrintDriversOverHTTP", + "ConnectivityProhibitInstallationAndConfigurationOfNetworkBridge", + "CredentialProvidersAllowPINLogon", + "CredentialsUIDisablePasswordReveal", + "CredentialsUIEnumerateAdministrators", + "CryptographyAllowedKerberosEncryptionTypes", + "CryptographyForceStrongKeyProtection", + "DetectApplicationInstallationsAndPromptForElevation", + "DeviceInstallationPreventDeviceMetadataFromNetwork", + "DeviceLockClearTextPassword", + "DeviceLockMaximumPasswordAge", + "DeviceLockMinDevicePasswordLength", + "DeviceLockMinimumPasswordAge", + "DeviceLockPasswordComplexity", + "DeviceLockPasswordHistorySize", + "DigitallyEncryptOrSignSecureChannelDataAlways", + "DigitallyEncryptSecureChannelDataWhenPossible", + "DigitallySignCommunicationsAlwaysClient", + "DigitallySignCommunicationsAlwaysServer", + "DigitallySignCommunicationsIfClientAgrees", + "DigitallySignCommunicationsIfServerAgrees", + "DigitallySignSecureChannelDataWhenPossible", + "DisableLocalAccountPasswordChanges", + "DisconnectClientsWhenLogonHoursExpire", + "DnsClientTurn_Off_Multicast", + "DoNotAllowAnonymousEnumerationOfSAMAccounts", + "DoNotAllowAnonymousEnumerationOfSamAccountsAndShares", + "DoNotDisplayLastSignedIn", + "DoNotRequireCTRLALTDEL", + "EnableGuestAccountStatus", + "EnableStructuredExceptionHandlingOverwriteProtection", + "EventLogChannelSecurityLogRetention", + "EventLogChannelSetupLogMaxSize", + "EventLogChannelSetupLogRetention", + "EventLogChannelSystemLogRetention", + "EventLogPercentageThresholdSecurityEventLogMaximumSizeReached", + "EventLogServiceControlEventLogBehavior", + "EventLogServiceSpecifyMaximumFileSizeApplicationLog", + "EventLogServiceSpecifyMaximumFileSizeSecurityLog", + "EventLogServiceSpecifyMaximumFileSizeSystemLog", + "ExperienceAllowWindowsConsumerFeatures", + "ExperienceDisableConsumerAccountStateContent", + "ExperienceDoNotShowFeedbackNotifications", + "FileExplorerTurnOffHeapTerminationOnCorruption", + "FirewallDomainProfileApplyLocalConnectionSecurityRules", + "FirewallDomainProfileApplyLocalFirewallRules", + "FirewallDomainProfileDisplayNotification", + "FirewallDomainProfileInboundConnection", + "FirewallDomainProfileLogDroppedPackets", + "FirewallDomainProfileLogFileMaxSize", + "FirewallDomainProfileLogFileName", + "FirewallDomainProfileLogSuccessfulConnections", + "FirewallDomainProfileOutboundConnection", + "FirewallDomainProfileState", + "FirewallDomainProfileUnicastResponse", + "FirewallPrivateProfileApplyLocalConnectionSecurityRules", + "FirewallPrivateProfileApplyLocalFirewallRules", + "FirewallPrivateProfileDisplayNotification", + "FirewallPrivateProfileInboundConnection", + "FirewallPrivateProfileLogDroppedPackets", + "FirewallPrivateProfileLogFileMaxSize", + "FirewallPrivateProfileLogFileName", + "FirewallPrivateProfileLogSuccessfulConnections", + "FirewallPrivateProfileOutboundConnection", + "FirewallPrivateProfileState", + "FirewallPrivateProfileUnicastResponse", + "FirewallPublicProfileApplyLocalConnectionSecurityRules", + "FirewallPublicProfileApplyLocalFirewallRules", + "FirewallPublicProfileDisplayNotification", + "FirewallPublicProfileInboundConnection", + "FirewallPublicProfileLogDroppedPackets", + "FirewallPublicProfileLogFileMaxSize", + "FirewallPublicProfileLogFileName", + "FirewallPublicProfileLogSuccessfulConnections", + "FirewallPublicProfileOutboundConnection", + "FirewallPublicProfileState", + "FirewallPublicProfileUnicastResponse", + "ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings", + "GroupPolicyDisableBackgroundPolicy", + "GroupPolicyEnableCDP", + "GroupPolicyNoBackgroundPolicy", + "GroupPolicyNoGPOListChanges", + "ICMNC_ExitOnISP", + "IPSourceRoutingProtectionLevel", + "IPv6SourceRoutingProtectionLevel", + "LANManagerAuthenticationLevel", + "LanmanWorkstationEnableInsecureGuestLogons", + "LDAPClientSigningRequirements", + "LetEveryonePermissionsApplyToAnonymousUsers", + "LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly", + "LogonBlockUserFromShowingAccountDetailsOnSignin", + "LogonDontEnumerateConnectedUsers", + "LsaFIPSAlgorithmPolicySTE", + "LsaNoLMHash", + "MachineInactivityLimit", + "MaximumMachineAccountPasswordAge", + "MessageTextUserLogon", + "MessageTextUserLogonTitle", + "MinimumSessionSecurityForNTLMSSPBasedClients", + "MinimumSessionSecurityForNTLMSSPBasedServers", + "NetBTNodeTypeConfiguration", + "NetworkConnectionsNC_ShowSharedAccessUI", + "NetworkProviderHardenedPathsNETLOGON", + "NetworkProviderHardenedPathsSYSVOL", + "OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations", + "PowerShellExecutionPolicyEnableTranscripting", + "PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters", + "PrintersRestrictDriverInstallationToAdministrators", + "PrivacyAllowInputPersonalization", + "PromptUserToChangePasswordBeforeExpiration", + "RDPPortNumber", + "RemoteAssistanceSolicitedRemoteAssistance", + "RemoteAssistanceUnsolicitedRemoteAssistance", + "RemoteDesktopServicesClientConnectionEncryptionLevel", + "RemoteDesktopServicesDoNotAllowDriveRedirection", + "RemoteDesktopServicesDoNotAllowPasswordSaving", + "RemoteDesktopServicesPromptForPasswordUponConnection", + "RemoteDesktopServicesRequireSecureRPCCommunication", + "RemotelyAccessibleRegistryPaths", + "RemotelyAccessibleRegistryPathsAndSubpaths", + "RemoteManagementAllowBasicAuthentication_Client", + "RemoteManagementAllowUnencryptedTraffic_Client", + "RemoteManagementDisallowDigestAuthentication", + "RemoteManagementDisallowStoringOfRunAsCredentials", + "RenameAdministratorAccount", + "RenameGuestAccount", + "RequireCaseInsensitivityForNonWindowsSubsystems", + "RequireStrongSessionKey", + "RestrictAnonymousAccessToNamedPipesAndShares", + "RestrictClientsAllowedToMakeRemoteCallsToSAM", + "RSSDisableEnclosureDownload", + "RunAllAdministratorsInAdminApprovalMode", + "SafeDllSearchMode", + "SearchAllowIndexingEncryptedStoresOrItems", + "SendUnencryptedPasswordToThirdPartySMBServers", + "ServerSPNTargetNameValidationLevel", + "SharesThatCanBeAccessedAnonymously", + "SharingAndSecurityModelForLocalAccounts", + "ShellDataExecutionPrevention", + "ShutdownSystemImmediatelyIfUnableToLogSecurityAudits", + "SmartScreenEnableSmartScreenInShell", + "StrengthenDefaultPermissionsOfInternalSystemObjects", + "SwitchToTheSecureDesktopWhenPromptingForElevation", + "SystemAllowTelemetry", + "SystemBootStartDriverInitialization", + "SystemEnableSoftwareRestrictionPolicies", + "SystemLogonCacheSize", + "SystemMinimizeInternetConnections", + "SystemWindowsSearchService", + "TerminalServerTS_TEMP_DELETE", + "TerminalServerTS_TEMP_PER_SESSION", + "TerminalServerTS_USER_AUTHENTICATION_POLICY", + "TurnOff_Windows_Error_Reporting", + "UseAdminApprovalMode", + "UserRightsAccessCredentialManagerAsTrustedCaller", + "UserRightsAccessFromNetwork", + "UserRightsActAsPartOfTheOperatingSystem", + "UserRightsAdjustMemoryQuotasForProcess", + "UserRightsAllowLocalLogOn", + "UserRightsAllowLogOnThroughRemoteDesktop", + "UserRightsBackupFilesAndDirectories", + "UserRightsBypassTraverseChecking", + "UserRightsChangeSystemTime", + "UserRightsChangeTimeZone", + "UserRightsCreateGlobalObjects", + "UserRightsCreatePageFile", + "UserRightsCreatePermanentSharedObjects", + "UserRightsCreateSymbolicLinks", + "UserRightsCreateToken", + "UserRightsDenyAccessFromNetwork", + "UserRightsDenyLocalLogOn", + "UserRightsDenyLogOnAsBatchJob", + "UserRightsDenyLogOnAsService", + "UserRightsEnableDelegation", + "UserRightsGenerateSecurityAudits", + "UserRightsIncreaseProcessWorkingSet", + "UserRightsIncreaseSchedulingPriority", + "UserRightsLoadUnloadDeviceDrivers", + "UserRightsLockMemory", + "UserRightsManageAuditingAndSecurityLog", + "UserRightsManageVolume", + "UserRightsModifyFirmwareEnvironment", + "UserRightsModifyObjectLabel", + "UserRightsProfileSingleProcess", + "UserRightsProfileSystemPerformance", + "UserRightsRemoteShutdown", + "UserRightsReplaceProcessLevelToken", + "UserRightsRestoreFilesAndDirectories", + "UserRightsShutDownTheSystem", + "UserRightsTakeOwnership", + "VirtualizeFileAndRegistryWriteFailuresToPerUserLocations", + "WindowsDefenderDisableAntiSpyware", + "WindowsDefenderExploitGuardASRExploitGuard_ASR_Rules", + "WindowsDefenderExploitGuardNetworkProtectionEnableNetworkProtection", + "WindowsDefenderPUAProtection", + "WindowsDefenderRealTimeProtectionDisableBehaviorMonitoring", + "WindowsDefenderRealTimeProtectionDisableIOAVProtection", + "WindowsDefenderRealTimeProtectionDisableRealtimeMonitoring", + "WindowsDefenderRealTimeProtectionDisableScriptScanning", + "WindowsDefenderScanDisableEmailScanning", + "WindowsDefenderScanDisableRemovableDriveScanning", + "WindowsDefenderSecurityCenterAppBrowserProtectionDisallowExploitProtectionOverride", + "WindowsDefenderSpyNetLocalSettingOverrideSpynetReporting", + "WindowsDefenderSpyNetSubmitSamplesConsent", + "WindowsExplorerShellProtocolProtectedModeTitle_2", + "WindowsLogonAllowAutomaticRestartSignOn", + "WindowsLogonDisableLockScreenAppNotifications", + "WindowsLogonDontDisplayNetworkSelectionUI", + "WindowsLogonEnumerateLocalUsersOnDomainJoinedComputers", + "WindowsPowerShellTurnOnPowerShellScriptBlockLogging" + ], + "sourceValues": { + "AccountLockoutPolicy": "ResetAccountLockoutCounterAfter:15, AccountLockoutDuration:15, AccountLockoutThreshold:3", + "AllowAnonymousSIDOrNameTranslation": 0, + "AllowedToFormatAndEjectRemovableMedia": "0", + "AllowICMPRedirectsToOverrideOSPFGeneratedRoutes": 0, + "AllowLocalSystemNULLSessionFallback": 0, + "AllowLocalSystemToUseComputerIdentityForNTLM": 1, + "AllowSystemToBeShutDownWithoutHavingToLogOn": 0, + "AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers": 1, + "AllowUIAccessApplicationsToPromptForElevation": 0, + "AmountOfIdleTimeRequiredBeforeSuspendingSession": 15, + "ApplicationManagementMSIAllowUserControlOverInstall": 0, + "ApplicationManagementMSIAlwaysInstallWithElevatedPrivileges": 0, + "AppRuntimeAllowMicrosoftAccountsToBeOptional": 1, + "AuditAccountLockout": 2, + "AuditAuthenticationPolicyChange": 1, + "AuditAuthorizationPolicyChange": 1, + "AuditChangeCategoryOther": 2, + "AuditCredentialValidation": 3, + "AuditDetailedFileShare": 2, + "AuditFileShare": 3, + "AuditGroupMembership": 1, + "AuditIPsecDriver": 3, + "AuditLogoff": 1, + "AuditLogon": 3, + "AuditMPSSVCRuleLevelPolicyChange": 3, + "AuditOtherLogonLogoffEvents": 3, + "AuditOtherObjectAccessEvents": 3, + "AuditOtherSystemEvents": 3, + "AuditPnPExternalDevice": 1, + "AuditPolicyChange": 1, + "AuditProcessCreatedOrStarted": 1, + "AuditRemovableStorage": 3, + "AuditSecurityGroupManagement": 1, + "AuditSecurityStateChange": 1, + "AuditSecuritySystemExtension": 1, + "AuditSensitivePrivilegeUse": 3, + "AuditSettingsIncludeCmdLine": 1, + "AuditSpecialLogon": 1, + "AuditSystemIntegrity": 3, + "AuditUserAccountManagement": 3, + "AutoplayDisallowAutoplayForNonVolumeDevices": 1, + "AutoplaySetDefaultAutoRunBehavior": 1, + "AutoplayTurnOffAutoPlay": 255, + "BehaviorOfTheElevationPromptForAdministrators": 2, + "BehaviorOfTheElevationPromptForStandardUsers": 0, + "ClearVirtualMemoryPageFile": 0, + "ConfigureSMBV1Server": 0, + "ConnectivityDisableDownloadingOfPrintDriversOverHTTP": 1, + "ConnectivityProhibitInstallationAndConfigurationOfNetworkBridge": 0, + "CredentialProvidersAllowPINLogon": 0, + "CredentialsUIDisablePasswordReveal": 1, + "CredentialsUIEnumerateAdministrators": 0, + "CryptographyAllowedKerberosEncryptionTypes": 2147483640, + "CryptographyForceStrongKeyProtection": 2, + "DetectApplicationInstallationsAndPromptForElevation": 1, + "DeviceInstallationPreventDeviceMetadataFromNetwork": 1, + "DeviceLockClearTextPassword": 0, + "DeviceLockMaximumPasswordAge": 42, + "DeviceLockMinDevicePasswordLength": 14, + "DeviceLockMinimumPasswordAge": 1, + "DeviceLockPasswordComplexity": 1, + "DeviceLockPasswordHistorySize": 24, + "DigitallyEncryptOrSignSecureChannelDataAlways": 1, + "DigitallyEncryptSecureChannelDataWhenPossible": 1, + "DigitallySignCommunicationsAlwaysClient": 1, + "DigitallySignCommunicationsAlwaysServer": 1, + "DigitallySignCommunicationsIfClientAgrees": 1, + "DigitallySignCommunicationsIfServerAgrees": 1, + "DigitallySignSecureChannelDataWhenPossible": 1, + "DisableLocalAccountPasswordChanges": 0, + "DisconnectClientsWhenLogonHoursExpire": 1, + "DnsClientTurn_Off_Multicast": 0, + "DoNotAllowAnonymousEnumerationOfSAMAccounts": 1, + "DoNotAllowAnonymousEnumerationOfSamAccountsAndShares": 1, + "DoNotDisplayLastSignedIn": 1, + "DoNotRequireCTRLALTDEL": 0, + "EnableGuestAccountStatus": 0, + "EnableStructuredExceptionHandlingOverwriteProtection": 0, + "EventLogChannelSecurityLogRetention": "0", + "EventLogChannelSetupLogMaxSize": 32768, + "EventLogChannelSetupLogRetention": "0", + "EventLogChannelSystemLogRetention": "0", + "EventLogPercentageThresholdSecurityEventLogMaximumSizeReached": 90, + "EventLogServiceControlEventLogBehavior": "0", + "EventLogServiceSpecifyMaximumFileSizeApplicationLog": 32768, + "EventLogServiceSpecifyMaximumFileSizeSecurityLog": 196608, + "EventLogServiceSpecifyMaximumFileSizeSystemLog": 32768, + "ExperienceAllowWindowsConsumerFeatures": 1, + "ExperienceDisableConsumerAccountStateContent": 1, + "ExperienceDoNotShowFeedbackNotifications": 1, + "FileExplorerTurnOffHeapTerminationOnCorruption": 0, + "FirewallDomainProfileApplyLocalConnectionSecurityRules": 1, + "FirewallDomainProfileApplyLocalFirewallRules": 1, + "FirewallDomainProfileDisplayNotification": 1, + "FirewallDomainProfileLogDroppedPackets": 1, + "FirewallDomainProfileLogFileMaxSize": 16384, + "FirewallDomainProfileLogFileName": "%SystemRoot%\\System32\\logfiles\\firewall\\domainfw.log", + "FirewallDomainProfileLogSuccessfulConnections": 1, + "FirewallDomainProfileOutboundConnection": 0, + "FirewallDomainProfileState": 1, + "FirewallDomainProfileUnicastResponse": 0, + "FirewallPrivateProfileApplyLocalConnectionSecurityRules": 1, + "FirewallPrivateProfileApplyLocalFirewallRules": 1, + "FirewallPrivateProfileDisplayNotification": 1, + "FirewallPrivateProfileLogDroppedPackets": 1, + "FirewallPrivateProfileLogFileMaxSize": 16384, + "FirewallPrivateProfileLogFileName": "%SystemRoot%\\System32\\logfiles\\firewall\\privatefw.log", + "FirewallPrivateProfileLogSuccessfulConnections": 1, + "FirewallPrivateProfileOutboundConnection": 0, + "FirewallPrivateProfileState": 1, + "FirewallPrivateProfileUnicastResponse": 0, + "FirewallPublicProfileApplyLocalConnectionSecurityRules": 1, + "FirewallPublicProfileApplyLocalFirewallRules": 1, + "FirewallPublicProfileDisplayNotification": 1, + "FirewallPublicProfileLogDroppedPackets": 1, + "FirewallPublicProfileLogFileMaxSize": 16384, + "FirewallPublicProfileLogFileName": "%SystemRoot%\\System32\\logfiles\\firewall\\publicfw.log", + "FirewallPublicProfileLogSuccessfulConnections": 1, + "FirewallPublicProfileOutboundConnection": 0, + "FirewallPublicProfileState": 1, + "FirewallPublicProfileUnicastResponse": 1, + "ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings": 1, + "GroupPolicyDisableBackgroundPolicy": 0, + "GroupPolicyEnableCDP": 0, + "GroupPolicyNoBackgroundPolicy": 0, + "GroupPolicyNoGPOListChanges": 0, + "ICMNC_ExitOnISP": 1, + "IPSourceRoutingProtectionLevel": 2, + "IPv6SourceRoutingProtectionLevel": 2, + "LANManagerAuthenticationLevel": 5, + "LanmanWorkstationEnableInsecureGuestLogons": 0, + "LDAPClientSigningRequirements": 1, + "LetEveryonePermissionsApplyToAnonymousUsers": 0, + "LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly": 1, + "LogonBlockUserFromShowingAccountDetailsOnSignin": 1, + "LogonDontEnumerateConnectedUsers": 1, + "LsaFIPSAlgorithmPolicySTE": 1, + "LsaNoLMHash": 1, + "MachineInactivityLimit": 900, + "MaximumMachineAccountPasswordAge": 30, + "MinimumSessionSecurityForNTLMSSPBasedClients": 537395200, + "MinimumSessionSecurityForNTLMSSPBasedServers": 537395200, + "NetBTNodeTypeConfiguration": 2, + "NetworkConnectionsNC_ShowSharedAccessUI": 0, + "NetworkProviderHardenedPathsNETLOGON": [ + "RequireMutualAuthentication=1", + "RequireIntegrity=1" + ], + "NetworkProviderHardenedPathsSYSVOL": [ + "RequireMutualAuthentication=1", + "RequireIntegrity=1" + ], + "OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations": 1, + "PowerShellExecutionPolicyEnableTranscripting": 0, + "PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters": 1, + "PrintersRestrictDriverInstallationToAdministrators": 1, + "PrivacyAllowInputPersonalization": 0, + "PromptUserToChangePasswordBeforeExpiration": 14, + "RDPPortNumber": 3389, + "RemoteAssistanceSolicitedRemoteAssistance": 0, + "RemoteAssistanceUnsolicitedRemoteAssistance": 0, + "RemoteDesktopServicesClientConnectionEncryptionLevel": 3, + "RemoteDesktopServicesDoNotAllowDriveRedirection": 1, + "RemoteDesktopServicesDoNotAllowPasswordSaving": 1, + "RemoteDesktopServicesPromptForPasswordUponConnection": 1, + "RemoteDesktopServicesRequireSecureRPCCommunication": 1, + "RemotelyAccessibleRegistryPaths": [ + "System\\CurrentControlSet\\Control\\ProductOptions", + "System\\CurrentControlSet\\Control\\Server Applications", + "Software\\Microsoft\\Windows NT\\CurrentVersion" + ], + "RemotelyAccessibleRegistryPathsAndSubpaths": [ + "System\\CurrentControlSet\\Control\\Print\\Printers", + "System\\CurrentControlSet\\Services\\Eventlog", + "Software\\Microsoft\\OLAP Server", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Print", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows", + "System\\CurrentControlSet\\Control\\ContentIndex", + "System\\CurrentControlSet\\Control\\Terminal Server", + "System\\CurrentControlSet\\Control\\Terminal Server\\UserConfig", + "System\\CurrentControlSet\\Control\\Terminal Server\\DefaultUserConfiguration", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Perflib", + "System\\CurrentControlSet\\Services\\SysmonLog" + ], + "RemoteManagementAllowBasicAuthentication_Client": 0, + "RemoteManagementAllowUnencryptedTraffic_Client": 0, + "RemoteManagementDisallowDigestAuthentication": 0, + "RemoteManagementDisallowStoringOfRunAsCredentials": 1, + "RequireCaseInsensitivityForNonWindowsSubsystems": 1, + "RequireStrongSessionKey": 1, + "RestrictAnonymousAccessToNamedPipesAndShares": 1, + "RestrictClientsAllowedToMakeRemoteCallsToSAM": "O:BAG:BAD:(A;;RC;;;BA)", + "RSSDisableEnclosureDownload": 1, + "RunAllAdministratorsInAdminApprovalMode": 1, + "SafeDllSearchMode": 1, + "SearchAllowIndexingEncryptedStoresOrItems": 0, + "SendUnencryptedPasswordToThirdPartySMBServers": 0, + "ServerSPNTargetNameValidationLevel": 1, + "SharesThatCanBeAccessedAnonymously": [], + "SharingAndSecurityModelForLocalAccounts": 0, + "ShellDataExecutionPrevention": 0, + "ShutdownSystemImmediatelyIfUnableToLogSecurityAudits": 0, + "SmartScreenEnableSmartScreenInShell": 1, + "StrengthenDefaultPermissionsOfInternalSystemObjects": 1, + "SwitchToTheSecureDesktopWhenPromptingForElevation": 1, + "SystemAllowTelemetry": 1, + "SystemBootStartDriverInitialization": 3, + "SystemEnableSoftwareRestrictionPolicies": 1, + "SystemLogonCacheSize": "4", + "SystemMinimizeInternetConnections": 1, + "SystemWindowsSearchService": 4, + "TerminalServerTS_TEMP_DELETE": 1, + "TerminalServerTS_TEMP_PER_SESSION": 1, + "TerminalServerTS_USER_AUTHENTICATION_POLICY": 1, + "TurnOff_Windows_Error_Reporting": 1, + "UseAdminApprovalMode": 1, + "UserRightsAccessCredentialManagerAsTrustedCaller": "", + "UserRightsAccessFromNetwork": [ + "*S-1-5-32-544", + "*S-1-5-11" + ], + "UserRightsActAsPartOfTheOperatingSystem": "", + "UserRightsAdjustMemoryQuotasForProcess": [ + "*S-1-5-32-544", + "*S-1-5-19", + "*S-1-5-20" + ], + "UserRightsAllowLocalLogOn": [ + "*S-1-5-32-544" + ], + "UserRightsAllowLogOnThroughRemoteDesktop": [ + "*S-1-5-32-544", + "*S-1-5-32-555" + ], + "UserRightsBackupFilesAndDirectories": [ + "*S-1-5-32-544", + "*S-1-5-32-551", + "*S-1-5-32-549" + ], + "UserRightsBypassTraverseChecking": [ + "*S-1-5-32-544", + "*S-1-5-11", + "*S-1-5-32-551", + "*S-1-5-19", + "*S-1-5-20" + ], + "UserRightsChangeSystemTime": [ + "*S-1-5-32-544", + "*S-1-5-32-549", + "*S-1-5-19" + ], + "UserRightsChangeTimeZone": [ + "*S-1-5-32-544", + "*S-1-5-19" + ], + "UserRightsCreateGlobalObjects": [ + "*S-1-5-32-544", + "*S-1-5-6", + "*S-1-5-19", + "*S-1-5-20" + ], + "UserRightsCreatePageFile": [ + "*S-1-5-32-544" + ], + "UserRightsCreatePermanentSharedObjects": "", + "UserRightsCreateSymbolicLinks": [ + "*S-1-5-32-544", + "*S-1-5-83-0" + ], + "UserRightsCreateToken": "", + "UserRightsDenyAccessFromNetwork": [ + "*S-1-5-32-546" + ], + "UserRightsDenyLocalLogOn": [ + "*S-1-5-32-546" + ], + "UserRightsDenyLogOnAsBatchJob": [ + "*S-1-5-32-546" + ], + "UserRightsDenyLogOnAsService": [ + "*S-1-5-32-546" + ], + "UserRightsEnableDelegation": "", + "UserRightsGenerateSecurityAudits": [ + "*S-1-5-19", + "*S-1-5-20", + "*S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415" + ], + "UserRightsIncreaseProcessWorkingSet": [ + "*S-1-5-32-544", + "*S-1-5-19" + ], + "UserRightsIncreaseSchedulingPriority": [ + "*S-1-5-32-544" + ], + "UserRightsLoadUnloadDeviceDrivers": [ + "*S-1-5-32-544", + "*S-1-5-32-550" + ], + "UserRightsLockMemory": "", + "UserRightsManageAuditingAndSecurityLog": [ + "*S-1-5-32-544" + ], + "UserRightsManageVolume": [ + "*S-1-5-32-544" + ], + "UserRightsModifyFirmwareEnvironment": [ + "*S-1-5-32-544" + ], + "UserRightsModifyObjectLabel": "", + "UserRightsProfileSingleProcess": [ + "*S-1-5-32-544" + ], + "UserRightsProfileSystemPerformance": [ + "*S-1-5-32-544", + "*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420" + ], + "UserRightsRemoteShutdown": [ + "*S-1-5-32-544" + ], + "UserRightsReplaceProcessLevelToken": [ + "*S-1-5-19", + "*S-1-5-20" + ], + "UserRightsRestoreFilesAndDirectories": [ + "*S-1-5-32-544", + "*S-1-5-32-551" + ], + "UserRightsShutDownTheSystem": [ + "*S-1-5-32-544", + "*S-1-5-32-551" + ], + "UserRightsTakeOwnership": [ + "*S-1-5-32-544" + ], + "VirtualizeFileAndRegistryWriteFailuresToPerUserLocations": 1, + "WindowsDefenderDisableAntiSpyware": 0, + "WindowsDefenderExploitGuardASRExploitGuard_ASR_Rules": 1, + "WindowsDefenderExploitGuardNetworkProtectionEnableNetworkProtection": 1, + "WindowsDefenderPUAProtection": 1, + "WindowsDefenderRealTimeProtectionDisableBehaviorMonitoring": 0, + "WindowsDefenderRealTimeProtectionDisableIOAVProtection": 0, + "WindowsDefenderRealTimeProtectionDisableRealtimeMonitoring": 0, + "WindowsDefenderRealTimeProtectionDisableScriptScanning": 0, + "WindowsDefenderScanDisableEmailScanning": 0, + "WindowsDefenderScanDisableRemovableDriveScanning": 0, + "WindowsDefenderSecurityCenterAppBrowserProtectionDisallowExploitProtectionOverride": 1, + "WindowsDefenderSpyNetLocalSettingOverrideSpynetReporting": 0, + "WindowsDefenderSpyNetSubmitSamplesConsent": 1, + "WindowsExplorerShellProtocolProtectedModeTitle_2": 0, + "WindowsLogonAllowAutomaticRestartSignOn": 1, + "WindowsLogonDisableLockScreenAppNotifications": 1, + "WindowsLogonDontDisplayNetworkSelectionUI": 1, + "WindowsLogonEnumerateLocalUsersOnDomainJoinedComputers": 0, + "WindowsPowerShellTurnOnPowerShellScriptBlockLogging": 1 + } + }, + { + "profile": "ws2022-domain-controller.osc.yaml", + "sourceRules": 242, + "outputRules": 244, + "sourceCsp": 71, + "convertedCsp": 71, + "residualCsp": [], + "keyPathNormalized": 171, + "providerCounts": { + "Microsoft.Windows/AccountPolicy": 13, + "Microsoft.Windows/Registry": 171, + "Microsoft.Windows/AuditPolicy": 32, + "Microsoft.Windows/UserRightsAssignment": 28 + }, + "expansions": [ + { + "name": "AccountLockoutPolicy", + "into": [ + "AccountLockoutPolicy", + "AccountLockoutPolicy_LockoutThreshold", + "AccountLockoutPolicy_LockoutReset" + ] + } + ], + "registryShapeRepairs": [ + { + "name": "NetworkProviderHardenedPathsNETLOGON", + "from": { + "valueType": "REG_DWORD", + "value": [ + "RequireMutualAuthentication=1", + "RequireIntegrity=1" + ] + }, + "to": { + "valueType": "REG_SZ", + "value": "RequireMutualAuthentication=1, RequireIntegrity=1" + }, + "evidence": "ws2025-member-server:NetworkProviderHardenedPathsNETLOGON" + }, + { + "name": "NetworkProviderHardenedPathsSYSVOL", + "from": { + "valueType": "REG_DWORD", + "value": [ + "RequireMutualAuthentication=1", + "RequireIntegrity=1" + ] + }, + "to": { + "valueType": "REG_SZ", + "value": "RequireMutualAuthentication=1, RequireIntegrity=1" + }, + "evidence": "ws2025-member-server:NetworkProviderHardenedPathsSYSVOL" + }, + { + "name": "RemotelyAccessibleRegistryPaths", + "from": { + "valueType": "REG_DWORD", + "value": [ + "System\\CurrentControlSet\\Control\\ProductOptions", + "System\\CurrentControlSet\\Control\\Server Applications", + "Software\\Microsoft\\Windows NT\\CurrentVersion" + ] + }, + "to": { + "valueType": "REG_MULTI_SZ", + "value": [ + "System\\CurrentControlSet\\Control\\ProductOptions", + "System\\CurrentControlSet\\Control\\Server Applications", + "Software\\Microsoft\\Windows NT\\CurrentVersion" + ] + }, + "evidence": "ws2025-member-server:RemotelyAccessibleRegistryPaths" + }, + { + "name": "SharesThatCanBeAccessedAnonymously", + "from": { + "valueType": "REG_DWORD", + "value": [] + }, + "to": { + "valueType": "REG_MULTI_SZ", + "value": [] + }, + "evidence": "ws2025-member-server:SharesThatCanBeAccessedAnonymously" + } + ], + "assertionRestatements": [ + { + "name": "UserRightsAccessCredentialManagerAsTrustedCaller", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AccessCredentialManagerAsTrustedCaller", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsActAsPartOfTheOperatingSystem", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ActAsPartOfTheOperatingSystem", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsCreatePermanentSharedObjects", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreatePermanentSharedObjects", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsCreateToken", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreateToken", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsLockMemory", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/LockMemory", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsModifyObjectLabel", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ModifyObjectLabel", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + } + ], + "assertionDowngrades": [], + "valueChanges": [ + { + "name": "AccountLockoutPolicy", + "from": "ResetAccountLockoutCounterAfter:15, AccountLockoutDuration:15, AccountLockoutThreshold:3", + "to": 15 + }, + { + "name": "AllowAnonymousSIDOrNameTranslation", + "from": 0, + "to": false + }, + { + "name": "DeviceLockClearTextPassword", + "from": 0, + "to": false + }, + { + "name": "DeviceLockPasswordComplexity", + "from": 1, + "to": true + }, + { + "name": "EnableGuestAccountStatus", + "from": 0, + "to": false + }, + { + "name": "NetworkProviderHardenedPathsNETLOGON", + "from": [ + "RequireMutualAuthentication=1", + "RequireIntegrity=1" + ], + "to": "RequireMutualAuthentication=1, RequireIntegrity=1" + }, + { + "name": "NetworkProviderHardenedPathsSYSVOL", + "from": [ + "RequireMutualAuthentication=1", + "RequireIntegrity=1" + ], + "to": "RequireMutualAuthentication=1, RequireIntegrity=1" + }, + { + "name": "UserRightsAccessCredentialManagerAsTrustedCaller", + "from": "", + "to": [] + }, + { + "name": "UserRightsActAsPartOfTheOperatingSystem", + "from": "", + "to": [] + }, + { + "name": "UserRightsCreatePermanentSharedObjects", + "from": "", + "to": [] + }, + { + "name": "UserRightsCreateToken", + "from": "", + "to": [] + }, + { + "name": "UserRightsLockMemory", + "from": "", + "to": [] + }, + { + "name": "UserRightsModifyObjectLabel", + "from": "", + "to": [] + } + ], + "conversions": [ + { + "name": "AccountLockoutPolicy", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/AccountLockoutPolicy", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockAccountLockoutPolicy", + "ws2025-member-server:DeviceLockAccountLockoutPolicy", + "ws2025-domain-controller:DeviceLockAccountLockoutPolicy" + ] + }, + { + "name": "AllowAnonymousSIDOrNameTranslation", + "cspPath": "./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/NetworkAccess_AllowAnonymousSIDOrNameTranslation", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:AllowAnonymousSIDOrNameTranslation", + "ws2025-member-server:AllowAnonymousSIDOrNameTranslation", + "ws2025-domain-controller:AllowAnonymousSIDOrNameTranslation" + ] + }, + { + "name": "AuditAccountLockout", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditAccountLockout", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditAccountLockout", + "ws2025-member-server:AuditAccountLockout", + "ws2025-domain-controller:AuditAccountLockout" + ] + }, + { + "name": "AuditAuthenticationPolicyChange", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditAuthenticationPolicyChange", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditAuthenticationPolicyChange", + "ws2025-member-server:AuditAuthenticationPolicyChange", + "ws2025-domain-controller:AuditAuthenticationPolicyChange" + ] + }, + { + "name": "AuditAuthorizationPolicyChange", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditAuthorizationPolicyChange", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditAuthorizationPolicyChange", + "ws2025-member-server:AuditAuthorizationPolicyChange", + "ws2025-domain-controller:AuditAuthorizationPolicyChange" + ] + }, + { + "name": "AuditChangeCategoryOther", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditOtherPolicyChangeEvents", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditOtherPolicyChangeEvents", + "ws2025-member-server:AuditOtherPolicyChangeEvents", + "ws2025-domain-controller:AuditOtherPolicyChangeEvents" + ] + }, + { + "name": "AuditComputerAccountManagement", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditComputerAccountManagement", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-domain-controller:AuditComputerAccountManagement" + ] + }, + { + "name": "AuditDetailedFileShare", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditDetailedFileShare", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditDetailedFileShare", + "ws2025-member-server:AuditDetailedFileShare", + "ws2025-domain-controller:AuditDetailedFileShare" + ] + }, + { + "name": "AuditDirectoryServiceAccess", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/DSAccess_AuditDirectoryServiceAccess", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-domain-controller:AuditDirectoryServiceAccess" + ] + }, + { + "name": "AuditDirectoryServiceChanges", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/DSAccess_AuditDirectoryServiceChanges", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-domain-controller:AuditDirectoryServiceChanges" + ] + }, + { + "name": "AuditDirectoryServiceReplication", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/DSAccess_AuditDirectoryServiceReplication", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-domain-controller:AuditDirectoryServiceReplication" + ] + }, + { + "name": "AuditDistributionGroupManagement", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditDistributionGroupManagement", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-domain-controller:AuditDistributionGroupManagement" + ] + }, + { + "name": "AuditFileShare", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditFileShare", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditFileShare", + "ws2025-member-server:AuditFileShare", + "ws2025-domain-controller:AuditFileShare" + ] + }, + { + "name": "AuditGroupMembership", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditGroupMembership", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditGroupMembership", + "ws2025-member-server:AuditGroupMembership", + "ws2025-domain-controller:AuditGroupMembership" + ] + }, + { + "name": "AuditIPsecDriver", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditIPsecDriver", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditIPsecDriver", + "ws2025-member-server:AuditIPsecDriver", + "ws2025-domain-controller:AuditIPsecDriver" + ] + }, + { + "name": "AuditKerberosAuthenticationService", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogon_AuditKerberosAuthenticationService", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-domain-controller:AuditKerberosAuthenticationService" + ] + }, + { + "name": "AuditLogoff", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditLogoff", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditLogoff", + "ws2025-member-server:AuditLogoff", + "ws2025-domain-controller:AuditLogoff" + ] + }, + { + "name": "AuditLogon", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditLogon", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditLogon", + "ws2025-member-server:AuditLogon", + "ws2025-domain-controller:AuditLogon" + ] + }, + { + "name": "AuditMPSSVCRuleLevelPolicyChange", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditMPSSVCRuleLevelPolicyChange", + "ws2025-member-server:AuditMPSSVCRuleLevelPolicyChange", + "ws2025-domain-controller:AuditMPSSVCRuleLevelPolicyChange" + ] + }, + { + "name": "AuditOtherAccountManagementEvents", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditOtherAccountManagementEvents", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-domain-controller:AuditOtherAccountManagementEvents" + ] + }, + { + "name": "AuditOtherLogonLogoffEvents", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditOtherLogonLogoffEvents", + "ws2025-member-server:AuditOtherLogonLogoffEvents", + "ws2025-domain-controller:AuditOtherLogonLogoffEvents" + ] + }, + { + "name": "AuditOtherObjectAccessEvents", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditOtherObjectAccessEvents", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditOtherObjectAccessEvents", + "ws2025-member-server:AuditOtherObjectAccessEvents", + "ws2025-domain-controller:AuditOtherObjectAccessEvents" + ] + }, + { + "name": "AuditOtherSystemEvents", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditOtherSystemEvents", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditOtherSystemEvents", + "ws2025-member-server:AuditOtherSystemEvents", + "ws2025-domain-controller:AuditOtherSystemEvents" + ] + }, + { + "name": "AuditPnPExternalDevice", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/DetailedTracking_AuditPNPActivity", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditPnPExternalDevice", + "ws2025-member-server:AuditPnPExternalDevice", + "ws2025-domain-controller:AuditPnPExternalDevice" + ] + }, + { + "name": "AuditPolicyChange", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditPolicyChange", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditPolicyChange", + "ws2025-member-server:AuditPolicyChange", + "ws2025-domain-controller:AuditPolicyChange" + ] + }, + { + "name": "AuditProcessCreatedOrStarted", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/DetailedTracking_AuditProcessCreation", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditProcessCreatedOrStarted", + "ws2025-member-server:AuditProcessCreatedOrStarted", + "ws2025-domain-controller:AuditProcessCreatedOrStarted" + ] + }, + { + "name": "AuditRemovableStorage", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditRemovableStorage", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditRemovableStorage", + "ws2025-member-server:AuditRemovableStorage", + "ws2025-domain-controller:AuditRemovableStorage" + ] + }, + { + "name": "AuditSecurityGroupManagement", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditSecurityGroupManagement", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSecurityGroupManagement", + "ws2025-member-server:AuditSecurityGroupManagement", + "ws2025-domain-controller:AuditSecurityGroupManagement" + ] + }, + { + "name": "AuditSecurityStateChange", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditSecurityStateChange", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSecurityStateChange", + "ws2025-member-server:AuditSecurityStateChange", + "ws2025-domain-controller:AuditSecurityStateChange" + ] + }, + { + "name": "AuditSecuritySystemExtension", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditSecuritySystemExtension", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSecuritySystemExtension", + "ws2025-member-server:AuditSecuritySystemExtension", + "ws2025-domain-controller:AuditSecuritySystemExtension" + ] + }, + { + "name": "AuditSensitivePrivilegeUse", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PrivilegeUse_AuditSensitivePrivilegeUse", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSensitivePrivilegeUse", + "ws2025-member-server:AuditSensitivePrivilegeUse", + "ws2025-domain-controller:AuditSensitivePrivilegeUse" + ] + }, + { + "name": "AuditSpecialLogon", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditSpecialLogon", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSpecialLogon", + "ws2025-member-server:AuditSpecialLogon", + "ws2025-domain-controller:AuditSpecialLogon" + ] + }, + { + "name": "AuditSystemIntegrity", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditSystemIntegrity", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSystemIntegrity", + "ws2025-member-server:AuditSystemIntegrity", + "ws2025-domain-controller:AuditSystemIntegrity" + ] + }, + { + "name": "AuditUserAccountManagement", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditUserAccountManagement", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditUserAccountManagement", + "ws2025-member-server:AuditUserAccountManagement", + "ws2025-domain-controller:AuditUserAccountManagement" + ] + }, + { + "name": "DeviceLockClearTextPassword", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/ClearTextPassword", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockClearTextPassword", + "ws2025-member-server:DeviceLockClearTextPassword", + "ws2025-domain-controller:DeviceLockClearTextPassword" + ] + }, + { + "name": "DeviceLockMaximumPasswordAge", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/MaximumPasswordAge", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockMaximumPasswordAge", + "ws2025-member-server:DeviceLockMaximumPasswordAge", + "ws2025-domain-controller:DeviceLockMaximumPasswordAge" + ] + }, + { + "name": "DeviceLockMinDevicePasswordLength", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/MinimumPasswordLength", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockMinimumPasswordLength", + "ws2025-member-server:DeviceLockMinimumPasswordLength" + ] + }, + { + "name": "DeviceLockMinimumPasswordAge", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/MinimumPasswordAge", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockMinimumPasswordAge", + "ws2025-member-server:DeviceLockMinimumPasswordAge", + "ws2025-domain-controller:DeviceLockMinimumPasswordAge" + ] + }, + { + "name": "DeviceLockPasswordComplexity", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/PasswordComplexity", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockPasswordComplexity", + "ws2025-member-server:DeviceLockPasswordComplexity", + "ws2025-domain-controller:DeviceLockPasswordComplexity" + ] + }, + { + "name": "DeviceLockPasswordHistorySize", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/PasswordHistorySize", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockPasswordHistorySize", + "ws2025-member-server:DeviceLockPasswordHistorySize", + "ws2025-domain-controller:DeviceLockPasswordHistorySize" + ] + }, + { + "name": "EnableGuestAccountStatus", + "cspPath": "./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:EnableGuestAccountStatus", + "ws2025-member-server:EnableGuestAccountStatus", + "ws2025-domain-controller:EnableGuestAccountStatus" + ] + }, + { + "name": "RenameAdministratorAccount", + "cspPath": "./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:RenameAdministratorAccount", + "ws2025-member-server:RenameAdministratorAccount", + "ws2025-domain-controller:RenameAdministratorAccount" + ] + }, + { + "name": "RenameGuestAccount", + "cspPath": "./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:RenameGuestAccount", + "ws2025-member-server:RenameGuestAccount", + "ws2025-domain-controller:RenameGuestAccount" + ] + }, + { + "name": "UserRightsAccessCredentialManagerAsTrustedCaller", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AccessCredentialManagerAsTrustedCaller", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsAccessCredentialManagerAsTrustedCaller", + "ws2025-member-server:UserRightsAccessCredentialManagerAsTrustedCaller", + "ws2025-domain-controller:UserRightsAccessCredentialManagerAsTrustedCaller" + ] + }, + { + "name": "UserRightsActAsPartOfTheOperatingSystem", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ActAsPartOfTheOperatingSystem", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsActAsPartOfTheOperatingSystem", + "ws2025-member-server:UserRightsActAsPartOfTheOperatingSystem", + "ws2025-domain-controller:UserRightsActAsPartOfTheOperatingSystem" + ] + }, + { + "name": "UserRightsAdjustMemoryQuotasForProcess", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AdjustMemoryQuotasForProcess", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsAdjustMemoryQuotasForProcess", + "ws2025-member-server:UserRightsAdjustMemoryQuotasForProcess", + "ws2025-domain-controller:UserRightsAdjustMemoryQuotasForProcess" + ] + }, + { + "name": "UserRightsAllowLogOnThroughRemoteDesktop", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AllowLogOnThroughRemoteDesktop", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsAllowLogOnThroughRemoteDesktop", + "ws2025-member-server:UserRightsAllowLogOnThroughRemoteDesktop", + "ws2025-domain-controller:UserRightsAllowLogOnThroughRemoteDesktop" + ] + }, + { + "name": "UserRightsChangeTimeZone", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ChangeTimeZone", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsChangeTimeZone", + "ws2025-member-server:UserRightsChangeTimeZone", + "ws2025-domain-controller:UserRightsChangeTimeZone" + ] + }, + { + "name": "UserRightsCreateGlobalObjects", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreateGlobalObjects", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsCreateGlobalObjects", + "ws2025-member-server:UserRightsCreateGlobalObjects", + "ws2025-domain-controller:UserRightsCreateGlobalObjects" + ] + }, + { + "name": "UserRightsCreatePageFile", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreatePageFile", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsCreatePageFile", + "ws2025-member-server:UserRightsCreatePageFile", + "ws2025-domain-controller:UserRightsCreatePageFile" + ] + }, + { + "name": "UserRightsCreatePermanentSharedObjects", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreatePermanentSharedObjects", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsCreatePermanentSharedObjects", + "ws2025-member-server:UserRightsCreatePermanentSharedObjects", + "ws2025-domain-controller:UserRightsCreatePermanentSharedObjects" + ] + }, + { + "name": "UserRightsCreateSymbolicLinks", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreateSymbolicLinks", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsCreateSymbolicLinks", + "ws2025-member-server:UserRightsCreateSymbolicLinks", + "ws2025-domain-controller:UserRightsCreateSymbolicLinks" + ] + }, + { + "name": "UserRightsCreateToken", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreateToken", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsCreateToken", + "ws2025-member-server:UserRightsCreateToken", + "ws2025-domain-controller:UserRightsCreateToken" + ] + }, + { + "name": "UserRightsDenyAccessFromNetwork", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyAccessFromNetwork", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyAccessFromNetwork", + "ws2025-member-server:UserRightsDenyAccessFromNetwork", + "ws2025-domain-controller:UserRightsDenyAccessFromNetwork" + ] + }, + { + "name": "UserRightsDenyLocalLogOn", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyLocalLogOn", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyLocalLogOn", + "ws2025-member-server:UserRightsDenyLocalLogOn", + "ws2025-domain-controller:UserRightsDenyLocalLogOn" + ] + }, + { + "name": "UserRightsDenyLogOnAsBatchJob", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyLogOnAsBatchJob", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyLogOnAsBatchJob", + "ws2025-member-server:UserRightsDenyLogOnAsBatchJob", + "ws2025-domain-controller:UserRightsDenyLogOnAsBatchJob" + ] + }, + { + "name": "UserRightsDenyLogOnAsService", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyLogOnAsService", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyLogOnAsService", + "ws2025-member-server:UserRightsDenyLogOnAsService", + "ws2025-domain-controller:UserRightsDenyLogOnAsService" + ] + }, + { + "name": "UserRightsGenerateSecurityAudits", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/GenerateSecurityAudits", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsGenerateSecurityAudits", + "ws2025-member-server:UserRightsGenerateSecurityAudits", + "ws2025-domain-controller:UserRightsGenerateSecurityAudits" + ] + }, + { + "name": "UserRightsIncreaseSchedulingPriority", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/IncreaseSchedulingPriority", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsIncreaseSchedulingPriority", + "ws2025-member-server:UserRightsIncreaseSchedulingPriority", + "ws2025-domain-controller:UserRightsIncreaseSchedulingPriority" + ] + }, + { + "name": "UserRightsLoadUnloadDeviceDrivers", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/LoadUnloadDeviceDrivers", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsLoadUnloadDeviceDrivers", + "ws2025-member-server:UserRightsLoadUnloadDeviceDrivers", + "ws2025-domain-controller:UserRightsLoadUnloadDeviceDrivers" + ] + }, + { + "name": "UserRightsLockMemory", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/LockMemory", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsLockMemory", + "ws2025-member-server:UserRightsLockMemory", + "ws2025-domain-controller:UserRightsLockMemory" + ] + }, + { + "name": "UserRightsManageAuditingAndSecurityLog", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ManageAuditingAndSecurityLog", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsManageAuditingAndSecurityLog", + "ws2025-member-server:UserRightsManageAuditingAndSecurityLog", + "ws2025-domain-controller:UserRightsManageAuditingAndSecurityLog" + ] + }, + { + "name": "UserRightsManageVolume", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ManageVolume", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsManageVolume", + "ws2025-member-server:UserRightsManageVolume", + "ws2025-domain-controller:UserRightsManageVolume" + ] + }, + { + "name": "UserRightsModifyFirmwareEnvironment", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ModifyFirmwareEnvironment", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsModifyFirmwareEnvironment", + "ws2025-member-server:UserRightsModifyFirmwareEnvironment", + "ws2025-domain-controller:UserRightsModifyFirmwareEnvironment" + ] + }, + { + "name": "UserRightsModifyObjectLabel", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ModifyObjectLabel", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsModifyObjectLabel", + "ws2025-member-server:UserRightsModifyObjectLabel", + "ws2025-domain-controller:UserRightsModifyObjectLabel" + ] + }, + { + "name": "UserRightsProfileSingleProcess", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ProfileSingleProcess", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsProfileSingleProcess", + "ws2025-member-server:UserRightsProfileSingleProcess", + "ws2025-domain-controller:UserRightsProfileSingleProcess" + ] + }, + { + "name": "UserRightsProfileSystemPerformance", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ProfileSystemPerformance", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsProfileSystemPerformance", + "ws2025-member-server:UserRightsProfileSystemPerformance", + "ws2025-domain-controller:UserRightsProfileSystemPerformance" + ] + }, + { + "name": "UserRightsRemoteShutdown", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/RemoteShutdown", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsRemoteShutdown", + "ws2025-member-server:UserRightsRemoteShutdown", + "ws2025-domain-controller:UserRightsRemoteShutdown" + ] + }, + { + "name": "UserRightsReplaceProcessLevelToken", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ReplaceProcessLevelToken", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsReplaceProcessLevelToken", + "ws2025-member-server:UserRightsReplaceProcessLevelToken", + "ws2025-domain-controller:UserRightsReplaceProcessLevelToken" + ] + }, + { + "name": "UserRightsShutDownTheSystem", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ShutDownTheSystem", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsShutDownTheSystem", + "ws2025-member-server:UserRightsShutDownTheSystem", + "ws2025-domain-controller:UserRightsShutDownTheSystem" + ] + }, + { + "name": "UserRightsTakeOwnership", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/TakeOwnership", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsTakeOwnership", + "ws2025-member-server:UserRightsTakeOwnership", + "ws2025-domain-controller:UserRightsTakeOwnership" + ] + } + ], + "sourceRuleNames": [ + "AccountLockoutPolicy", + "AllowAnonymousSIDOrNameTranslation", + "AllowedToFormatAndEjectRemovableMedia", + "AllowICMPRedirectsToOverrideOSPFGeneratedRoutes", + "AllowLocalSystemNULLSessionFallback", + "AllowLocalSystemToUseComputerIdentityForNTLM", + "AllowSystemToBeShutDownWithoutHavingToLogOn", + "AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers", + "AllowUIAccessApplicationsToPromptForElevation", + "AmountOfIdleTimeRequiredBeforeSuspendingSession", + "ApplicationManagementMSIAllowUserControlOverInstall", + "AppRuntimeAllowMicrosoftAccountsToBeOptional", + "AuditAccountLockout", + "AuditAuthenticationPolicyChange", + "AuditAuthorizationPolicyChange", + "AuditChangeCategoryOther", + "AuditComputerAccountManagement", + "AuditDetailedFileShare", + "AuditDirectoryServiceAccess", + "AuditDirectoryServiceChanges", + "AuditDirectoryServiceReplication", + "AuditDistributionGroupManagement", + "AuditFileShare", + "AuditGroupMembership", + "AuditIPsecDriver", + "AuditKerberosAuthenticationService", + "AuditLogoff", + "AuditLogon", + "AuditMPSSVCRuleLevelPolicyChange", + "AuditOtherAccountManagementEvents", + "AuditOtherLogonLogoffEvents", + "AuditOtherObjectAccessEvents", + "AuditOtherSystemEvents", + "AuditPnPExternalDevice", + "AuditPolicyChange", + "AuditProcessCreatedOrStarted", + "AuditRemovableStorage", + "AuditSecurityGroupManagement", + "AuditSecurityStateChange", + "AuditSecuritySystemExtension", + "AuditSensitivePrivilegeUse", + "AuditSettingsIncludeCmdLine", + "AuditSpecialLogon", + "AuditSystemIntegrity", + "AuditUserAccountManagement", + "AutoplayDisallowAutoplayForNonVolumeDevices", + "AutoplaySetDefaultAutoRunBehavior", + "AutoplayTurnOffAutoPlay", + "BehaviorOfTheElevationPromptForAdministrators", + "BehaviorOfTheElevationPromptForStandardUsers", + "ConfigureSMBV1Server", + "ConnectivityDisableDownloadingOfPrintDriversOverHTTP", + "ConnectivityProhibitInstallationAndConfigurationOfNetworkBridge", + "CredentialProvidersAllowPINLogon", + "CredentialsUIDisablePasswordReveal", + "CredentialsUIEnumerateAdministrators", + "CryptographyAllowedKerberosEncryptionTypes", + "CryptographyForceStrongKeyProtection", + "DetectApplicationInstallationsAndPromptForElevation", + "DeviceInstallationPreventDeviceMetadataFromNetwork", + "DeviceLockClearTextPassword", + "DeviceLockMaximumPasswordAge", + "DeviceLockMinDevicePasswordLength", + "DeviceLockMinimumPasswordAge", + "DeviceLockPasswordComplexity", + "DeviceLockPasswordHistorySize", + "DigitallyEncryptOrSignSecureChannelDataAlways", + "DigitallyEncryptSecureChannelDataWhenPossible", + "DigitallySignCommunicationsAlwaysClient", + "DigitallySignCommunicationsAlwaysServer", + "DigitallySignCommunicationsIfClientAgrees", + "DigitallySignCommunicationsIfServerAgrees", + "DigitallySignSecureChannelDataWhenPossible", + "DisableLocalAccountPasswordChanges", + "DisconnectClientsWhenLogonHoursExpire", + "DoNotDisplayLastSignedIn", + "DoNotRequireCTRLALTDEL", + "EnableGuestAccountStatus", + "EnableStructuredExceptionHandlingOverwriteProtection", + "EventLogChannelSecurityLogRetention", + "EventLogChannelSetupLogMaxSize", + "EventLogChannelSetupLogRetention", + "EventLogChannelSystemLogRetention", + "EventLogPercentageThresholdSecurityEventLogMaximumSizeReached", + "EventLogServiceControlEventLogBehavior", + "EventLogServiceSpecifyMaximumFileSizeApplicationLog", + "EventLogServiceSpecifyMaximumFileSizeSecurityLog", + "EventLogServiceSpecifyMaximumFileSizeSystemLog", + "ExperienceAllowWindowsConsumerFeatures", + "ExperienceDisableConsumerAccountStateContent", + "ExperienceDoNotShowFeedbackNotifications", + "FileExplorerTurnOffHeapTerminationOnCorruption", + "FirewallDomainProfileApplyLocalConnectionSecurityRules", + "FirewallDomainProfileApplyLocalFirewallRules", + "FirewallDomainProfileDisplayNotification", + "FirewallDomainProfileInboundConnection", + "FirewallDomainProfileLogDroppedPackets", + "FirewallDomainProfileLogFileMaxSize", + "FirewallDomainProfileLogFileName", + "FirewallDomainProfileLogSuccessfulConnections", + "FirewallDomainProfileOutboundConnection", + "FirewallDomainProfileState", + "FirewallDomainProfileUnicastResponse", + "FirewallPrivateProfileApplyLocalConnectionSecurityRules", + "FirewallPrivateProfileApplyLocalFirewallRules", + "FirewallPrivateProfileDisplayNotification", + "FirewallPrivateProfileInboundConnection", + "FirewallPrivateProfileLogDroppedPackets", + "FirewallPrivateProfileLogFileMaxSize", + "FirewallPrivateProfileLogFileName", + "FirewallPrivateProfileLogSuccessfulConnections", + "FirewallPrivateProfileOutboundConnection", + "FirewallPrivateProfileState", + "FirewallPrivateProfileUnicastResponse", + "FirewallPublicProfileApplyLocalConnectionSecurityRules", + "FirewallPublicProfileApplyLocalFirewallRules", + "FirewallPublicProfileDisplayNotification", + "FirewallPublicProfileInboundConnection", + "FirewallPublicProfileLogDroppedPackets", + "FirewallPublicProfileLogFileMaxSize", + "FirewallPublicProfileLogFileName", + "FirewallPublicProfileLogSuccessfulConnections", + "FirewallPublicProfileOutboundConnection", + "FirewallPublicProfileState", + "FirewallPublicProfileUnicastResponse", + "ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings", + "GroupPolicyDisableBackgroundPolicy", + "GroupPolicyEnableCDP", + "GroupPolicyNoBackgroundPolicy", + "GroupPolicyNoGPOListChanges", + "ICMNC_ExitOnISP", + "IPSourceRoutingProtectionLevel", + "IPv6SourceRoutingProtectionLevel", + "LANManagerAuthenticationLevel", + "LDAPClientSigningRequirements", + "LetEveryonePermissionsApplyToAnonymousUsers", + "LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly", + "LogonBlockUserFromShowingAccountDetailsOnSignin", + "LogonDontEnumerateConnectedUsers", + "LsaNoLMHash", + "MachineInactivityLimit", + "MaximumMachineAccountPasswordAge", + "MessageTextUserLogon", + "MessageTextUserLogonTitle", + "MinimumSessionSecurityForNTLMSSPBasedClients", + "MinimumSessionSecurityForNTLMSSPBasedServers", + "NetBTNodeTypeConfiguration", + "NetworkConnectionsNC_ShowSharedAccessUI", + "NetworkProviderHardenedPathsNETLOGON", + "NetworkProviderHardenedPathsSYSVOL", + "OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations", + "PowerShellExecutionPolicyEnableTranscripting", + "PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters", + "PrintersRestrictDriverInstallationToAdministrators", + "PrivacyAllowInputPersonalization", + "PromptUserToChangePasswordBeforeExpiration", + "RDPPortNumber", + "RemoteAssistanceSolicitedRemoteAssistance", + "RemoteAssistanceUnsolicitedRemoteAssistance", + "RemoteDesktopServicesClientConnectionEncryptionLevel", + "RemoteDesktopServicesDoNotAllowDriveRedirection", + "RemoteDesktopServicesDoNotAllowPasswordSaving", + "RemoteDesktopServicesPromptForPasswordUponConnection", + "RemoteDesktopServicesRequireSecureRPCCommunication", + "RemotelyAccessibleRegistryPaths", + "RemoteManagementAllowBasicAuthentication_Client", + "RemoteManagementAllowUnencryptedTraffic_Client", + "RemoteManagementDisallowDigestAuthentication", + "RemoteManagementDisallowStoringOfRunAsCredentials", + "RenameAdministratorAccount", + "RenameGuestAccount", + "RequireCaseInsensitivityForNonWindowsSubsystems", + "RequireStrongSessionKey", + "RestrictAnonymousAccessToNamedPipesAndShares", + "RSSDisableEnclosureDownload", + "RunAllAdministratorsInAdminApprovalMode", + "SafeDllSearchMode", + "SearchAllowIndexingEncryptedStoresOrItems", + "SendUnencryptedPasswordToThirdPartySMBServers", + "SharesThatCanBeAccessedAnonymously", + "SharingAndSecurityModelForLocalAccounts", + "ShellDataExecutionPrevention", + "ShutdownSystemImmediatelyIfUnableToLogSecurityAudits", + "SmartScreenEnableSmartScreenInShell", + "StrengthenDefaultPermissionsOfInternalSystemObjects", + "SwitchToTheSecureDesktopWhenPromptingForElevation", + "SystemAllowTelemetry", + "SystemBootStartDriverInitialization", + "SystemLogonCacheSize", + "SystemMinimizeInternetConnections", + "SystemWindowsSearchService", + "TerminalServerTS_TEMP_DELETE", + "TerminalServerTS_TEMP_PER_SESSION", + "TerminalServerTS_USER_AUTHENTICATION_POLICY", + "UseAdminApprovalMode", + "UserRightsAccessCredentialManagerAsTrustedCaller", + "UserRightsActAsPartOfTheOperatingSystem", + "UserRightsAdjustMemoryQuotasForProcess", + "UserRightsAllowLogOnThroughRemoteDesktop", + "UserRightsChangeTimeZone", + "UserRightsCreateGlobalObjects", + "UserRightsCreatePageFile", + "UserRightsCreatePermanentSharedObjects", + "UserRightsCreateSymbolicLinks", + "UserRightsCreateToken", + "UserRightsDenyAccessFromNetwork", + "UserRightsDenyLocalLogOn", + "UserRightsDenyLogOnAsBatchJob", + "UserRightsDenyLogOnAsService", + "UserRightsGenerateSecurityAudits", + "UserRightsIncreaseSchedulingPriority", + "UserRightsLoadUnloadDeviceDrivers", + "UserRightsLockMemory", + "UserRightsManageAuditingAndSecurityLog", + "UserRightsManageVolume", + "UserRightsModifyFirmwareEnvironment", + "UserRightsModifyObjectLabel", + "UserRightsProfileSingleProcess", + "UserRightsProfileSystemPerformance", + "UserRightsRemoteShutdown", + "UserRightsReplaceProcessLevelToken", + "UserRightsShutDownTheSystem", + "UserRightsTakeOwnership", + "VirtualizeFileAndRegistryWriteFailuresToPerUserLocations", + "WindowsDefenderDisableAntiSpyware", + "WindowsDefenderExploitGuardASRExploitGuard_ASR_Rules", + "WindowsDefenderExploitGuardNetworkProtectionEnableNetworkProtection", + "WindowsDefenderPUAProtection", + "WindowsDefenderRealTimeProtectionDisableBehaviorMonitoring", + "WindowsDefenderRealTimeProtectionDisableIOAVProtection", + "WindowsDefenderRealTimeProtectionDisableRealtimeMonitoring", + "WindowsDefenderRealTimeProtectionDisableScriptScanning", + "WindowsDefenderScanDisableEmailScanning", + "WindowsDefenderScanDisableRemovableDriveScanning", + "WindowsDefenderSecurityCenterAppBrowserProtectionDisallowExploitProtectionOverride", + "WindowsDefenderSpyNetLocalSettingOverrideSpynetReporting", + "WindowsDefenderSpyNetSubmitSamplesConsent", + "WindowsExplorerShellProtocolProtectedModeTitle_2", + "WindowsLogonAllowAutomaticRestartSignOn", + "WindowsLogonDisableLockScreenAppNotifications", + "WindowsLogonDontDisplayNetworkSelectionUI", + "WindowsPowerShellTurnOnPowerShellScriptBlockLogging" + ], + "sourceValues": { + "AccountLockoutPolicy": "ResetAccountLockoutCounterAfter:15, AccountLockoutDuration:15, AccountLockoutThreshold:3", + "AllowAnonymousSIDOrNameTranslation": 0, + "AllowedToFormatAndEjectRemovableMedia": "0", + "AllowICMPRedirectsToOverrideOSPFGeneratedRoutes": 0, + "AllowLocalSystemNULLSessionFallback": 0, + "AllowLocalSystemToUseComputerIdentityForNTLM": 1, + "AllowSystemToBeShutDownWithoutHavingToLogOn": 0, + "AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers": 1, + "AllowUIAccessApplicationsToPromptForElevation": 0, + "AmountOfIdleTimeRequiredBeforeSuspendingSession": 15, + "ApplicationManagementMSIAllowUserControlOverInstall": 0, + "AppRuntimeAllowMicrosoftAccountsToBeOptional": 1, + "AuditAccountLockout": 2, + "AuditAuthenticationPolicyChange": 1, + "AuditAuthorizationPolicyChange": 1, + "AuditChangeCategoryOther": 2, + "AuditComputerAccountManagement": 1, + "AuditDetailedFileShare": 2, + "AuditDirectoryServiceAccess": 2, + "AuditDirectoryServiceChanges": 1, + "AuditDirectoryServiceReplication": 0, + "AuditDistributionGroupManagement": 1, + "AuditFileShare": 3, + "AuditGroupMembership": 1, + "AuditIPsecDriver": 3, + "AuditKerberosAuthenticationService": 3, + "AuditLogoff": 1, + "AuditLogon": 3, + "AuditMPSSVCRuleLevelPolicyChange": 3, + "AuditOtherAccountManagementEvents": 1, + "AuditOtherLogonLogoffEvents": 3, + "AuditOtherObjectAccessEvents": 3, + "AuditOtherSystemEvents": 3, + "AuditPnPExternalDevice": 1, + "AuditPolicyChange": 1, + "AuditProcessCreatedOrStarted": 1, + "AuditRemovableStorage": 3, + "AuditSecurityGroupManagement": 1, + "AuditSecurityStateChange": 1, + "AuditSecuritySystemExtension": 1, + "AuditSensitivePrivilegeUse": 3, + "AuditSettingsIncludeCmdLine": 1, + "AuditSpecialLogon": 1, + "AuditSystemIntegrity": 3, + "AuditUserAccountManagement": 3, + "AutoplayDisallowAutoplayForNonVolumeDevices": 1, + "AutoplaySetDefaultAutoRunBehavior": 1, + "AutoplayTurnOffAutoPlay": 255, + "BehaviorOfTheElevationPromptForAdministrators": 2, + "BehaviorOfTheElevationPromptForStandardUsers": 0, + "ConfigureSMBV1Server": 0, + "ConnectivityDisableDownloadingOfPrintDriversOverHTTP": 1, + "ConnectivityProhibitInstallationAndConfigurationOfNetworkBridge": 0, + "CredentialProvidersAllowPINLogon": 0, + "CredentialsUIDisablePasswordReveal": 1, + "CredentialsUIEnumerateAdministrators": 0, + "CryptographyAllowedKerberosEncryptionTypes": 2147483640, + "CryptographyForceStrongKeyProtection": 2, + "DetectApplicationInstallationsAndPromptForElevation": 1, + "DeviceInstallationPreventDeviceMetadataFromNetwork": 1, + "DeviceLockClearTextPassword": 0, + "DeviceLockMaximumPasswordAge": 42, + "DeviceLockMinDevicePasswordLength": 14, + "DeviceLockMinimumPasswordAge": 1, + "DeviceLockPasswordComplexity": 1, + "DeviceLockPasswordHistorySize": 24, + "DigitallyEncryptOrSignSecureChannelDataAlways": 1, + "DigitallyEncryptSecureChannelDataWhenPossible": 1, + "DigitallySignCommunicationsAlwaysClient": 1, + "DigitallySignCommunicationsAlwaysServer": 1, + "DigitallySignCommunicationsIfClientAgrees": 1, + "DigitallySignCommunicationsIfServerAgrees": 1, + "DigitallySignSecureChannelDataWhenPossible": 1, + "DisableLocalAccountPasswordChanges": 0, + "DisconnectClientsWhenLogonHoursExpire": 1, + "DoNotDisplayLastSignedIn": 1, + "DoNotRequireCTRLALTDEL": 0, + "EnableGuestAccountStatus": 0, + "EnableStructuredExceptionHandlingOverwriteProtection": 0, + "EventLogChannelSecurityLogRetention": "0", + "EventLogChannelSetupLogMaxSize": 32768, + "EventLogChannelSetupLogRetention": "0", + "EventLogChannelSystemLogRetention": "0", + "EventLogPercentageThresholdSecurityEventLogMaximumSizeReached": 90, + "EventLogServiceControlEventLogBehavior": "0", + "EventLogServiceSpecifyMaximumFileSizeApplicationLog": 32768, + "EventLogServiceSpecifyMaximumFileSizeSecurityLog": 196608, + "EventLogServiceSpecifyMaximumFileSizeSystemLog": 32768, + "ExperienceAllowWindowsConsumerFeatures": 1, + "ExperienceDisableConsumerAccountStateContent": 1, + "ExperienceDoNotShowFeedbackNotifications": 1, + "FileExplorerTurnOffHeapTerminationOnCorruption": 0, + "FirewallDomainProfileApplyLocalConnectionSecurityRules": 1, + "FirewallDomainProfileApplyLocalFirewallRules": 1, + "FirewallDomainProfileDisplayNotification": 1, + "FirewallDomainProfileLogDroppedPackets": 1, + "FirewallDomainProfileLogFileMaxSize": 16384, + "FirewallDomainProfileLogFileName": "%SystemRoot%\\System32\\logfiles\\firewall\\domainfw.log", + "FirewallDomainProfileLogSuccessfulConnections": 1, + "FirewallDomainProfileOutboundConnection": 0, + "FirewallDomainProfileState": 1, + "FirewallDomainProfileUnicastResponse": 0, + "FirewallPrivateProfileApplyLocalConnectionSecurityRules": 1, + "FirewallPrivateProfileApplyLocalFirewallRules": 1, + "FirewallPrivateProfileDisplayNotification": 1, + "FirewallPrivateProfileLogDroppedPackets": 1, + "FirewallPrivateProfileLogFileMaxSize": 16384, + "FirewallPrivateProfileLogFileName": "%SystemRoot%\\System32\\logfiles\\firewall\\privatefw.log", + "FirewallPrivateProfileLogSuccessfulConnections": 1, + "FirewallPrivateProfileOutboundConnection": 0, + "FirewallPrivateProfileState": 1, + "FirewallPrivateProfileUnicastResponse": 0, + "FirewallPublicProfileApplyLocalConnectionSecurityRules": 1, + "FirewallPublicProfileApplyLocalFirewallRules": 1, + "FirewallPublicProfileDisplayNotification": 1, + "FirewallPublicProfileLogDroppedPackets": 1, + "FirewallPublicProfileLogFileMaxSize": 16384, + "FirewallPublicProfileLogFileName": "%SystemRoot%\\System32\\logfiles\\firewall\\publicfw.log", + "FirewallPublicProfileLogSuccessfulConnections": 1, + "FirewallPublicProfileOutboundConnection": 0, + "FirewallPublicProfileState": 1, + "FirewallPublicProfileUnicastResponse": 1, + "ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings": 1, + "GroupPolicyDisableBackgroundPolicy": 0, + "GroupPolicyEnableCDP": 0, + "GroupPolicyNoBackgroundPolicy": 0, + "GroupPolicyNoGPOListChanges": 0, + "ICMNC_ExitOnISP": 1, + "IPSourceRoutingProtectionLevel": 2, + "IPv6SourceRoutingProtectionLevel": 2, + "LANManagerAuthenticationLevel": 5, + "LDAPClientSigningRequirements": 1, + "LetEveryonePermissionsApplyToAnonymousUsers": 0, + "LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly": 1, + "LogonBlockUserFromShowingAccountDetailsOnSignin": 1, + "LogonDontEnumerateConnectedUsers": 1, + "LsaNoLMHash": 1, + "MachineInactivityLimit": 900, + "MaximumMachineAccountPasswordAge": 30, + "MinimumSessionSecurityForNTLMSSPBasedClients": 537395200, + "MinimumSessionSecurityForNTLMSSPBasedServers": 537395200, + "NetBTNodeTypeConfiguration": 2, + "NetworkConnectionsNC_ShowSharedAccessUI": 0, + "NetworkProviderHardenedPathsNETLOGON": [ + "RequireMutualAuthentication=1", + "RequireIntegrity=1" + ], + "NetworkProviderHardenedPathsSYSVOL": [ + "RequireMutualAuthentication=1", + "RequireIntegrity=1" + ], + "OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations": 1, + "PowerShellExecutionPolicyEnableTranscripting": 0, + "PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters": 1, + "PrintersRestrictDriverInstallationToAdministrators": 1, + "PrivacyAllowInputPersonalization": 0, + "PromptUserToChangePasswordBeforeExpiration": 14, + "RDPPortNumber": 3389, + "RemoteAssistanceSolicitedRemoteAssistance": 0, + "RemoteAssistanceUnsolicitedRemoteAssistance": 0, + "RemoteDesktopServicesClientConnectionEncryptionLevel": 3, + "RemoteDesktopServicesDoNotAllowDriveRedirection": 1, + "RemoteDesktopServicesDoNotAllowPasswordSaving": 1, + "RemoteDesktopServicesPromptForPasswordUponConnection": 1, + "RemoteDesktopServicesRequireSecureRPCCommunication": 1, + "RemotelyAccessibleRegistryPaths": [ + "System\\CurrentControlSet\\Control\\ProductOptions", + "System\\CurrentControlSet\\Control\\Server Applications", + "Software\\Microsoft\\Windows NT\\CurrentVersion" + ], + "RemoteManagementAllowBasicAuthentication_Client": 0, + "RemoteManagementAllowUnencryptedTraffic_Client": 0, + "RemoteManagementDisallowDigestAuthentication": 0, + "RemoteManagementDisallowStoringOfRunAsCredentials": 1, + "RequireCaseInsensitivityForNonWindowsSubsystems": 1, + "RequireStrongSessionKey": 1, + "RestrictAnonymousAccessToNamedPipesAndShares": 1, + "RSSDisableEnclosureDownload": 1, + "RunAllAdministratorsInAdminApprovalMode": 1, + "SafeDllSearchMode": 1, + "SearchAllowIndexingEncryptedStoresOrItems": 0, + "SendUnencryptedPasswordToThirdPartySMBServers": 0, + "SharesThatCanBeAccessedAnonymously": [], + "SharingAndSecurityModelForLocalAccounts": 0, + "ShellDataExecutionPrevention": 0, + "ShutdownSystemImmediatelyIfUnableToLogSecurityAudits": 0, + "SmartScreenEnableSmartScreenInShell": 1, + "StrengthenDefaultPermissionsOfInternalSystemObjects": 1, + "SwitchToTheSecureDesktopWhenPromptingForElevation": 1, + "SystemAllowTelemetry": 1, + "SystemBootStartDriverInitialization": 3, + "SystemLogonCacheSize": "4", + "SystemMinimizeInternetConnections": 1, + "SystemWindowsSearchService": 4, + "TerminalServerTS_TEMP_DELETE": 1, + "TerminalServerTS_TEMP_PER_SESSION": 1, + "TerminalServerTS_USER_AUTHENTICATION_POLICY": 1, + "UseAdminApprovalMode": 1, + "UserRightsAccessCredentialManagerAsTrustedCaller": "", + "UserRightsActAsPartOfTheOperatingSystem": "", + "UserRightsAdjustMemoryQuotasForProcess": [ + "*S-1-5-32-544", + "*S-1-5-19", + "*S-1-5-20" + ], + "UserRightsAllowLogOnThroughRemoteDesktop": [ + "*S-1-5-32-544", + "*S-1-5-32-555" + ], + "UserRightsChangeTimeZone": [ + "*S-1-5-32-544", + "*S-1-5-19" + ], + "UserRightsCreateGlobalObjects": [ + "*S-1-5-32-544", + "*S-1-5-6", + "*S-1-5-19", + "*S-1-5-20" + ], + "UserRightsCreatePageFile": [ + "*S-1-5-32-544" + ], + "UserRightsCreatePermanentSharedObjects": "", + "UserRightsCreateSymbolicLinks": [ + "*S-1-5-32-544", + "*S-1-5-83-0" + ], + "UserRightsCreateToken": "", + "UserRightsDenyAccessFromNetwork": [ + "*S-1-5-32-546" + ], + "UserRightsDenyLocalLogOn": [ + "*S-1-5-32-546" + ], + "UserRightsDenyLogOnAsBatchJob": [ + "*S-1-5-32-546" + ], + "UserRightsDenyLogOnAsService": [ + "*S-1-5-32-546" + ], + "UserRightsGenerateSecurityAudits": [ + "*S-1-5-19", + "*S-1-5-20", + "*S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415" + ], + "UserRightsIncreaseSchedulingPriority": [ + "*S-1-5-32-544" + ], + "UserRightsLoadUnloadDeviceDrivers": [ + "*S-1-5-32-544", + "*S-1-5-32-550" + ], + "UserRightsLockMemory": "", + "UserRightsManageAuditingAndSecurityLog": [ + "*S-1-5-32-544" + ], + "UserRightsManageVolume": [ + "*S-1-5-32-544" + ], + "UserRightsModifyFirmwareEnvironment": [ + "*S-1-5-32-544" + ], + "UserRightsModifyObjectLabel": "", + "UserRightsProfileSingleProcess": [ + "*S-1-5-32-544" + ], + "UserRightsProfileSystemPerformance": [ + "*S-1-5-32-544", + "*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420" + ], + "UserRightsRemoteShutdown": [ + "*S-1-5-32-544" + ], + "UserRightsReplaceProcessLevelToken": [ + "*S-1-5-19", + "*S-1-5-20" + ], + "UserRightsShutDownTheSystem": [ + "*S-1-5-32-544", + "*S-1-5-32-551" + ], + "UserRightsTakeOwnership": [ + "*S-1-5-32-544" + ], + "VirtualizeFileAndRegistryWriteFailuresToPerUserLocations": 1, + "WindowsDefenderDisableAntiSpyware": 0, + "WindowsDefenderExploitGuardASRExploitGuard_ASR_Rules": 1, + "WindowsDefenderExploitGuardNetworkProtectionEnableNetworkProtection": 1, + "WindowsDefenderPUAProtection": 1, + "WindowsDefenderRealTimeProtectionDisableBehaviorMonitoring": 0, + "WindowsDefenderRealTimeProtectionDisableIOAVProtection": 0, + "WindowsDefenderRealTimeProtectionDisableRealtimeMonitoring": 0, + "WindowsDefenderRealTimeProtectionDisableScriptScanning": 0, + "WindowsDefenderScanDisableEmailScanning": 0, + "WindowsDefenderScanDisableRemovableDriveScanning": 0, + "WindowsDefenderSecurityCenterAppBrowserProtectionDisallowExploitProtectionOverride": 1, + "WindowsDefenderSpyNetLocalSettingOverrideSpynetReporting": 0, + "WindowsDefenderSpyNetSubmitSamplesConsent": 1, + "WindowsExplorerShellProtocolProtectedModeTitle_2": 0, + "WindowsLogonAllowAutomaticRestartSignOn": 1, + "WindowsLogonDisableLockScreenAppNotifications": 1, + "WindowsLogonDontDisplayNetworkSelectionUI": 1, + "WindowsPowerShellTurnOnPowerShellScriptBlockLogging": 1 + } + }, + { + "profile": "ws2022-workgroup-member.osc.yaml", + "sourceRules": 200, + "outputRules": 202, + "sourceCsp": 71, + "convertedCsp": 71, + "residualCsp": [], + "keyPathNormalized": 129, + "providerCounts": { + "Microsoft.Windows/AccountPolicy": 11, + "Microsoft.Windows/Registry": 129, + "Microsoft.Windows/AuditPolicy": 26, + "Microsoft.Windows/UserRightsAssignment": 36 + }, + "expansions": [ + { + "name": "AccountLockoutPolicy", + "into": [ + "AccountLockoutPolicy", + "AccountLockoutPolicy_LockoutThreshold", + "AccountLockoutPolicy_LockoutReset" + ] + } + ], + "registryShapeRepairs": [ + { + "name": "RemotelyAccessibleRegistryPaths", + "from": { + "valueType": "REG_DWORD", + "value": [ + "System\\CurrentControlSet\\Control\\ProductOptions", + "System\\CurrentControlSet\\Control\\Server Applications", + "Software\\Microsoft\\Windows NT\\CurrentVersion" + ] + }, + "to": { + "valueType": "REG_MULTI_SZ", + "value": [ + "System\\CurrentControlSet\\Control\\ProductOptions", + "System\\CurrentControlSet\\Control\\Server Applications", + "Software\\Microsoft\\Windows NT\\CurrentVersion" + ] + }, + "evidence": "ws2025-member-server:RemotelyAccessibleRegistryPaths" + }, + { + "name": "RemotelyAccessibleRegistryPathsAndSubpaths", + "from": { + "valueType": "REG_DWORD", + "value": [ + "System\\CurrentControlSet\\Control\\Print\\Printers", + "System\\CurrentControlSet\\Services\\Eventlog", + "Software\\Microsoft\\OLAP Server", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Print", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows", + "System\\CurrentControlSet\\Control\\ContentIndex", + "System\\CurrentControlSet\\Control\\Terminal Server", + "System\\CurrentControlSet\\Control\\Terminal Server\\UserConfig", + "System\\CurrentControlSet\\Control\\Terminal Server\\DefaultUserConfiguration", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Perflib", + "System\\CurrentControlSet\\Services\\SysmonLog" + ] + }, + "to": { + "valueType": "REG_MULTI_SZ", + "value": [ + "System\\CurrentControlSet\\Control\\Print\\Printers", + "System\\CurrentControlSet\\Services\\Eventlog", + "Software\\Microsoft\\OLAP Server", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Print", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows", + "System\\CurrentControlSet\\Control\\ContentIndex", + "System\\CurrentControlSet\\Control\\Terminal Server", + "System\\CurrentControlSet\\Control\\Terminal Server\\UserConfig", + "System\\CurrentControlSet\\Control\\Terminal Server\\DefaultUserConfiguration", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Perflib", + "System\\CurrentControlSet\\Services\\SysmonLog" + ] + }, + "evidence": "ws2025-member-server:RemotelyAccessibleRegistryPathsAndSubpaths" + }, + { + "name": "SharesThatCanBeAccessedAnonymously", + "from": { + "valueType": "REG_DWORD", + "value": [] + }, + "to": { + "valueType": "REG_MULTI_SZ", + "value": [] + }, + "evidence": "ws2025-member-server:SharesThatCanBeAccessedAnonymously" + } + ], + "assertionRestatements": [ + { + "name": "UserRightsAccessCredentialManagerAsTrustedCaller", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AccessCredentialManagerAsTrustedCaller", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsActAsPartOfTheOperatingSystem", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ActAsPartOfTheOperatingSystem", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsCreatePermanentSharedObjects", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreatePermanentSharedObjects", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsCreateToken", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreateToken", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsEnableDelegation", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/EnableDelegation", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsLockMemory", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/LockMemory", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + }, + { + "name": "UserRightsModifyObjectLabel", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ModifyObjectLabel", + "from": { + "oneOf": [ + { + "const": "" + }, + { + "type": "null" + } + ] + }, + "to": "value == null || value.size() == 0", + "reason": "the scalar \"empty or not set\" schema is restated over the principal list the UserRightsAssignment provider returns" + } + ], + "assertionDowngrades": [], + "valueChanges": [ + { + "name": "AccountLockoutPolicy", + "from": "ResetAccountLockoutCounterAfter:15, AccountLockoutDuration:15, AccountLockoutThreshold:3", + "to": 15 + }, + { + "name": "DeviceLockClearTextPassword", + "from": 0, + "to": false + }, + { + "name": "DeviceLockPasswordComplexity", + "from": 1, + "to": true + }, + { + "name": "EnableGuestAccountStatus", + "from": 0, + "to": false + }, + { + "name": "UserRightsAccessCredentialManagerAsTrustedCaller", + "from": "", + "to": [] + }, + { + "name": "UserRightsActAsPartOfTheOperatingSystem", + "from": "", + "to": [] + }, + { + "name": "UserRightsCreatePermanentSharedObjects", + "from": "", + "to": [] + }, + { + "name": "UserRightsCreateToken", + "from": "", + "to": [] + }, + { + "name": "UserRightsEnableDelegation", + "from": "", + "to": [] + }, + { + "name": "UserRightsLockMemory", + "from": "", + "to": [] + }, + { + "name": "UserRightsModifyObjectLabel", + "from": "", + "to": [] + } + ], + "conversions": [ + { + "name": "AccountLockoutPolicy", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/AccountLockoutPolicy", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockAccountLockoutPolicy", + "ws2025-member-server:DeviceLockAccountLockoutPolicy", + "ws2025-domain-controller:DeviceLockAccountLockoutPolicy" + ] + }, + { + "name": "AuditAccountLockout", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditAccountLockout", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditAccountLockout", + "ws2025-member-server:AuditAccountLockout", + "ws2025-domain-controller:AuditAccountLockout" + ] + }, + { + "name": "AuditAuthenticationPolicyChange", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditAuthenticationPolicyChange", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditAuthenticationPolicyChange", + "ws2025-member-server:AuditAuthenticationPolicyChange", + "ws2025-domain-controller:AuditAuthenticationPolicyChange" + ] + }, + { + "name": "AuditAuthorizationPolicyChange", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditAuthorizationPolicyChange", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditAuthorizationPolicyChange", + "ws2025-member-server:AuditAuthorizationPolicyChange", + "ws2025-domain-controller:AuditAuthorizationPolicyChange" + ] + }, + { + "name": "AuditChangeCategoryOther", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditOtherPolicyChangeEvents", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditOtherPolicyChangeEvents", + "ws2025-member-server:AuditOtherPolicyChangeEvents", + "ws2025-domain-controller:AuditOtherPolicyChangeEvents" + ] + }, + { + "name": "AuditCredentialValidation", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogon_AuditCredentialValidation", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditCredentialValidation", + "ws2025-member-server:AuditCredentialValidation", + "ws2025-domain-controller:AuditCredentialValidation" + ] + }, + { + "name": "AuditDetailedFileShare", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditDetailedFileShare", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditDetailedFileShare", + "ws2025-member-server:AuditDetailedFileShare", + "ws2025-domain-controller:AuditDetailedFileShare" + ] + }, + { + "name": "AuditFileShare", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditFileShare", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditFileShare", + "ws2025-member-server:AuditFileShare", + "ws2025-domain-controller:AuditFileShare" + ] + }, + { + "name": "AuditGroupMembership", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditGroupMembership", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditGroupMembership", + "ws2025-member-server:AuditGroupMembership", + "ws2025-domain-controller:AuditGroupMembership" + ] + }, + { + "name": "AuditIPsecDriver", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditIPsecDriver", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditIPsecDriver", + "ws2025-member-server:AuditIPsecDriver", + "ws2025-domain-controller:AuditIPsecDriver" + ] + }, + { + "name": "AuditLogoff", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditLogoff", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditLogoff", + "ws2025-member-server:AuditLogoff", + "ws2025-domain-controller:AuditLogoff" + ] + }, + { + "name": "AuditLogon", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditLogon", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditLogon", + "ws2025-member-server:AuditLogon", + "ws2025-domain-controller:AuditLogon" + ] + }, + { + "name": "AuditMPSSVCRuleLevelPolicyChange", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditMPSSVCRuleLevelPolicyChange", + "ws2025-member-server:AuditMPSSVCRuleLevelPolicyChange", + "ws2025-domain-controller:AuditMPSSVCRuleLevelPolicyChange" + ] + }, + { + "name": "AuditOtherLogonLogoffEvents", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditOtherLogonLogoffEvents", + "ws2025-member-server:AuditOtherLogonLogoffEvents", + "ws2025-domain-controller:AuditOtherLogonLogoffEvents" + ] + }, + { + "name": "AuditOtherObjectAccessEvents", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditOtherObjectAccessEvents", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditOtherObjectAccessEvents", + "ws2025-member-server:AuditOtherObjectAccessEvents", + "ws2025-domain-controller:AuditOtherObjectAccessEvents" + ] + }, + { + "name": "AuditOtherSystemEvents", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditOtherSystemEvents", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditOtherSystemEvents", + "ws2025-member-server:AuditOtherSystemEvents", + "ws2025-domain-controller:AuditOtherSystemEvents" + ] + }, + { + "name": "AuditPnPExternalDevice", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/DetailedTracking_AuditPNPActivity", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditPnPExternalDevice", + "ws2025-member-server:AuditPnPExternalDevice", + "ws2025-domain-controller:AuditPnPExternalDevice" + ] + }, + { + "name": "AuditPolicyChange", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditPolicyChange", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditPolicyChange", + "ws2025-member-server:AuditPolicyChange", + "ws2025-domain-controller:AuditPolicyChange" + ] + }, + { + "name": "AuditProcessCreatedOrStarted", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/DetailedTracking_AuditProcessCreation", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditProcessCreatedOrStarted", + "ws2025-member-server:AuditProcessCreatedOrStarted", + "ws2025-domain-controller:AuditProcessCreatedOrStarted" + ] + }, + { + "name": "AuditRemovableStorage", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditRemovableStorage", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditRemovableStorage", + "ws2025-member-server:AuditRemovableStorage", + "ws2025-domain-controller:AuditRemovableStorage" + ] + }, + { + "name": "AuditSecurityGroupManagement", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditSecurityGroupManagement", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSecurityGroupManagement", + "ws2025-member-server:AuditSecurityGroupManagement", + "ws2025-domain-controller:AuditSecurityGroupManagement" + ] + }, + { + "name": "AuditSecurityStateChange", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditSecurityStateChange", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSecurityStateChange", + "ws2025-member-server:AuditSecurityStateChange", + "ws2025-domain-controller:AuditSecurityStateChange" + ] + }, + { + "name": "AuditSecuritySystemExtension", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditSecuritySystemExtension", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSecuritySystemExtension", + "ws2025-member-server:AuditSecuritySystemExtension", + "ws2025-domain-controller:AuditSecuritySystemExtension" + ] + }, + { + "name": "AuditSensitivePrivilegeUse", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PrivilegeUse_AuditSensitivePrivilegeUse", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSensitivePrivilegeUse", + "ws2025-member-server:AuditSensitivePrivilegeUse", + "ws2025-domain-controller:AuditSensitivePrivilegeUse" + ] + }, + { + "name": "AuditSpecialLogon", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditSpecialLogon", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSpecialLogon", + "ws2025-member-server:AuditSpecialLogon", + "ws2025-domain-controller:AuditSpecialLogon" + ] + }, + { + "name": "AuditSystemIntegrity", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditSystemIntegrity", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditSystemIntegrity", + "ws2025-member-server:AuditSystemIntegrity", + "ws2025-domain-controller:AuditSystemIntegrity" + ] + }, + { + "name": "AuditUserAccountManagement", + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditUserAccountManagement", + "to": "Microsoft.Windows/AuditPolicy", + "evidence": [ + "ws2025-workgroup-member:AuditUserAccountManagement", + "ws2025-member-server:AuditUserAccountManagement", + "ws2025-domain-controller:AuditUserAccountManagement" + ] + }, + { + "name": "DeviceLockClearTextPassword", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/ClearTextPassword", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockClearTextPassword", + "ws2025-member-server:DeviceLockClearTextPassword", + "ws2025-domain-controller:DeviceLockClearTextPassword" + ] + }, + { + "name": "DeviceLockMaximumPasswordAge", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/MaximumPasswordAge", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockMaximumPasswordAge", + "ws2025-member-server:DeviceLockMaximumPasswordAge", + "ws2025-domain-controller:DeviceLockMaximumPasswordAge" + ] + }, + { + "name": "DeviceLockMinDevicePasswordLength", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/MinimumPasswordLength", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockMinimumPasswordLength", + "ws2025-member-server:DeviceLockMinimumPasswordLength" + ] + }, + { + "name": "DeviceLockMinimumPasswordAge", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/MinimumPasswordAge", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockMinimumPasswordAge", + "ws2025-member-server:DeviceLockMinimumPasswordAge", + "ws2025-domain-controller:DeviceLockMinimumPasswordAge" + ] + }, + { + "name": "DeviceLockPasswordComplexity", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/PasswordComplexity", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockPasswordComplexity", + "ws2025-member-server:DeviceLockPasswordComplexity", + "ws2025-domain-controller:DeviceLockPasswordComplexity" + ] + }, + { + "name": "DeviceLockPasswordHistorySize", + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/PasswordHistorySize", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:DeviceLockPasswordHistorySize", + "ws2025-member-server:DeviceLockPasswordHistorySize", + "ws2025-domain-controller:DeviceLockPasswordHistorySize" + ] + }, + { + "name": "EnableGuestAccountStatus", + "cspPath": "./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:EnableGuestAccountStatus", + "ws2025-member-server:EnableGuestAccountStatus", + "ws2025-domain-controller:EnableGuestAccountStatus" + ] + }, + { + "name": "RenameGuestAccount", + "cspPath": "./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount", + "to": "Microsoft.Windows/AccountPolicy", + "evidence": [ + "ws2025-workgroup-member:RenameGuestAccount", + "ws2025-member-server:RenameGuestAccount", + "ws2025-domain-controller:RenameGuestAccount" + ] + }, + { + "name": "UserRightsAccessCredentialManagerAsTrustedCaller", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AccessCredentialManagerAsTrustedCaller", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsAccessCredentialManagerAsTrustedCaller", + "ws2025-member-server:UserRightsAccessCredentialManagerAsTrustedCaller", + "ws2025-domain-controller:UserRightsAccessCredentialManagerAsTrustedCaller" + ] + }, + { + "name": "UserRightsAccessFromNetwork", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AccessFromNetwork", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsAccessFromNetwork", + "ws2025-member-server:UserRightsAccessFromNetwork", + "ws2025-domain-controller:UserRightsAccessFromNetwork" + ] + }, + { + "name": "UserRightsActAsPartOfTheOperatingSystem", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ActAsPartOfTheOperatingSystem", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsActAsPartOfTheOperatingSystem", + "ws2025-member-server:UserRightsActAsPartOfTheOperatingSystem", + "ws2025-domain-controller:UserRightsActAsPartOfTheOperatingSystem" + ] + }, + { + "name": "UserRightsAllowLocalLogOn", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AllowLocalLogOn", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsAllowLocalLogOn", + "ws2025-member-server:UserRightsAllowLocalLogOn", + "ws2025-domain-controller:UserRightsAllowLocalLogOn" + ] + }, + { + "name": "UserRightsAllowLogOnThroughRemoteDesktop", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AllowLogOnThroughRemoteDesktop", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsAllowLogOnThroughRemoteDesktop", + "ws2025-member-server:UserRightsAllowLogOnThroughRemoteDesktop", + "ws2025-domain-controller:UserRightsAllowLogOnThroughRemoteDesktop" + ] + }, + { + "name": "UserRightsBackupFilesAndDirectories", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/BackupFilesAndDirectories", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsBackupFilesAndDirectories", + "ws2025-member-server:UserRightsBackupFilesAndDirectories", + "ws2025-domain-controller:UserRightsBackupFilesAndDirectories" + ] + }, + { + "name": "UserRightsBypassTraverseChecking", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/BypassTraverseChecking", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsBypassTraverseChecking", + "ws2025-member-server:UserRightsBypassTraverseChecking" + ] + }, + { + "name": "UserRightsChangeSystemTime", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ChangeSystemTime", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsChangeSystemTime", + "ws2025-member-server:UserRightsChangeSystemTime", + "ws2025-domain-controller:UserRightsChangeSystemTime" + ] + }, + { + "name": "UserRightsChangeTimeZone", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ChangeTimeZone", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsChangeTimeZone", + "ws2025-member-server:UserRightsChangeTimeZone", + "ws2025-domain-controller:UserRightsChangeTimeZone" + ] + }, + { + "name": "UserRightsCreateGlobalObjects", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreateGlobalObjects", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsCreateGlobalObjects", + "ws2025-member-server:UserRightsCreateGlobalObjects", + "ws2025-domain-controller:UserRightsCreateGlobalObjects" + ] + }, + { + "name": "UserRightsCreatePageFile", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreatePageFile", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsCreatePageFile", + "ws2025-member-server:UserRightsCreatePageFile", + "ws2025-domain-controller:UserRightsCreatePageFile" + ] + }, + { + "name": "UserRightsCreatePermanentSharedObjects", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreatePermanentSharedObjects", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsCreatePermanentSharedObjects", + "ws2025-member-server:UserRightsCreatePermanentSharedObjects", + "ws2025-domain-controller:UserRightsCreatePermanentSharedObjects" + ] + }, + { + "name": "UserRightsCreateSymbolicLinks", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreateSymbolicLinks", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsCreateSymbolicLinks", + "ws2025-member-server:UserRightsCreateSymbolicLinks", + "ws2025-domain-controller:UserRightsCreateSymbolicLinks" + ] + }, + { + "name": "UserRightsCreateToken", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreateToken", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsCreateToken", + "ws2025-member-server:UserRightsCreateToken", + "ws2025-domain-controller:UserRightsCreateToken" + ] + }, + { + "name": "UserRightsDenyAccessFromNetwork", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyAccessFromNetwork", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyAccessFromNetwork", + "ws2025-member-server:UserRightsDenyAccessFromNetwork", + "ws2025-domain-controller:UserRightsDenyAccessFromNetwork" + ] + }, + { + "name": "UserRightsDenyLocalLogOn", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyLocalLogOn", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyLocalLogOn", + "ws2025-member-server:UserRightsDenyLocalLogOn", + "ws2025-domain-controller:UserRightsDenyLocalLogOn" + ] + }, + { + "name": "UserRightsDenyLogOnAsBatchJob", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyLogOnAsBatchJob", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyLogOnAsBatchJob", + "ws2025-member-server:UserRightsDenyLogOnAsBatchJob", + "ws2025-domain-controller:UserRightsDenyLogOnAsBatchJob" + ] + }, + { + "name": "UserRightsDenyLogOnAsService", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyLogOnAsService", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyLogOnAsService", + "ws2025-member-server:UserRightsDenyLogOnAsService", + "ws2025-domain-controller:UserRightsDenyLogOnAsService" + ] + }, + { + "name": "UserRightsDenyRemoteDesktopServicesLogOn", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyRemoteDesktopServicesLogOn", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyRemoteDesktopServicesLogOn", + "ws2025-member-server:UserRightsDenyRemoteDesktopServicesLogOn", + "ws2025-domain-controller:UserRightsDenyRemoteDesktopServicesLogOn" + ] + }, + { + "name": "UserRightsEnableDelegation", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/EnableDelegation", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsEnableDelegation", + "ws2025-member-server:UserRightsEnableDelegation", + "ws2025-domain-controller:UserRightsEnableDelegation" + ] + }, + { + "name": "UserRightsGenerateSecurityAudits", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/GenerateSecurityAudits", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsGenerateSecurityAudits", + "ws2025-member-server:UserRightsGenerateSecurityAudits", + "ws2025-domain-controller:UserRightsGenerateSecurityAudits" + ] + }, + { + "name": "UserRightsIncreaseProcessWorkingSet", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/IncreaseProcessWorkingSet", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsIncreaseProcessWorkingSet", + "ws2025-member-server:UserRightsIncreaseProcessWorkingSet" + ] + }, + { + "name": "UserRightsIncreaseSchedulingPriority", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/IncreaseSchedulingPriority", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsIncreaseSchedulingPriority", + "ws2025-member-server:UserRightsIncreaseSchedulingPriority", + "ws2025-domain-controller:UserRightsIncreaseSchedulingPriority" + ] + }, + { + "name": "UserRightsLoadUnloadDeviceDrivers", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/LoadUnloadDeviceDrivers", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsLoadUnloadDeviceDrivers", + "ws2025-member-server:UserRightsLoadUnloadDeviceDrivers", + "ws2025-domain-controller:UserRightsLoadUnloadDeviceDrivers" + ] + }, + { + "name": "UserRightsLockMemory", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/LockMemory", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsLockMemory", + "ws2025-member-server:UserRightsLockMemory", + "ws2025-domain-controller:UserRightsLockMemory" + ] + }, + { + "name": "UserRightsManageAuditingAndSecurityLog", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ManageAuditingAndSecurityLog", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsManageAuditingAndSecurityLog", + "ws2025-member-server:UserRightsManageAuditingAndSecurityLog", + "ws2025-domain-controller:UserRightsManageAuditingAndSecurityLog" + ] + }, + { + "name": "UserRightsManageVolume", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ManageVolume", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsManageVolume", + "ws2025-member-server:UserRightsManageVolume", + "ws2025-domain-controller:UserRightsManageVolume" + ] + }, + { + "name": "UserRightsModifyFirmwareEnvironment", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ModifyFirmwareEnvironment", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsModifyFirmwareEnvironment", + "ws2025-member-server:UserRightsModifyFirmwareEnvironment", + "ws2025-domain-controller:UserRightsModifyFirmwareEnvironment" + ] + }, + { + "name": "UserRightsModifyObjectLabel", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ModifyObjectLabel", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsModifyObjectLabel", + "ws2025-member-server:UserRightsModifyObjectLabel", + "ws2025-domain-controller:UserRightsModifyObjectLabel" + ] + }, + { + "name": "UserRightsProfileSingleProcess", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ProfileSingleProcess", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsProfileSingleProcess", + "ws2025-member-server:UserRightsProfileSingleProcess", + "ws2025-domain-controller:UserRightsProfileSingleProcess" + ] + }, + { + "name": "UserRightsProfileSystemPerformance", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ProfileSystemPerformance", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsProfileSystemPerformance", + "ws2025-member-server:UserRightsProfileSystemPerformance", + "ws2025-domain-controller:UserRightsProfileSystemPerformance" + ] + }, + { + "name": "UserRightsRemoteShutdown", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/RemoteShutdown", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsRemoteShutdown", + "ws2025-member-server:UserRightsRemoteShutdown", + "ws2025-domain-controller:UserRightsRemoteShutdown" + ] + }, + { + "name": "UserRightsReplaceProcessLevelToken", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ReplaceProcessLevelToken", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsReplaceProcessLevelToken", + "ws2025-member-server:UserRightsReplaceProcessLevelToken", + "ws2025-domain-controller:UserRightsReplaceProcessLevelToken" + ] + }, + { + "name": "UserRightsRestoreFilesAndDirectories", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/RestoreFilesAndDirectories", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsRestoreFilesAndDirectories", + "ws2025-member-server:UserRightsRestoreFilesAndDirectories", + "ws2025-domain-controller:UserRightsRestoreFilesAndDirectories" + ] + }, + { + "name": "UserRightsShutDownTheSystem", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ShutDownTheSystem", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsShutDownTheSystem", + "ws2025-member-server:UserRightsShutDownTheSystem", + "ws2025-domain-controller:UserRightsShutDownTheSystem" + ] + }, + { + "name": "UserRightsTakeOwnership", + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/TakeOwnership", + "to": "Microsoft.Windows/UserRightsAssignment", + "evidence": [ + "ws2025-workgroup-member:UserRightsTakeOwnership", + "ws2025-member-server:UserRightsTakeOwnership", + "ws2025-domain-controller:UserRightsTakeOwnership" + ] + } + ], + "sourceRuleNames": [ + "AccountLockoutPolicy", + "AllowedToFormatAndEjectRemovableMedia", + "AllowICMPRedirectsToOverrideOSPFGeneratedRoutes", + "AllowLocalSystemNULLSessionFallback", + "AllowLocalSystemToUseComputerIdentityForNTLM", + "AllowSystemToBeShutDownWithoutHavingToLogOn", + "AllowUIAccessApplicationsToPromptForElevation", + "AmountOfIdleTimeRequiredBeforeSuspendingSession", + "ApplicationManagementMSIAllowUserControlOverInstall", + "ApplicationManagementMSIAlwaysInstallWithElevatedPrivileges", + "AppRuntimeAllowMicrosoftAccountsToBeOptional", + "AuditAccountLockout", + "AuditAuthenticationPolicyChange", + "AuditAuthorizationPolicyChange", + "AuditChangeCategoryOther", + "AuditCredentialValidation", + "AuditDetailedFileShare", + "AuditFileShare", + "AuditGroupMembership", + "AuditIPsecDriver", + "AuditLogoff", + "AuditLogon", + "AuditMPSSVCRuleLevelPolicyChange", + "AuditOtherLogonLogoffEvents", + "AuditOtherObjectAccessEvents", + "AuditOtherSystemEvents", + "AuditPnPExternalDevice", + "AuditPolicyChange", + "AuditProcessCreatedOrStarted", + "AuditRemovableStorage", + "AuditSecurityGroupManagement", + "AuditSecurityStateChange", + "AuditSecuritySystemExtension", + "AuditSensitivePrivilegeUse", + "AuditSettingsIncludeCmdLine", + "AuditSpecialLogon", + "AuditSystemIntegrity", + "AuditUserAccountManagement", + "AutoplayDisallowAutoplayForNonVolumeDevices", + "AutoplaySetDefaultAutoRunBehavior", + "AutoplayTurnOffAutoPlay", + "BehaviorOfTheElevationPromptForAdministrators", + "BehaviorOfTheElevationPromptForStandardUsers", + "ClearVirtualMemoryPageFile", + "ConfigureSMBV1Server", + "ConnectivityDisableDownloadingOfPrintDriversOverHTTP", + "ConnectivityProhibitInstallationAndConfigurationOfNetworkBridge", + "CredentialProvidersAllowPINLogon", + "CredentialsUIDisablePasswordReveal", + "CredentialsUIEnumerateAdministrators", + "CryptographyAllowedKerberosEncryptionTypes", + "CryptographyForceStrongKeyProtection", + "DetectApplicationInstallationsAndPromptForElevation", + "DeviceLockClearTextPassword", + "DeviceLockMaximumPasswordAge", + "DeviceLockMinDevicePasswordLength", + "DeviceLockMinimumPasswordAge", + "DeviceLockPasswordComplexity", + "DeviceLockPasswordHistorySize", + "DigitallySignCommunicationsAlwaysClient", + "DigitallySignCommunicationsAlwaysServer", + "DigitallySignCommunicationsIfClientAgrees", + "DigitallySignCommunicationsIfServerAgrees", + "DisconnectClientsWhenLogonHoursExpire", + "DnsClientTurn_Off_Multicast", + "DoNotAllowAnonymousEnumerationOfSAMAccounts", + "DoNotAllowAnonymousEnumerationOfSamAccountsAndShares", + "DoNotDisplayLastSignedIn", + "DoNotRequireCTRLALTDEL", + "EnabledNTPClient", + "EnableGuestAccountStatus", + "EventLogChannelSecurityLogRetention", + "EventLogChannelSetupLogMaxSize", + "EventLogChannelSetupLogRetention", + "EventLogChannelSystemLogRetention", + "EventLogServiceControlEventLogBehavior", + "EventLogServiceSpecifyMaximumFileSizeApplicationLog", + "EventLogServiceSpecifyMaximumFileSizeSecurityLog", + "EventLogServiceSpecifyMaximumFileSizeSystemLog", + "ExperienceAllowWindowsConsumerFeatures", + "ExperienceDoNotShowFeedbackNotifications", + "FileExplorerTurnOffHeapTerminationOnCorruption", + "FirewallDomainProfileLogDroppedPackets", + "FirewallDomainProfileState", + "FirewallPrivateProfileApplyLocalConnectionSecurityRules", + "FirewallPrivateProfileApplyLocalFirewallRules", + "FirewallPrivateProfileDisplayNotification", + "FirewallPrivateProfileOutboundConnection", + "FirewallPrivateProfileState", + "FirewallPrivateProfileUnicastResponse", + "FirewallPublicProfileApplyLocalFirewallRules", + "FirewallPublicProfileDisplayNotification", + "FirewallPublicProfileLogFileMaxSize", + "FirewallPublicProfileLogSuccessfulConnections", + "FirewallPublicProfileOutboundConnection", + "FirewallPublicProfileState", + "FirewallPublicProfileUnicastResponse", + "ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings", + "GroupPolicyEnableCDP", + "ICMNC_ExitOnISP", + "LANManagerAuthenticationLevel", + "LanmanWorkstationEnableInsecureGuestLogons", + "LDAPClientSigningRequirements", + "LetEveryonePermissionsApplyToAnonymousUsers", + "LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly", + "LogonBlockUserFromShowingAccountDetailsOnSignin", + "LsaNoLMHash", + "MachineInactivityLimit", + "MinimumSessionSecurityForNTLMSSPBasedClients", + "MinimumSessionSecurityForNTLMSSPBasedServers", + "NetworkConnectionsNC_ShowSharedAccessUI", + "OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations", + "PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters", + "PrivacyAllowInputPersonalization", + "PromptUserToChangePasswordBeforeExpiration", + "RDPPortNumber", + "RemoteAssistanceSolicitedRemoteAssistance", + "RemoteAssistanceUnsolicitedRemoteAssistance", + "RemoteDesktopServicesClientConnectionEncryptionLevel", + "RemoteDesktopServicesDoNotAllowPasswordSaving", + "RemoteDesktopServicesPromptForPasswordUponConnection", + "RemoteDesktopServicesRequireSecureRPCCommunication", + "RemotelyAccessibleRegistryPaths", + "RemotelyAccessibleRegistryPathsAndSubpaths", + "RemoteManagementAllowBasicAuthentication_Client", + "RemoteManagementAllowUnencryptedTraffic_Client", + "RemoteManagementDisallowDigestAuthentication", + "RemoteManagementDisallowStoringOfRunAsCredentials", + "RenameGuestAccount", + "RequireCaseInsensitivityForNonWindowsSubsystems", + "RestrictAnonymousAccessToNamedPipesAndShares", + "RestrictClientsAllowedToMakeRemoteCallsToSAM", + "RSSDisableEnclosureDownload", + "RunAllAdministratorsInAdminApprovalMode", + "SearchAllowIndexingEncryptedStoresOrItems", + "SendUnencryptedPasswordToThirdPartySMBServers", + "SharesThatCanBeAccessedAnonymously", + "SharingAndSecurityModelForLocalAccounts", + "ShellDataExecutionPrevention", + "ShutdownSystemImmediatelyIfUnableToLogSecurityAudits", + "SmartScreenEnableSmartScreenInShell", + "StrengthenDefaultPermissionsOfInternalSystemObjects", + "SwitchToTheSecureDesktopWhenPromptingForElevation", + "SystemAllowTelemetry", + "SystemBootStartDriverInitialization", + "SystemEnableSoftwareRestrictionPolicies", + "SystemLogonCacheSize", + "SystemMinimizeInternetConnections", + "SystemWindowsSearchService", + "TerminalServerTS_TEMP_DELETE", + "TerminalServerTS_TEMP_PER_SESSION", + "TerminalServerTS_USER_AUTHENTICATION_POLICY", + "UseAdminApprovalMode", + "UserRightsAccessCredentialManagerAsTrustedCaller", + "UserRightsAccessFromNetwork", + "UserRightsActAsPartOfTheOperatingSystem", + "UserRightsAllowLocalLogOn", + "UserRightsAllowLogOnThroughRemoteDesktop", + "UserRightsBackupFilesAndDirectories", + "UserRightsBypassTraverseChecking", + "UserRightsChangeSystemTime", + "UserRightsChangeTimeZone", + "UserRightsCreateGlobalObjects", + "UserRightsCreatePageFile", + "UserRightsCreatePermanentSharedObjects", + "UserRightsCreateSymbolicLinks", + "UserRightsCreateToken", + "UserRightsDenyAccessFromNetwork", + "UserRightsDenyLocalLogOn", + "UserRightsDenyLogOnAsBatchJob", + "UserRightsDenyLogOnAsService", + "UserRightsDenyRemoteDesktopServicesLogOn", + "UserRightsEnableDelegation", + "UserRightsGenerateSecurityAudits", + "UserRightsIncreaseProcessWorkingSet", + "UserRightsIncreaseSchedulingPriority", + "UserRightsLoadUnloadDeviceDrivers", + "UserRightsLockMemory", + "UserRightsManageAuditingAndSecurityLog", + "UserRightsManageVolume", + "UserRightsModifyFirmwareEnvironment", + "UserRightsModifyObjectLabel", + "UserRightsProfileSingleProcess", + "UserRightsProfileSystemPerformance", + "UserRightsRemoteShutdown", + "UserRightsReplaceProcessLevelToken", + "UserRightsRestoreFilesAndDirectories", + "UserRightsShutDownTheSystem", + "UserRightsTakeOwnership", + "VirtualizeFileAndRegistryWriteFailuresToPerUserLocations", + "WindowsDefenderRealTimeProtectionDisableBehaviorMonitoring", + "WindowsDefenderScanDisableEmailScanning", + "WindowsDefenderScanDisableRemovableDriveScanning", + "WindowsDefenderSpyNetLocalSettingOverrideSpynetReporting", + "WindowsDefenderSpyNetSubmitSamplesConsent", + "WindowsExplorerShellProtocolProtectedModeTitle_2", + "WindowsLogonAllowAutomaticRestartSignOn", + "WindowsLogonDisableLockScreenAppNotifications", + "WindowsLogonDontDisplayNetworkSelectionUI", + "WindowsPowerShellTurnOnPowerShellScriptBlockLogging" + ], + "sourceValues": { + "AccountLockoutPolicy": "ResetAccountLockoutCounterAfter:15, AccountLockoutDuration:15, AccountLockoutThreshold:3", + "AllowedToFormatAndEjectRemovableMedia": "0", + "AllowICMPRedirectsToOverrideOSPFGeneratedRoutes": 0, + "AllowLocalSystemNULLSessionFallback": 0, + "AllowLocalSystemToUseComputerIdentityForNTLM": 1, + "AllowSystemToBeShutDownWithoutHavingToLogOn": 0, + "AllowUIAccessApplicationsToPromptForElevation": 0, + "AmountOfIdleTimeRequiredBeforeSuspendingSession": 15, + "ApplicationManagementMSIAllowUserControlOverInstall": 0, + "ApplicationManagementMSIAlwaysInstallWithElevatedPrivileges": 0, + "AppRuntimeAllowMicrosoftAccountsToBeOptional": 1, + "AuditAccountLockout": 2, + "AuditAuthenticationPolicyChange": 1, + "AuditAuthorizationPolicyChange": 1, + "AuditChangeCategoryOther": 2, + "AuditCredentialValidation": 3, + "AuditDetailedFileShare": 2, + "AuditFileShare": 3, + "AuditGroupMembership": 1, + "AuditIPsecDriver": 3, + "AuditLogoff": 1, + "AuditLogon": 3, + "AuditMPSSVCRuleLevelPolicyChange": 3, + "AuditOtherLogonLogoffEvents": 3, + "AuditOtherObjectAccessEvents": 3, + "AuditOtherSystemEvents": 3, + "AuditPnPExternalDevice": 1, + "AuditPolicyChange": 1, + "AuditProcessCreatedOrStarted": 1, + "AuditRemovableStorage": 3, + "AuditSecurityGroupManagement": 1, + "AuditSecurityStateChange": 1, + "AuditSecuritySystemExtension": 1, + "AuditSensitivePrivilegeUse": 3, + "AuditSettingsIncludeCmdLine": 1, + "AuditSpecialLogon": 1, + "AuditSystemIntegrity": 3, + "AuditUserAccountManagement": 3, + "AutoplayDisallowAutoplayForNonVolumeDevices": 1, + "AutoplaySetDefaultAutoRunBehavior": 1, + "AutoplayTurnOffAutoPlay": 255, + "BehaviorOfTheElevationPromptForAdministrators": 2, + "BehaviorOfTheElevationPromptForStandardUsers": 0, + "ClearVirtualMemoryPageFile": 0, + "ConfigureSMBV1Server": 0, + "ConnectivityDisableDownloadingOfPrintDriversOverHTTP": 1, + "ConnectivityProhibitInstallationAndConfigurationOfNetworkBridge": 0, + "CredentialProvidersAllowPINLogon": 0, + "CredentialsUIDisablePasswordReveal": 1, + "CredentialsUIEnumerateAdministrators": 0, + "CryptographyAllowedKerberosEncryptionTypes": 2147483640, + "CryptographyForceStrongKeyProtection": 2, + "DetectApplicationInstallationsAndPromptForElevation": 1, + "DeviceLockClearTextPassword": 0, + "DeviceLockMaximumPasswordAge": 42, + "DeviceLockMinDevicePasswordLength": 14, + "DeviceLockMinimumPasswordAge": 1, + "DeviceLockPasswordComplexity": 1, + "DeviceLockPasswordHistorySize": 24, + "DigitallySignCommunicationsAlwaysClient": 1, + "DigitallySignCommunicationsAlwaysServer": 1, + "DigitallySignCommunicationsIfClientAgrees": 1, + "DigitallySignCommunicationsIfServerAgrees": 1, + "DisconnectClientsWhenLogonHoursExpire": 1, + "DnsClientTurn_Off_Multicast": 0, + "DoNotAllowAnonymousEnumerationOfSAMAccounts": 1, + "DoNotAllowAnonymousEnumerationOfSamAccountsAndShares": 1, + "DoNotDisplayLastSignedIn": 1, + "DoNotRequireCTRLALTDEL": 0, + "EnabledNTPClient": 1, + "EnableGuestAccountStatus": 0, + "EventLogChannelSecurityLogRetention": "0", + "EventLogChannelSetupLogMaxSize": 32768, + "EventLogChannelSetupLogRetention": "0", + "EventLogChannelSystemLogRetention": "0", + "EventLogServiceControlEventLogBehavior": "0", + "EventLogServiceSpecifyMaximumFileSizeApplicationLog": 32768, + "EventLogServiceSpecifyMaximumFileSizeSecurityLog": 196608, + "EventLogServiceSpecifyMaximumFileSizeSystemLog": 32768, + "ExperienceAllowWindowsConsumerFeatures": 1, + "ExperienceDoNotShowFeedbackNotifications": 1, + "FileExplorerTurnOffHeapTerminationOnCorruption": 0, + "FirewallDomainProfileLogDroppedPackets": 1, + "FirewallDomainProfileState": 1, + "FirewallPrivateProfileApplyLocalConnectionSecurityRules": 1, + "FirewallPrivateProfileApplyLocalFirewallRules": 1, + "FirewallPrivateProfileDisplayNotification": 1, + "FirewallPrivateProfileOutboundConnection": 0, + "FirewallPrivateProfileState": 1, + "FirewallPrivateProfileUnicastResponse": 0, + "FirewallPublicProfileApplyLocalFirewallRules": 1, + "FirewallPublicProfileDisplayNotification": 1, + "FirewallPublicProfileLogFileMaxSize": 16384, + "FirewallPublicProfileLogSuccessfulConnections": 1, + "FirewallPublicProfileOutboundConnection": 0, + "FirewallPublicProfileState": 1, + "FirewallPublicProfileUnicastResponse": 1, + "ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings": 1, + "GroupPolicyEnableCDP": 0, + "ICMNC_ExitOnISP": 1, + "LANManagerAuthenticationLevel": 5, + "LanmanWorkstationEnableInsecureGuestLogons": 0, + "LDAPClientSigningRequirements": 1, + "LetEveryonePermissionsApplyToAnonymousUsers": 0, + "LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly": 1, + "LogonBlockUserFromShowingAccountDetailsOnSignin": 1, + "LsaNoLMHash": 1, + "MachineInactivityLimit": 900, + "MinimumSessionSecurityForNTLMSSPBasedClients": 537395200, + "MinimumSessionSecurityForNTLMSSPBasedServers": 537395200, + "NetworkConnectionsNC_ShowSharedAccessUI": 0, + "OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations": 1, + "PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters": 1, + "PrivacyAllowInputPersonalization": 0, + "PromptUserToChangePasswordBeforeExpiration": 14, + "RDPPortNumber": 3389, + "RemoteAssistanceSolicitedRemoteAssistance": 0, + "RemoteAssistanceUnsolicitedRemoteAssistance": 0, + "RemoteDesktopServicesClientConnectionEncryptionLevel": 3, + "RemoteDesktopServicesDoNotAllowPasswordSaving": 1, + "RemoteDesktopServicesPromptForPasswordUponConnection": 1, + "RemoteDesktopServicesRequireSecureRPCCommunication": 1, + "RemotelyAccessibleRegistryPaths": [ + "System\\CurrentControlSet\\Control\\ProductOptions", + "System\\CurrentControlSet\\Control\\Server Applications", + "Software\\Microsoft\\Windows NT\\CurrentVersion" + ], + "RemotelyAccessibleRegistryPathsAndSubpaths": [ + "System\\CurrentControlSet\\Control\\Print\\Printers", + "System\\CurrentControlSet\\Services\\Eventlog", + "Software\\Microsoft\\OLAP Server", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Print", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows", + "System\\CurrentControlSet\\Control\\ContentIndex", + "System\\CurrentControlSet\\Control\\Terminal Server", + "System\\CurrentControlSet\\Control\\Terminal Server\\UserConfig", + "System\\CurrentControlSet\\Control\\Terminal Server\\DefaultUserConfiguration", + "Software\\Microsoft\\Windows NT\\CurrentVersion\\Perflib", + "System\\CurrentControlSet\\Services\\SysmonLog" + ], + "RemoteManagementAllowBasicAuthentication_Client": 0, + "RemoteManagementAllowUnencryptedTraffic_Client": 0, + "RemoteManagementDisallowDigestAuthentication": 0, + "RemoteManagementDisallowStoringOfRunAsCredentials": 1, + "RequireCaseInsensitivityForNonWindowsSubsystems": 1, + "RestrictAnonymousAccessToNamedPipesAndShares": 1, + "RestrictClientsAllowedToMakeRemoteCallsToSAM": "O:BAG:BAD:(A;;RC;;;BA)", + "RSSDisableEnclosureDownload": 1, + "RunAllAdministratorsInAdminApprovalMode": 1, + "SearchAllowIndexingEncryptedStoresOrItems": 0, + "SendUnencryptedPasswordToThirdPartySMBServers": 0, + "SharesThatCanBeAccessedAnonymously": [], + "SharingAndSecurityModelForLocalAccounts": 0, + "ShellDataExecutionPrevention": 0, + "ShutdownSystemImmediatelyIfUnableToLogSecurityAudits": 0, + "SmartScreenEnableSmartScreenInShell": 1, + "StrengthenDefaultPermissionsOfInternalSystemObjects": 1, + "SwitchToTheSecureDesktopWhenPromptingForElevation": 1, + "SystemAllowTelemetry": 1, + "SystemBootStartDriverInitialization": 3, + "SystemEnableSoftwareRestrictionPolicies": 1, + "SystemLogonCacheSize": "4", + "SystemMinimizeInternetConnections": 1, + "SystemWindowsSearchService": 4, + "TerminalServerTS_TEMP_DELETE": 1, + "TerminalServerTS_TEMP_PER_SESSION": 1, + "TerminalServerTS_USER_AUTHENTICATION_POLICY": 1, + "UseAdminApprovalMode": 1, + "UserRightsAccessCredentialManagerAsTrustedCaller": "", + "UserRightsAccessFromNetwork": [ + "*S-1-5-32-544", + "*S-1-5-11" + ], + "UserRightsActAsPartOfTheOperatingSystem": "", + "UserRightsAllowLocalLogOn": [ + "*S-1-5-32-544" + ], + "UserRightsAllowLogOnThroughRemoteDesktop": [ + "*S-1-5-32-544", + "*S-1-5-32-555" + ], + "UserRightsBackupFilesAndDirectories": [ + "*S-1-5-32-544", + "*S-1-5-32-551", + "*S-1-5-32-549" + ], + "UserRightsBypassTraverseChecking": [ + "*S-1-5-32-544", + "*S-1-5-11", + "*S-1-5-32-551", + "*S-1-5-19", + "*S-1-5-20" + ], + "UserRightsChangeSystemTime": [ + "*S-1-5-32-544", + "*S-1-5-32-549", + "*S-1-5-19" + ], + "UserRightsChangeTimeZone": [ + "*S-1-5-32-544", + "*S-1-5-19" + ], + "UserRightsCreateGlobalObjects": [ + "*S-1-5-32-544", + "*S-1-5-6", + "*S-1-5-19", + "*S-1-5-20" + ], + "UserRightsCreatePageFile": [ + "*S-1-5-32-544" + ], + "UserRightsCreatePermanentSharedObjects": "", + "UserRightsCreateSymbolicLinks": [ + "*S-1-5-32-544", + "*S-1-5-83-0" + ], + "UserRightsCreateToken": "", + "UserRightsDenyAccessFromNetwork": [ + "*S-1-5-32-546" + ], + "UserRightsDenyLocalLogOn": [ + "*S-1-5-32-546" + ], + "UserRightsDenyLogOnAsBatchJob": [ + "*S-1-5-32-546" + ], + "UserRightsDenyLogOnAsService": [ + "*S-1-5-32-546" + ], + "UserRightsDenyRemoteDesktopServicesLogOn": [ + "*S-1-5-32-546" + ], + "UserRightsEnableDelegation": "", + "UserRightsGenerateSecurityAudits": [ + "*S-1-5-19", + "*S-1-5-20", + "*S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415" + ], + "UserRightsIncreaseProcessWorkingSet": [ + "*S-1-5-32-544", + "*S-1-5-19" + ], + "UserRightsIncreaseSchedulingPriority": [ + "*S-1-5-32-544" + ], + "UserRightsLoadUnloadDeviceDrivers": [ + "*S-1-5-32-544", + "*S-1-5-32-550" + ], + "UserRightsLockMemory": "", + "UserRightsManageAuditingAndSecurityLog": [ + "*S-1-5-32-544" + ], + "UserRightsManageVolume": [ + "*S-1-5-32-544" + ], + "UserRightsModifyFirmwareEnvironment": [ + "*S-1-5-32-544" + ], + "UserRightsModifyObjectLabel": "", + "UserRightsProfileSingleProcess": [ + "*S-1-5-32-544" + ], + "UserRightsProfileSystemPerformance": [ + "*S-1-5-32-544", + "*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420" + ], + "UserRightsRemoteShutdown": [ + "*S-1-5-32-544" + ], + "UserRightsReplaceProcessLevelToken": [ + "*S-1-5-19", + "*S-1-5-20" + ], + "UserRightsRestoreFilesAndDirectories": [ + "*S-1-5-32-544", + "*S-1-5-32-551" + ], + "UserRightsShutDownTheSystem": [ + "*S-1-5-32-544", + "*S-1-5-32-551" + ], + "UserRightsTakeOwnership": [ + "*S-1-5-32-544" + ], + "VirtualizeFileAndRegistryWriteFailuresToPerUserLocations": 1, + "WindowsDefenderRealTimeProtectionDisableBehaviorMonitoring": 0, + "WindowsDefenderScanDisableEmailScanning": 0, + "WindowsDefenderScanDisableRemovableDriveScanning": 0, + "WindowsDefenderSpyNetLocalSettingOverrideSpynetReporting": 0, + "WindowsDefenderSpyNetSubmitSamplesConsent": 1, + "WindowsExplorerShellProtocolProtectedModeTitle_2": 0, + "WindowsLogonAllowAutomaticRestartSignOn": 1, + "WindowsLogonDisableLockScreenAppNotifications": 1, + "WindowsLogonDontDisplayNetworkSelectionUI": 1, + "WindowsPowerShellTurnOnPowerShellScriptBlockLogging": 1 + } + } + ] +} diff --git a/scripts/ws2022-baseline-repair/csp-provider-map.json b/scripts/ws2022-baseline-repair/csp-provider-map.json new file mode 100644 index 0000000..aac1258 --- /dev/null +++ b/scripts/ws2022-baseline-repair/csp-provider-map.json @@ -0,0 +1,1670 @@ +{ + "_provenance": { + "description": "Policy CSP OMA-URI -> dedicated provider + addressing, extracted from the reviewed WS2025 CSP repair. Values are NOT carried over; only the mechanism is.", + "providerBeforeCommit": "ab71aaf778a87322899a671e6d06bce0fa40aa2a", + "providerAfterCommit": "50d469c3cf5e16729f1359538b10ef4bc0b6de78", + "ws2022SourceCommit": "173177e9eaa34d0b910b44d0749192859831fd50", + "paths": [ + "public/_baselines/ws2025-workgroup-member.osc.yaml", + "public/_baselines/ws2025-member-server.osc.yaml", + "public/_baselines/ws2025-domain-controller.osc.yaml" + ], + "reachableFromOriginMain": true, + "regenerate": "node scripts/ws2022-baseline-repair/derive-maps.mjs" + }, + "entries": [ + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogon_AuditCredentialValidation", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE923F-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 3, + "evidence": [ + "ws2025-workgroup-member:AuditCredentialValidation", + "ws2025-member-server:AuditCredentialValidation", + "ws2025-domain-controller:AuditCredentialValidation" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditCredentialValidation", + "ws2022-domain-member:AuditCredentialValidation" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogon_AuditKerberosAuthenticationService", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9242-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 3, + "evidence": [ + "ws2025-domain-controller:AuditKerberosAuthenticationService" + ], + "usedBy": [ + "ws2022-domain-controller:AuditKerberosAuthenticationService" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditAccountLockout", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9217-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 2, + "evidence": [ + "ws2025-workgroup-member:AuditAccountLockout", + "ws2025-member-server:AuditAccountLockout", + "ws2025-domain-controller:AuditAccountLockout" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditAccountLockout", + "ws2022-domain-member:AuditAccountLockout", + "ws2022-domain-controller:AuditAccountLockout" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditGroupMembership", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9249-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 1, + "evidence": [ + "ws2025-workgroup-member:AuditGroupMembership", + "ws2025-member-server:AuditGroupMembership", + "ws2025-domain-controller:AuditGroupMembership" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditGroupMembership", + "ws2022-domain-member:AuditGroupMembership", + "ws2022-domain-controller:AuditGroupMembership" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditLogoff", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9216-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 1, + "evidence": [ + "ws2025-workgroup-member:AuditLogoff", + "ws2025-member-server:AuditLogoff", + "ws2025-domain-controller:AuditLogoff" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditLogoff", + "ws2022-domain-member:AuditLogoff", + "ws2022-domain-controller:AuditLogoff" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditLogon", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9215-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 3, + "evidence": [ + "ws2025-workgroup-member:AuditLogon", + "ws2025-member-server:AuditLogon", + "ws2025-domain-controller:AuditLogon" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditLogon", + "ws2022-domain-member:AuditLogon", + "ws2022-domain-controller:AuditLogon" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE921C-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 3, + "evidence": [ + "ws2025-workgroup-member:AuditOtherLogonLogoffEvents", + "ws2025-member-server:AuditOtherLogonLogoffEvents", + "ws2025-domain-controller:AuditOtherLogonLogoffEvents" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditOtherLogonLogoffEvents", + "ws2022-domain-member:AuditOtherLogonLogoffEvents", + "ws2022-domain-controller:AuditOtherLogonLogoffEvents" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountLogonLogoff_AuditSpecialLogon", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE921B-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 1, + "evidence": [ + "ws2025-workgroup-member:AuditSpecialLogon", + "ws2025-member-server:AuditSpecialLogon", + "ws2025-domain-controller:AuditSpecialLogon" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditSpecialLogon", + "ws2022-domain-member:AuditSpecialLogon", + "ws2022-domain-controller:AuditSpecialLogon" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditComputerAccountManagement", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9236-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 1, + "evidence": [ + "ws2025-domain-controller:AuditComputerAccountManagement" + ], + "usedBy": [ + "ws2022-domain-controller:AuditComputerAccountManagement" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditDistributionGroupManagement", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9238-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 1, + "evidence": [ + "ws2025-domain-controller:AuditDistributionGroupManagement" + ], + "usedBy": [ + "ws2022-domain-controller:AuditDistributionGroupManagement" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditOtherAccountManagementEvents", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE923A-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 1, + "evidence": [ + "ws2025-domain-controller:AuditOtherAccountManagementEvents" + ], + "usedBy": [ + "ws2022-domain-controller:AuditOtherAccountManagementEvents" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditSecurityGroupManagement", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9237-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 1, + "evidence": [ + "ws2025-workgroup-member:AuditSecurityGroupManagement", + "ws2025-member-server:AuditSecurityGroupManagement", + "ws2025-domain-controller:AuditSecurityGroupManagement" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditSecurityGroupManagement", + "ws2022-domain-member:AuditSecurityGroupManagement", + "ws2022-domain-controller:AuditSecurityGroupManagement" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/AccountManagement_AuditUserAccountManagement", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9235-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 3, + "evidence": [ + "ws2025-workgroup-member:AuditUserAccountManagement", + "ws2025-member-server:AuditUserAccountManagement", + "ws2025-domain-controller:AuditUserAccountManagement" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditUserAccountManagement", + "ws2022-domain-member:AuditUserAccountManagement", + "ws2022-domain-controller:AuditUserAccountManagement" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/DetailedTracking_AuditPNPActivity", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9248-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 1, + "evidence": [ + "ws2025-workgroup-member:AuditPnPExternalDevice", + "ws2025-member-server:AuditPnPExternalDevice", + "ws2025-domain-controller:AuditPnPExternalDevice" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditPnPExternalDevice", + "ws2022-domain-member:AuditPnPExternalDevice", + "ws2022-domain-controller:AuditPnPExternalDevice" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/DetailedTracking_AuditProcessCreation", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE922B-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 1, + "evidence": [ + "ws2025-workgroup-member:AuditProcessCreatedOrStarted", + "ws2025-member-server:AuditProcessCreatedOrStarted", + "ws2025-domain-controller:AuditProcessCreatedOrStarted" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditProcessCreatedOrStarted", + "ws2022-domain-member:AuditProcessCreatedOrStarted", + "ws2022-domain-controller:AuditProcessCreatedOrStarted" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/DSAccess_AuditDirectoryServiceAccess", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE923B-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 2, + "evidence": [ + "ws2025-domain-controller:AuditDirectoryServiceAccess" + ], + "usedBy": [ + "ws2022-domain-controller:AuditDirectoryServiceAccess" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/DSAccess_AuditDirectoryServiceChanges", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE923C-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 1, + "evidence": [ + "ws2025-domain-controller:AuditDirectoryServiceChanges" + ], + "usedBy": [ + "ws2022-domain-controller:AuditDirectoryServiceChanges" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/DSAccess_AuditDirectoryServiceReplication", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE923D-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 0, + "evidence": [ + "ws2025-domain-controller:AuditDirectoryServiceReplication" + ], + "usedBy": [ + "ws2022-domain-controller:AuditDirectoryServiceReplication" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditDetailedFileShare", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9244-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 2, + "evidence": [ + "ws2025-workgroup-member:AuditDetailedFileShare", + "ws2025-member-server:AuditDetailedFileShare", + "ws2025-domain-controller:AuditDetailedFileShare" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditDetailedFileShare", + "ws2022-domain-member:AuditDetailedFileShare", + "ws2022-domain-controller:AuditDetailedFileShare" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditFileShare", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9224-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 3, + "evidence": [ + "ws2025-workgroup-member:AuditFileShare", + "ws2025-member-server:AuditFileShare", + "ws2025-domain-controller:AuditFileShare" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditFileShare", + "ws2022-domain-member:AuditFileShare", + "ws2022-domain-controller:AuditFileShare" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditOtherObjectAccessEvents", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9227-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 3, + "evidence": [ + "ws2025-workgroup-member:AuditOtherObjectAccessEvents", + "ws2025-member-server:AuditOtherObjectAccessEvents", + "ws2025-domain-controller:AuditOtherObjectAccessEvents" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditOtherObjectAccessEvents", + "ws2022-domain-member:AuditOtherObjectAccessEvents", + "ws2022-domain-controller:AuditOtherObjectAccessEvents" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditRemovableStorage", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9245-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 3, + "evidence": [ + "ws2025-workgroup-member:AuditRemovableStorage", + "ws2025-member-server:AuditRemovableStorage", + "ws2025-domain-controller:AuditRemovableStorage" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditRemovableStorage", + "ws2022-domain-member:AuditRemovableStorage", + "ws2022-domain-controller:AuditRemovableStorage" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditAuthenticationPolicyChange", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9230-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 1, + "evidence": [ + "ws2025-workgroup-member:AuditAuthenticationPolicyChange", + "ws2025-member-server:AuditAuthenticationPolicyChange", + "ws2025-domain-controller:AuditAuthenticationPolicyChange" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditAuthenticationPolicyChange", + "ws2022-domain-member:AuditAuthenticationPolicyChange", + "ws2022-domain-controller:AuditAuthenticationPolicyChange" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditAuthorizationPolicyChange", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9231-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 1, + "evidence": [ + "ws2025-workgroup-member:AuditAuthorizationPolicyChange", + "ws2025-member-server:AuditAuthorizationPolicyChange", + "ws2025-domain-controller:AuditAuthorizationPolicyChange" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditAuthorizationPolicyChange", + "ws2022-domain-member:AuditAuthorizationPolicyChange", + "ws2022-domain-controller:AuditAuthorizationPolicyChange" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9232-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 3, + "evidence": [ + "ws2025-workgroup-member:AuditMPSSVCRuleLevelPolicyChange", + "ws2025-member-server:AuditMPSSVCRuleLevelPolicyChange", + "ws2025-domain-controller:AuditMPSSVCRuleLevelPolicyChange" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditMPSSVCRuleLevelPolicyChange", + "ws2022-domain-member:AuditMPSSVCRuleLevelPolicyChange", + "ws2022-domain-controller:AuditMPSSVCRuleLevelPolicyChange" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditOtherPolicyChangeEvents", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9234-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 2, + "evidence": [ + "ws2025-workgroup-member:AuditOtherPolicyChangeEvents", + "ws2025-member-server:AuditOtherPolicyChangeEvents", + "ws2025-domain-controller:AuditOtherPolicyChangeEvents" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditChangeCategoryOther", + "ws2022-domain-member:AuditChangeCategoryOther", + "ws2022-domain-controller:AuditChangeCategoryOther" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PolicyChange_AuditPolicyChange", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE922F-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 1, + "evidence": [ + "ws2025-workgroup-member:AuditPolicyChange", + "ws2025-member-server:AuditPolicyChange", + "ws2025-domain-controller:AuditPolicyChange" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditPolicyChange", + "ws2022-domain-member:AuditPolicyChange", + "ws2022-domain-controller:AuditPolicyChange" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/PrivilegeUse_AuditSensitivePrivilegeUse", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9228-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 3, + "evidence": [ + "ws2025-workgroup-member:AuditSensitivePrivilegeUse", + "ws2025-member-server:AuditSensitivePrivilegeUse", + "ws2025-domain-controller:AuditSensitivePrivilegeUse" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditSensitivePrivilegeUse", + "ws2022-domain-member:AuditSensitivePrivilegeUse", + "ws2022-domain-controller:AuditSensitivePrivilegeUse" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditIPsecDriver", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9213-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 3, + "evidence": [ + "ws2025-workgroup-member:AuditIPsecDriver", + "ws2025-member-server:AuditIPsecDriver", + "ws2025-domain-controller:AuditIPsecDriver" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditIPsecDriver", + "ws2022-domain-member:AuditIPsecDriver", + "ws2022-domain-controller:AuditIPsecDriver" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditOtherSystemEvents", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9214-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 3, + "evidence": [ + "ws2025-workgroup-member:AuditOtherSystemEvents", + "ws2025-member-server:AuditOtherSystemEvents", + "ws2025-domain-controller:AuditOtherSystemEvents" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditOtherSystemEvents", + "ws2022-domain-member:AuditOtherSystemEvents", + "ws2022-domain-controller:AuditOtherSystemEvents" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditSecurityStateChange", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9210-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 1, + "evidence": [ + "ws2025-workgroup-member:AuditSecurityStateChange", + "ws2025-member-server:AuditSecurityStateChange", + "ws2025-domain-controller:AuditSecurityStateChange" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditSecurityStateChange", + "ws2022-domain-member:AuditSecurityStateChange", + "ws2022-domain-controller:AuditSecurityStateChange" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditSecuritySystemExtension", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9211-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 1, + "evidence": [ + "ws2025-workgroup-member:AuditSecuritySystemExtension", + "ws2025-member-server:AuditSecuritySystemExtension", + "ws2025-domain-controller:AuditSecuritySystemExtension" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditSecuritySystemExtension", + "ws2022-domain-member:AuditSecuritySystemExtension", + "ws2022-domain-controller:AuditSecuritySystemExtension" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/Audit/System_AuditSystemIntegrity", + "target": { + "type": "Microsoft.Windows/AuditPolicy", + "properties": { + "subcategory": "{0CCE9212-69AE-11D9-BED3-505054503030}" + } + }, + "ws2025Value": 3, + "evidence": [ + "ws2025-workgroup-member:AuditSystemIntegrity", + "ws2025-member-server:AuditSystemIntegrity", + "ws2025-domain-controller:AuditSystemIntegrity" + ], + "usedBy": [ + "ws2022-workgroup-member:AuditSystemIntegrity", + "ws2022-domain-member:AuditSystemIntegrity", + "ws2022-domain-controller:AuditSystemIntegrity" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/AccountLockoutPolicy", + "target": { + "type": "Microsoft.Windows/AccountPolicy", + "properties": { + "name": "LockoutDuration" + } + }, + "ws2025Value": 15, + "evidence": [ + "ws2025-workgroup-member:DeviceLockAccountLockoutPolicy", + "ws2025-member-server:DeviceLockAccountLockoutPolicy", + "ws2025-domain-controller:DeviceLockAccountLockoutPolicy" + ], + "usedBy": [ + "ws2022-workgroup-member:AccountLockoutPolicy", + "ws2022-domain-member:AccountLockoutPolicy", + "ws2022-domain-controller:AccountLockoutPolicy" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/ClearTextPassword", + "target": { + "type": "Microsoft.Windows/AccountPolicy", + "properties": { + "name": "EnablePasswordReversibleEncryption" + } + }, + "ws2025Value": false, + "evidence": [ + "ws2025-workgroup-member:DeviceLockClearTextPassword", + "ws2025-member-server:DeviceLockClearTextPassword", + "ws2025-domain-controller:DeviceLockClearTextPassword" + ], + "usedBy": [ + "ws2022-workgroup-member:DeviceLockClearTextPassword", + "ws2022-domain-member:DeviceLockClearTextPassword", + "ws2022-domain-controller:DeviceLockClearTextPassword" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/MaximumPasswordAge", + "target": { + "type": "Microsoft.Windows/AccountPolicy", + "properties": { + "name": "MaximumPasswordAge" + } + }, + "ws2025Value": 42, + "evidence": [ + "ws2025-workgroup-member:DeviceLockMaximumPasswordAge", + "ws2025-member-server:DeviceLockMaximumPasswordAge", + "ws2025-domain-controller:DeviceLockMaximumPasswordAge" + ], + "usedBy": [ + "ws2022-workgroup-member:DeviceLockMaximumPasswordAge", + "ws2022-domain-member:DeviceLockMaximumPasswordAge", + "ws2022-domain-controller:DeviceLockMaximumPasswordAge" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/MinimumPasswordAge", + "target": { + "type": "Microsoft.Windows/AccountPolicy", + "properties": { + "name": "MinimumPasswordAge" + } + }, + "ws2025Value": 1, + "evidence": [ + "ws2025-workgroup-member:DeviceLockMinimumPasswordAge", + "ws2025-member-server:DeviceLockMinimumPasswordAge", + "ws2025-domain-controller:DeviceLockMinimumPasswordAge" + ], + "usedBy": [ + "ws2022-workgroup-member:DeviceLockMinimumPasswordAge", + "ws2022-domain-member:DeviceLockMinimumPasswordAge", + "ws2022-domain-controller:DeviceLockMinimumPasswordAge" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/MinimumPasswordLength", + "target": { + "type": "Microsoft.Windows/AccountPolicy", + "properties": { + "name": "MinimumPasswordLength" + } + }, + "ws2025Value": 14, + "evidence": [ + "ws2025-workgroup-member:DeviceLockMinimumPasswordLength", + "ws2025-member-server:DeviceLockMinimumPasswordLength" + ], + "usedBy": [ + "ws2022-workgroup-member:DeviceLockMinDevicePasswordLength", + "ws2022-domain-member:DeviceLockMinDevicePasswordLength", + "ws2022-domain-controller:DeviceLockMinDevicePasswordLength" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/PasswordComplexity", + "target": { + "type": "Microsoft.Windows/AccountPolicy", + "properties": { + "name": "EnforcePasswordComplexity" + } + }, + "ws2025Value": true, + "evidence": [ + "ws2025-workgroup-member:DeviceLockPasswordComplexity", + "ws2025-member-server:DeviceLockPasswordComplexity", + "ws2025-domain-controller:DeviceLockPasswordComplexity" + ], + "usedBy": [ + "ws2022-workgroup-member:DeviceLockPasswordComplexity", + "ws2022-domain-member:DeviceLockPasswordComplexity", + "ws2022-domain-controller:DeviceLockPasswordComplexity" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/DeviceLock/PasswordHistorySize", + "target": { + "type": "Microsoft.Windows/AccountPolicy", + "properties": { + "name": "PasswordHistoryLength" + } + }, + "ws2025Value": 24, + "evidence": [ + "ws2025-workgroup-member:DeviceLockPasswordHistorySize", + "ws2025-member-server:DeviceLockPasswordHistorySize", + "ws2025-domain-controller:DeviceLockPasswordHistorySize" + ], + "usedBy": [ + "ws2022-workgroup-member:DeviceLockPasswordHistorySize", + "ws2022-domain-member:DeviceLockPasswordHistorySize", + "ws2022-domain-controller:DeviceLockPasswordHistorySize" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus", + "target": { + "type": "Microsoft.Windows/AccountPolicy", + "properties": { + "name": "EnableGuestAccount" + } + }, + "ws2025Value": false, + "evidence": [ + "ws2025-workgroup-member:EnableGuestAccountStatus", + "ws2025-member-server:EnableGuestAccountStatus", + "ws2025-domain-controller:EnableGuestAccountStatus" + ], + "usedBy": [ + "ws2022-workgroup-member:EnableGuestAccountStatus", + "ws2022-domain-member:EnableGuestAccountStatus", + "ws2022-domain-controller:EnableGuestAccountStatus" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount", + "target": { + "type": "Microsoft.Windows/AccountPolicy", + "properties": { + "name": "AdministratorAccountName" + } + }, + "evidence": [ + "ws2025-workgroup-member:RenameAdministratorAccount", + "ws2025-member-server:RenameAdministratorAccount", + "ws2025-domain-controller:RenameAdministratorAccount" + ], + "usedBy": [ + "ws2022-domain-member:RenameAdministratorAccount", + "ws2022-domain-controller:RenameAdministratorAccount" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount", + "target": { + "type": "Microsoft.Windows/AccountPolicy", + "properties": { + "name": "GuestAccountName" + } + }, + "evidence": [ + "ws2025-workgroup-member:RenameGuestAccount", + "ws2025-member-server:RenameGuestAccount", + "ws2025-domain-controller:RenameGuestAccount" + ], + "usedBy": [ + "ws2022-workgroup-member:RenameGuestAccount", + "ws2022-domain-member:RenameGuestAccount", + "ws2022-domain-controller:RenameGuestAccount" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/NetworkAccess_AllowAnonymousSIDOrNameTranslation", + "target": { + "type": "Microsoft.Windows/AccountPolicy", + "properties": { + "name": "EnableAnonymousNameTranslation" + } + }, + "ws2025Value": false, + "evidence": [ + "ws2025-workgroup-member:AllowAnonymousSIDOrNameTranslation", + "ws2025-member-server:AllowAnonymousSIDOrNameTranslation", + "ws2025-domain-controller:AllowAnonymousSIDOrNameTranslation" + ], + "usedBy": [ + "ws2022-domain-member:AllowAnonymousSIDOrNameTranslation", + "ws2022-domain-controller:AllowAnonymousSIDOrNameTranslation" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AccessCredentialManagerAsTrustedCaller", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeTrustedCredManAccessPrivilege" + } + }, + "ws2025Value": [], + "evidence": [ + "ws2025-workgroup-member:UserRightsAccessCredentialManagerAsTrustedCaller", + "ws2025-member-server:UserRightsAccessCredentialManagerAsTrustedCaller", + "ws2025-domain-controller:UserRightsAccessCredentialManagerAsTrustedCaller" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsAccessCredentialManagerAsTrustedCaller", + "ws2022-domain-member:UserRightsAccessCredentialManagerAsTrustedCaller", + "ws2022-domain-controller:UserRightsAccessCredentialManagerAsTrustedCaller" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AccessFromNetwork", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeNetworkLogonRight" + } + }, + "ws2025Value": [ + "*S-1-5-32-544", + "*S-1-5-11" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsAccessFromNetwork", + "ws2025-member-server:UserRightsAccessFromNetwork", + "ws2025-domain-controller:UserRightsAccessFromNetwork" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsAccessFromNetwork", + "ws2022-domain-member:UserRightsAccessFromNetwork" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ActAsPartOfTheOperatingSystem", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeTcbPrivilege" + } + }, + "ws2025Value": [], + "evidence": [ + "ws2025-workgroup-member:UserRightsActAsPartOfTheOperatingSystem", + "ws2025-member-server:UserRightsActAsPartOfTheOperatingSystem", + "ws2025-domain-controller:UserRightsActAsPartOfTheOperatingSystem" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsActAsPartOfTheOperatingSystem", + "ws2022-domain-member:UserRightsActAsPartOfTheOperatingSystem", + "ws2022-domain-controller:UserRightsActAsPartOfTheOperatingSystem" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AdjustMemoryQuotasForProcess", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeIncreaseQuotaPrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544", + "*S-1-5-19", + "*S-1-5-20" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsAdjustMemoryQuotasForProcess", + "ws2025-member-server:UserRightsAdjustMemoryQuotasForProcess", + "ws2025-domain-controller:UserRightsAdjustMemoryQuotasForProcess" + ], + "usedBy": [ + "ws2022-domain-member:UserRightsAdjustMemoryQuotasForProcess", + "ws2022-domain-controller:UserRightsAdjustMemoryQuotasForProcess" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AllowLocalLogOn", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeInteractiveLogonRight" + } + }, + "ws2025Value": [ + "*S-1-5-32-544" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsAllowLocalLogOn", + "ws2025-member-server:UserRightsAllowLocalLogOn", + "ws2025-domain-controller:UserRightsAllowLocalLogOn" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsAllowLocalLogOn", + "ws2022-domain-member:UserRightsAllowLocalLogOn" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/AllowLogOnThroughRemoteDesktop", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeRemoteInteractiveLogonRight" + } + }, + "ws2025Value": [ + "*S-1-5-32-544", + "*S-1-5-32-555" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsAllowLogOnThroughRemoteDesktop", + "ws2025-member-server:UserRightsAllowLogOnThroughRemoteDesktop", + "ws2025-domain-controller:UserRightsAllowLogOnThroughRemoteDesktop" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsAllowLogOnThroughRemoteDesktop", + "ws2022-domain-member:UserRightsAllowLogOnThroughRemoteDesktop", + "ws2022-domain-controller:UserRightsAllowLogOnThroughRemoteDesktop" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/BackupFilesAndDirectories", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeBackupPrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsBackupFilesAndDirectories", + "ws2025-member-server:UserRightsBackupFilesAndDirectories", + "ws2025-domain-controller:UserRightsBackupFilesAndDirectories" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsBackupFilesAndDirectories", + "ws2022-domain-member:UserRightsBackupFilesAndDirectories" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/BypassTraverseChecking", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeChangeNotifyPrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544", + "*S-1-5-11", + "*S-1-5-32-551", + "*S-1-5-19", + "*S-1-5-20" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsBypassTraverseChecking", + "ws2025-member-server:UserRightsBypassTraverseChecking" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsBypassTraverseChecking", + "ws2022-domain-member:UserRightsBypassTraverseChecking" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ChangeSystemTime", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeSystemtimePrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544", + "*S-1-5-32-549", + "*S-1-5-19" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsChangeSystemTime", + "ws2025-member-server:UserRightsChangeSystemTime", + "ws2025-domain-controller:UserRightsChangeSystemTime" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsChangeSystemTime", + "ws2022-domain-member:UserRightsChangeSystemTime" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ChangeTimeZone", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeTimeZonePrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544", + "*S-1-5-19" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsChangeTimeZone", + "ws2025-member-server:UserRightsChangeTimeZone", + "ws2025-domain-controller:UserRightsChangeTimeZone" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsChangeTimeZone", + "ws2022-domain-member:UserRightsChangeTimeZone", + "ws2022-domain-controller:UserRightsChangeTimeZone" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreateGlobalObjects", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeCreateGlobalPrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544", + "*S-1-5-6", + "*S-1-5-19", + "*S-1-5-20" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsCreateGlobalObjects", + "ws2025-member-server:UserRightsCreateGlobalObjects", + "ws2025-domain-controller:UserRightsCreateGlobalObjects" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsCreateGlobalObjects", + "ws2022-domain-member:UserRightsCreateGlobalObjects", + "ws2022-domain-controller:UserRightsCreateGlobalObjects" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreatePageFile", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeCreatePagefilePrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsCreatePageFile", + "ws2025-member-server:UserRightsCreatePageFile", + "ws2025-domain-controller:UserRightsCreatePageFile" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsCreatePageFile", + "ws2022-domain-member:UserRightsCreatePageFile", + "ws2022-domain-controller:UserRightsCreatePageFile" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreatePermanentSharedObjects", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeCreatePermanentPrivilege" + } + }, + "ws2025Value": [], + "evidence": [ + "ws2025-workgroup-member:UserRightsCreatePermanentSharedObjects", + "ws2025-member-server:UserRightsCreatePermanentSharedObjects", + "ws2025-domain-controller:UserRightsCreatePermanentSharedObjects" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsCreatePermanentSharedObjects", + "ws2022-domain-member:UserRightsCreatePermanentSharedObjects", + "ws2022-domain-controller:UserRightsCreatePermanentSharedObjects" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreateSymbolicLinks", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeCreateSymbolicLinkPrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544", + "*S-1-5-83-0" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsCreateSymbolicLinks", + "ws2025-member-server:UserRightsCreateSymbolicLinks", + "ws2025-domain-controller:UserRightsCreateSymbolicLinks" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsCreateSymbolicLinks", + "ws2022-domain-member:UserRightsCreateSymbolicLinks", + "ws2022-domain-controller:UserRightsCreateSymbolicLinks" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/CreateToken", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeCreateTokenPrivilege" + } + }, + "ws2025Value": [], + "evidence": [ + "ws2025-workgroup-member:UserRightsCreateToken", + "ws2025-member-server:UserRightsCreateToken", + "ws2025-domain-controller:UserRightsCreateToken" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsCreateToken", + "ws2022-domain-member:UserRightsCreateToken", + "ws2022-domain-controller:UserRightsCreateToken" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyAccessFromNetwork", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeDenyNetworkLogonRight" + } + }, + "ws2025Value": [ + "*S-1-5-32-546" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyAccessFromNetwork", + "ws2025-member-server:UserRightsDenyAccessFromNetwork", + "ws2025-domain-controller:UserRightsDenyAccessFromNetwork" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsDenyAccessFromNetwork", + "ws2022-domain-member:UserRightsDenyAccessFromNetwork", + "ws2022-domain-controller:UserRightsDenyAccessFromNetwork" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyLocalLogOn", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeDenyInteractiveLogonRight" + } + }, + "ws2025Value": [ + "*S-1-5-32-546" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyLocalLogOn", + "ws2025-member-server:UserRightsDenyLocalLogOn", + "ws2025-domain-controller:UserRightsDenyLocalLogOn" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsDenyLocalLogOn", + "ws2022-domain-member:UserRightsDenyLocalLogOn", + "ws2022-domain-controller:UserRightsDenyLocalLogOn" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyLogOnAsBatchJob", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeDenyBatchLogonRight" + } + }, + "ws2025Value": [ + "*S-1-5-32-546" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyLogOnAsBatchJob", + "ws2025-member-server:UserRightsDenyLogOnAsBatchJob", + "ws2025-domain-controller:UserRightsDenyLogOnAsBatchJob" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsDenyLogOnAsBatchJob", + "ws2022-domain-member:UserRightsDenyLogOnAsBatchJob", + "ws2022-domain-controller:UserRightsDenyLogOnAsBatchJob" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyLogOnAsService", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeDenyServiceLogonRight" + } + }, + "ws2025Value": [ + "*S-1-5-32-546" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyLogOnAsService", + "ws2025-member-server:UserRightsDenyLogOnAsService", + "ws2025-domain-controller:UserRightsDenyLogOnAsService" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsDenyLogOnAsService", + "ws2022-domain-member:UserRightsDenyLogOnAsService", + "ws2022-domain-controller:UserRightsDenyLogOnAsService" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/DenyRemoteDesktopServicesLogOn", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeDenyRemoteInteractiveLogonRight" + } + }, + "ws2025Value": [ + "*S-1-5-32-546" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsDenyRemoteDesktopServicesLogOn", + "ws2025-member-server:UserRightsDenyRemoteDesktopServicesLogOn", + "ws2025-domain-controller:UserRightsDenyRemoteDesktopServicesLogOn" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsDenyRemoteDesktopServicesLogOn" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/EnableDelegation", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeEnableDelegationPrivilege" + } + }, + "ws2025Value": [], + "evidence": [ + "ws2025-workgroup-member:UserRightsEnableDelegation", + "ws2025-member-server:UserRightsEnableDelegation", + "ws2025-domain-controller:UserRightsEnableDelegation" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsEnableDelegation", + "ws2022-domain-member:UserRightsEnableDelegation" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/GenerateSecurityAudits", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeAuditPrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-19", + "*S-1-5-20", + "*S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsGenerateSecurityAudits", + "ws2025-member-server:UserRightsGenerateSecurityAudits", + "ws2025-domain-controller:UserRightsGenerateSecurityAudits" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsGenerateSecurityAudits", + "ws2022-domain-member:UserRightsGenerateSecurityAudits", + "ws2022-domain-controller:UserRightsGenerateSecurityAudits" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/IncreaseProcessWorkingSet", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeIncreaseWorkingSetPrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544", + "*S-1-5-19" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsIncreaseProcessWorkingSet", + "ws2025-member-server:UserRightsIncreaseProcessWorkingSet" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsIncreaseProcessWorkingSet", + "ws2022-domain-member:UserRightsIncreaseProcessWorkingSet" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/IncreaseSchedulingPriority", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeIncreaseBasePriorityPrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsIncreaseSchedulingPriority", + "ws2025-member-server:UserRightsIncreaseSchedulingPriority", + "ws2025-domain-controller:UserRightsIncreaseSchedulingPriority" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsIncreaseSchedulingPriority", + "ws2022-domain-member:UserRightsIncreaseSchedulingPriority", + "ws2022-domain-controller:UserRightsIncreaseSchedulingPriority" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/LoadUnloadDeviceDrivers", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeLoadDriverPrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsLoadUnloadDeviceDrivers", + "ws2025-member-server:UserRightsLoadUnloadDeviceDrivers", + "ws2025-domain-controller:UserRightsLoadUnloadDeviceDrivers" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsLoadUnloadDeviceDrivers", + "ws2022-domain-member:UserRightsLoadUnloadDeviceDrivers", + "ws2022-domain-controller:UserRightsLoadUnloadDeviceDrivers" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/LockMemory", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeLockMemoryPrivilege" + } + }, + "ws2025Value": [], + "evidence": [ + "ws2025-workgroup-member:UserRightsLockMemory", + "ws2025-member-server:UserRightsLockMemory", + "ws2025-domain-controller:UserRightsLockMemory" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsLockMemory", + "ws2022-domain-member:UserRightsLockMemory", + "ws2022-domain-controller:UserRightsLockMemory" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ManageAuditingAndSecurityLog", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeSecurityPrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsManageAuditingAndSecurityLog", + "ws2025-member-server:UserRightsManageAuditingAndSecurityLog", + "ws2025-domain-controller:UserRightsManageAuditingAndSecurityLog" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsManageAuditingAndSecurityLog", + "ws2022-domain-member:UserRightsManageAuditingAndSecurityLog", + "ws2022-domain-controller:UserRightsManageAuditingAndSecurityLog" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ManageVolume", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeManageVolumePrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsManageVolume", + "ws2025-member-server:UserRightsManageVolume", + "ws2025-domain-controller:UserRightsManageVolume" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsManageVolume", + "ws2022-domain-member:UserRightsManageVolume", + "ws2022-domain-controller:UserRightsManageVolume" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ModifyFirmwareEnvironment", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeSystemEnvironmentPrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsModifyFirmwareEnvironment", + "ws2025-member-server:UserRightsModifyFirmwareEnvironment", + "ws2025-domain-controller:UserRightsModifyFirmwareEnvironment" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsModifyFirmwareEnvironment", + "ws2022-domain-member:UserRightsModifyFirmwareEnvironment", + "ws2022-domain-controller:UserRightsModifyFirmwareEnvironment" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ModifyObjectLabel", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeRelabelPrivilege" + } + }, + "ws2025Value": [], + "evidence": [ + "ws2025-workgroup-member:UserRightsModifyObjectLabel", + "ws2025-member-server:UserRightsModifyObjectLabel", + "ws2025-domain-controller:UserRightsModifyObjectLabel" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsModifyObjectLabel", + "ws2022-domain-member:UserRightsModifyObjectLabel", + "ws2022-domain-controller:UserRightsModifyObjectLabel" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ProfileSingleProcess", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeProfileSingleProcessPrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsProfileSingleProcess", + "ws2025-member-server:UserRightsProfileSingleProcess", + "ws2025-domain-controller:UserRightsProfileSingleProcess" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsProfileSingleProcess", + "ws2022-domain-member:UserRightsProfileSingleProcess", + "ws2022-domain-controller:UserRightsProfileSingleProcess" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ProfileSystemPerformance", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeSystemProfilePrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544", + "*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsProfileSystemPerformance", + "ws2025-member-server:UserRightsProfileSystemPerformance", + "ws2025-domain-controller:UserRightsProfileSystemPerformance" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsProfileSystemPerformance", + "ws2022-domain-member:UserRightsProfileSystemPerformance", + "ws2022-domain-controller:UserRightsProfileSystemPerformance" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/RemoteShutdown", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeRemoteShutdownPrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsRemoteShutdown", + "ws2025-member-server:UserRightsRemoteShutdown", + "ws2025-domain-controller:UserRightsRemoteShutdown" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsRemoteShutdown", + "ws2022-domain-member:UserRightsRemoteShutdown", + "ws2022-domain-controller:UserRightsRemoteShutdown" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ReplaceProcessLevelToken", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeAssignPrimaryTokenPrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-19", + "*S-1-5-20" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsReplaceProcessLevelToken", + "ws2025-member-server:UserRightsReplaceProcessLevelToken", + "ws2025-domain-controller:UserRightsReplaceProcessLevelToken" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsReplaceProcessLevelToken", + "ws2022-domain-member:UserRightsReplaceProcessLevelToken", + "ws2022-domain-controller:UserRightsReplaceProcessLevelToken" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/RestoreFilesAndDirectories", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeRestorePrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsRestoreFilesAndDirectories", + "ws2025-member-server:UserRightsRestoreFilesAndDirectories", + "ws2025-domain-controller:UserRightsRestoreFilesAndDirectories" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsRestoreFilesAndDirectories", + "ws2022-domain-member:UserRightsRestoreFilesAndDirectories" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/ShutDownTheSystem", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeShutdownPrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsShutDownTheSystem", + "ws2025-member-server:UserRightsShutDownTheSystem", + "ws2025-domain-controller:UserRightsShutDownTheSystem" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsShutDownTheSystem", + "ws2022-domain-member:UserRightsShutDownTheSystem", + "ws2022-domain-controller:UserRightsShutDownTheSystem" + ] + }, + { + "cspPath": "./Vendor/MSFT/Policy/Result/UserRights/TakeOwnership", + "target": { + "type": "Microsoft.Windows/UserRightsAssignment", + "properties": { + "name": "SeTakeOwnershipPrivilege" + } + }, + "ws2025Value": [ + "*S-1-5-32-544" + ], + "evidence": [ + "ws2025-workgroup-member:UserRightsTakeOwnership", + "ws2025-member-server:UserRightsTakeOwnership", + "ws2025-domain-controller:UserRightsTakeOwnership" + ], + "usedBy": [ + "ws2022-workgroup-member:UserRightsTakeOwnership", + "ws2022-domain-member:UserRightsTakeOwnership", + "ws2022-domain-controller:UserRightsTakeOwnership" + ] + } + ] +} diff --git a/scripts/ws2022-baseline-repair/derive-maps.mjs b/scripts/ws2022-baseline-repair/derive-maps.mjs new file mode 100644 index 0000000..5869d6a --- /dev/null +++ b/scripts/ws2022-baseline-repair/derive-maps.mjs @@ -0,0 +1,278 @@ +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. +// +// Derives the two reviewable data tables used by `repair-ws2022-baselines.mjs` +// from the *already reviewed and merged* WS2025 baseline repair: +// +// csp-provider-map.json CSP OMA-URI -> dedicated provider + addressing +// schema-expression-map.json JSON Schema -> CEL expression + human template +// +// Both tables are pure evidence extraction. Nothing is invented here: every +// entry is the (before, after) pair of one WS2025 rule that a human already +// reviewed and merged to `main`. The tables are committed so the repair is +// auditable without git archaeology; this script exists so they can be +// regenerated and diffed. +// +// PROVENANCE RULES +// ---------------- +// * Every artifact is loaded with `git show :`. +// The working tree is never read. `HEAD`, branch names and abbreviated +// SHAs are all mutable, so none of them are used. +// * Every pinned commit must be an ancestor of `origin/main`, which this +// script verifies before it derives anything. +// +// Usage: node scripts/ws2022-baseline-repair/derive-maps.mjs [--check] + +import { execFileSync } from 'node:child_process'; +import { readFileSync, writeFileSync } from 'node:fs'; +import path from 'node:path'; +import { fileURLToPath } from 'node:url'; +import yaml from 'js-yaml'; + +const HERE = path.dirname(fileURLToPath(import.meta.url)); +const REPO = path.resolve(HERE, '..', '..'); + +/** + * Pinned evidence commits, all reachable from `origin/main`. + * + * providerBeforeCommit ab71aaf generated WS2025, `Policy/Result` CSP form + * providerAfterCommit 50d469c "fix(baselines): repair WS2025 standalone + * audits" — CSP moved onto dedicated providers + * schemaBeforeCommit 50d469c same commit: dedicated providers, legacy + * `schema:` compliance blocks + * schemaAfterCommit 37ab26a "fix(compliance): preserve CLI Test reasons" + * — `schema:` replaced by `expression:` + + * `template:` + * ws2022SourceCommit 173177e last commit carrying the generated WS2022 + * profiles (the repair input) + * + * Note the deliberate overlap: `50d469c` is the *after* state for the provider + * mapping and the *before* state for the schema translation, which is exactly + * how the two reviewed changes were layered on main. + */ +export const EVIDENCE = { + providerBeforeCommit: 'ab71aaf778a87322899a671e6d06bce0fa40aa2a', + providerAfterCommit: '50d469c3cf5e16729f1359538b10ef4bc0b6de78', + schemaBeforeCommit: '50d469c3cf5e16729f1359538b10ef4bc0b6de78', + schemaAfterCommit: '37ab26a74bd7a6aa7f6df9a6ecc0fba3a7521821', + ws2022SourceCommit: '173177e9eaa34d0b910b44d0749192859831fd50', +}; + +export const WS2025 = [ + ['ws2025-workgroup-member.osc.yaml', 'workgroup-member'], + ['ws2025-member-server.osc.yaml', 'member-server'], + ['ws2025-domain-controller.osc.yaml', 'domain-controller'], +]; + +export const WS2022 = [ + 'ws2022-workgroup-member.osc.yaml', + 'ws2022-domain-member.osc.yaml', + 'ws2022-domain-controller.osc.yaml', +]; + +const CSP_TYPE = 'Microsoft.Windows/CSP'; + +/** Fail loudly if any pinned SHA is not a full SHA reachable from origin/main. */ +export function assertPinnedAndReachable(evidence = EVIDENCE, cwd = REPO) { + for (const [label, sha] of Object.entries(evidence)) { + if (!/^[0-9a-f]{40}$/.test(sha)) { + throw new Error(`${label}: ${sha} is not a full 40-character SHA`); + } + const resolved = execFileSync('git', ['rev-parse', `${sha}^{commit}`], { + cwd, encoding: 'utf8', + }).trim(); + if (resolved !== sha) { + throw new Error(`${label}: ${sha} does not resolve to itself — refusing to derive`); + } + try { + execFileSync('git', ['merge-base', '--is-ancestor', sha, 'origin/main'], { cwd }); + } catch { + throw new Error(`${label}: ${sha} is not reachable from origin/main`); + } + } +} + +/** Load a baseline exclusively from a pinned commit — never the working tree. */ +export function showAt(commit, file, cwd = REPO) { + if (!/^[0-9a-f]{40}$/.test(commit)) { + throw new Error(`refusing to read a baseline from a non-pinned ref: ${commit}`); + } + const text = execFileSync('git', ['show', `${commit}:public/_baselines/${file}`], { + cwd, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, + }); + return yaml.load(text); +} + +const byName = (doc) => new Map((doc.resources ?? []).map((r) => [r.name, r])); + +/** Every OMA-URI addressed by any bundled WS2022 profile at the pinned source. */ +function ws2022CspPaths() { + const wanted = new Map(); + for (const file of WS2022) { + for (const rule of showAt(EVIDENCE.ws2022SourceCommit, file).resources ?? []) { + const inner = rule.properties?.resource; + if (inner?.type !== CSP_TYPE) continue; + const cspPath = String(inner.properties?.path ?? ''); + if (!wanted.has(cspPath)) wanted.set(cspPath, []); + wanted.get(cspPath).push(`${file.replace('.osc.yaml', '')}:${rule.name}`); + } + } + return wanted; +} + +export function deriveCspProviderMap() { + const wanted = ws2022CspPaths(); + const found = new Map(); + + for (const [file, tag] of WS2025) { + const before = byName(showAt(EVIDENCE.providerBeforeCommit, file)); + const after = byName(showAt(EVIDENCE.providerAfterCommit, file)); + for (const [name, rule] of before) { + const from = rule.properties?.resource; + if (from?.type !== CSP_TYPE) continue; + const cspPath = String(from.properties?.path ?? ''); + if (!wanted.has(cspPath)) continue; + + const to = after.get(name)?.properties?.resource; + if (!to || to.type === CSP_TYPE) continue; + + const address = { ...to.properties }; + delete address.value; + const record = { + cspPath, + target: { type: to.type, properties: address }, + ws2025Value: Object.prototype.hasOwnProperty.call(to.properties ?? {}, 'value') + ? to.properties.value + : undefined, + evidence: [`ws2025-${tag}:${name}`], + }; + + const existing = found.get(cspPath); + if (!existing) { + found.set(cspPath, record); + continue; + } + const a = JSON.stringify(existing.target); + const b = JSON.stringify(record.target); + if (a !== b) { + throw new Error(`conflicting WS2025 provider mapping for ${cspPath}:\n ${a}\n ${b}`); + } + existing.evidence.push(`ws2025-${tag}:${name}`); + } + } + + const missing = [...wanted.keys()].filter((p) => !found.has(p)); + if (missing.length) { + throw new Error(`no reviewed WS2025 mapping for:\n ${missing.join('\n ')}`); + } + + const entries = [...found.values()].sort((a, b) => a.cspPath.localeCompare(b.cspPath)); + for (const entry of entries) entry.usedBy = wanted.get(entry.cspPath); + return { + _provenance: { + description: + 'Policy CSP OMA-URI -> dedicated provider + addressing, extracted from the reviewed ' + + 'WS2025 CSP repair. Values are NOT carried over; only the mechanism is.', + providerBeforeCommit: EVIDENCE.providerBeforeCommit, + providerAfterCommit: EVIDENCE.providerAfterCommit, + ws2022SourceCommit: EVIDENCE.ws2022SourceCommit, + paths: WS2025.map(([file]) => `public/_baselines/${file}`), + reachableFromOriginMain: true, + regenerate: 'node scripts/ws2022-baseline-repair/derive-maps.mjs', + }, + entries, + }; +} + +export function deriveSchemaExpressionMap() { + const table = new Map(); + for (const [file] of WS2025) { + const before = byName(showAt(EVIDENCE.schemaBeforeCommit, file)); + const after = byName(showAt(EVIDENCE.schemaAfterCommit, file)); + for (const [name, rule] of before) { + const next = after.get(name); + if (!next) continue; + const schema = rule.properties?.schema; + if (schema === undefined) continue; + const value = next.properties?.resource?.properties?.value; + const key = `${JSON.stringify(schema)}\u0000${valueKind(value)}`; + const out = { + schema, + valueKind: valueKind(value), + expression: next.properties?.expression, + template: next.properties?.template, + }; + const existing = table.get(key); + if (!existing) { + table.set(key, { ...out, evidence: [name] }); + continue; + } + if (existing.expression !== out.expression || existing.template !== out.template) { + throw new Error( + `ambiguous schema translation for ${key}: ` + + `${existing.expression} vs ${out.expression} (${name})`, + ); + } + if (existing.evidence.length < 3 && !existing.evidence.includes(name)) { + existing.evidence.push(name); + } + } + } + const entries = [...table.values()].sort( + (a, b) => JSON.stringify(a.schema).localeCompare(JSON.stringify(b.schema)) + || a.valueKind.localeCompare(b.valueKind), + ); + return { + _provenance: { + description: + 'Legacy JSON-Schema compliance shape -> CEL expression + human template, extracted ' + + 'from the reviewed WS2025 schema translation. Keyed by schema shape AND the kind ' + + 'of the desired value, because string-typed values use an int() coercion form.', + schemaBeforeCommit: EVIDENCE.schemaBeforeCommit, + schemaAfterCommit: EVIDENCE.schemaAfterCommit, + paths: WS2025.map(([file]) => `public/_baselines/${file}`), + reachableFromOriginMain: true, + regenerate: 'node scripts/ws2022-baseline-repair/derive-maps.mjs', + }, + entries, + }; +} + +export function valueKind(value) { + if (value === undefined) return 'absent'; + if (value === null) return 'null'; + if (Array.isArray(value)) return 'array'; + return typeof value; +} + +const targets = [ + ['csp-provider-map.json', deriveCspProviderMap], + ['schema-expression-map.json', deriveSchemaExpressionMap], +]; + +function main() { + assertPinnedAndReachable(); + const check = process.argv.includes('--check'); + let drift = 0; + for (const [file, build] of targets) { + const next = `${JSON.stringify(build(), null, 2)}\n`; + const dest = path.join(HERE, file); + if (check) { + const current = readFileSync(dest, 'utf8'); + if (current.replace(/\r\n/g, '\n') !== next) { + drift += 1; + console.error(`DRIFT: ${file} differs from the derived table`); + } else { + console.log(`ok: ${file}`); + } + continue; + } + writeFileSync(dest, next, 'utf8'); + console.log(`wrote: ${file}`); + } + if (check && drift) process.exit(1); +} + +if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) { + main(); +} diff --git a/scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs b/scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs new file mode 100644 index 0000000..1199db3 --- /dev/null +++ b/scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs @@ -0,0 +1,775 @@ +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. +// +// Repairs the three bundled Windows Server 2022 security baselines so a +// standalone (non-MDM-enrolled) machine can actually read every setting. +// +// WHY +// --- +// The generated WS2022 profiles address 71-73 rules per profile through +// `./Vendor/MSFT/Policy/Result/...` (the Policy CSP). On a standalone box the +// rules that declare `type: array` fail the OMA-DM read with 0x86000011 and +// surface in ConfigForge as "unread". WS2025 had the same defect and was +// repaired in PRs #82/#93 by moving those rules onto dedicated providers. +// WS2022 was left in the old generated form. This script applies the same, +// already reviewed conversion to WS2022. +// +// POLICY +// ------ +// * WS2022 desired values are AUTHORITATIVE. Only the mechanism (provider + +// addressing) is borrowed from the reviewed WS2025 repair. A value is only +// ever reshaped to satisfy the destination provider's contract (scalar -> +// list for UserRightsAssignment, 0/1 -> false/true for AccountPolicy, +// array -> REG_MULTI_SZ / delimited REG_SZ for Registry), never retargeted. +// * Conversion preference: Registry > AuditPolicy > UserRightsAssignment > +// AccountPolicy > keep CSP. The preference is already encoded per OMA-URI +// in `csp-provider-map.json`; anything absent from that table stays CSP and +// is reported. +// * `schema: {}` is NOT turned into an invented assertion. It becomes the +// WS2025 informational form (`expression: 'true'` plus a template that says +// so). Any real schema that cannot survive a provider value reshape is +// downgraded to informational and reported, never silently reinterpreted. +// +// Usage: +// node scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs # write +// node scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs --check # verify +// node scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs --report # print + +import { execFileSync } from 'node:child_process'; +import { readFileSync, writeFileSync } from 'node:fs'; +import path from 'node:path'; +import { fileURLToPath } from 'node:url'; +import yaml from 'js-yaml'; + +const HERE = path.dirname(fileURLToPath(import.meta.url)); +const REPO = path.resolve(HERE, '..', '..'); +const BASELINES = path.join(REPO, 'public', '_baselines'); + +/** + * The conversion input is pinned to the full SHA of the last commit that + * carries the original generated WS2022 profiles, so the repair stays + * reproducible and `--check` keeps working after the repaired files are + * committed on top. Full SHA (not an abbreviation, not a branch) so the input + * cannot drift; reachable from `origin/main`. + */ +export const SOURCE_COMMIT = '173177e9eaa34d0b910b44d0749192859831fd50'; + +/** + * Reviewer-supplied live audit of the workgroup-member profile, recorded as + * evidence for the read-failure claim. NOT a native WS2022 validation: the run + * was performed against a Windows Server 2025 host, because that is the only + * platform OSConfig supports the security-baseline scenario on. + */ +export const LIVE_SMOKE = { + profile: 'ws2022-workgroup-member.osc.yaml', + host: 'Windows Server 2025 (not Windows Server 2022)', + oscfgVersion: '1.3.12-preview5', + shipped: { compliant: 171, readErrors: 29 }, + repaired: { compliant: 200, nonCompliant: 2, readErrors: 0 }, + caveat: + 'Executed on Windows Server 2025 hardware, so it demonstrates that the repaired ' + + 'provider addressing reads on a standalone machine. It is NOT native Windows ' + + 'Server 2022 validation, and the 2 non-compliant results are genuine findings ' + + 'on that host rather than read failures.', +}; + +const CSP = 'Microsoft.Windows/CSP'; +const REGISTRY = 'Microsoft.Windows/Registry'; +const URA = 'Microsoft.Windows/UserRightsAssignment'; +const ACCOUNT = 'Microsoft.Windows/AccountPolicy'; +const TEST = 'Microsoft.OSConfig/Test'; +const GROUP = 'Microsoft.OSConfig/Group'; + +export const PROFILES = [ + 'ws2022-domain-member.osc.yaml', + 'ws2022-domain-controller.osc.yaml', + 'ws2022-workgroup-member.osc.yaml', +]; + +const cspProviderMap = JSON.parse(readFileSync(path.join(HERE, 'csp-provider-map.json'), 'utf8')); +const schemaExpressionMap = JSON.parse( + readFileSync(path.join(HERE, 'schema-expression-map.json'), 'utf8'), +); + +// ── registry contract normalisation ─────────────────────────────────────── +// `Microsoft.Windows/Registry` only resolves a hive token when it is followed +// by a colon: `HKEY_LOCAL_MACHINE\...` silently reads back null. The WS2025 +// repair normalised every keyPath; do the same here so the manifest is correct +// on its own instead of relying on the audit-path normaliser. +const HIVES = [ + 'HKEY_LOCAL_MACHINE', 'HKEY_CURRENT_USER', 'HKEY_CLASSES_ROOT', + 'HKEY_USERS', 'HKEY_CURRENT_CONFIG', 'HKLM', 'HKCU', 'HKCR', 'HKU', 'HKCC', +]; + +const REG_TYPE_ALIASES = { + dword: 'REG_DWORD', + qword: 'REG_QWORD', + string: 'REG_SZ', + expandstring: 'REG_EXPAND_SZ', + multistring: 'REG_MULTI_SZ', + binary: 'REG_BINARY', + reg_dword: 'REG_DWORD', + reg_qword: 'REG_QWORD', + reg_sz: 'REG_SZ', + reg_expand_sz: 'REG_EXPAND_SZ', + reg_multi_sz: 'REG_MULTI_SZ', + reg_binary: 'REG_BINARY', +}; + +const REG_INT_TYPES = new Set(['REG_DWORD', 'REG_QWORD']); +const REG_STRING_TYPES = new Set(['REG_SZ', 'REG_EXPAND_SZ', 'REG_BINARY']); + +/** + * WS2022 rules whose declared Registry contract cannot hold their own value + * (an array parked in a Dword). Each repair is the shape the reviewed WS2025 + * baseline ships for the identical keyPath/valueName, so the desired state is + * unchanged; only the declared type and the payload shape are corrected. + */ +const REGISTRY_SHAPE_REPAIRS = { + NetworkProviderHardenedPathsNETLOGON: { + valueType: 'REG_SZ', + reshape: (value) => value.map(String).join(', '), + evidence: 'ws2025-member-server:NetworkProviderHardenedPathsNETLOGON', + }, + NetworkProviderHardenedPathsSYSVOL: { + valueType: 'REG_SZ', + reshape: (value) => value.map(String).join(', '), + evidence: 'ws2025-member-server:NetworkProviderHardenedPathsSYSVOL', + }, + RemotelyAccessibleRegistryPaths: { + valueType: 'REG_MULTI_SZ', + reshape: (value) => value.map(String), + evidence: 'ws2025-member-server:RemotelyAccessibleRegistryPaths', + }, + RemotelyAccessibleRegistryPathsAndSubpaths: { + valueType: 'REG_MULTI_SZ', + reshape: (value) => value.map(String), + evidence: 'ws2025-member-server:RemotelyAccessibleRegistryPathsAndSubpaths', + }, + SharesThatCanBeAccessedAnonymously: { + valueType: 'REG_MULTI_SZ', + reshape: (value) => value.map(String), + evidence: 'ws2025-member-server:SharesThatCanBeAccessedAnonymously', + }, +}; + +/** + * The one composite rule in WS2022: a single DeviceLock CSP node carries three + * independent account-lockout policies as a delimited string. AccountPolicy + * addresses them individually, so the rule expands into three. Same expansion + * and same `_` suffix convention as the shipped WS2025 baselines. + */ +const LOCKOUT_CSP_PATH = './Vendor/MSFT/Policy/Result/DeviceLock/AccountLockoutPolicy'; +const LOCKOUT_POLICIES = [ + ['AccountLockoutDuration', 'LockoutDuration'], + ['AccountLockoutThreshold', 'LockoutThreshold'], + ['ResetAccountLockoutCounterAfter', 'LockoutReset'], +]; + +// ── small helpers ───────────────────────────────────────────────────────── +const clone = (value) => (value === undefined ? undefined : JSON.parse(JSON.stringify(value))); +const isInteger = (value) => typeof value === 'string' && /^-?\d+$/.test(value.trim()); + +export function valueKind(value) { + if (value === undefined) return 'absent'; + if (value === null) return 'null'; + if (Array.isArray(value)) return 'array'; + return typeof value; +} + +function canonical(value) { + if (Array.isArray(value)) return value.map(canonical); + if (value && typeof value === 'object') { + return Object.fromEntries( + Object.keys(value).sort().map((key) => [key, canonical(value[key])]), + ); + } + return value; +} + +const schemaKey = (schema, kind) => `${JSON.stringify(canonical(schema))}\u0000${kind}`; + +export function normalizeKeyPath(keyPath) { + const text = String(keyPath ?? ''); + const separator = text.indexOf('\\'); + if (separator < 0) return text; + const head = text.slice(0, separator); + if (head.endsWith(':')) return text; + if (!HIVES.includes(head.toUpperCase())) return text; + return `${head}:${text.slice(separator)}`; +} + +export function normalizeRegistryValueType(valueType) { + const alias = REG_TYPE_ALIASES[String(valueType ?? '').toLowerCase()]; + return alias ?? String(valueType ?? ''); +} + +// ── schema -> CEL ───────────────────────────────────────────────────────── +const INFORMATIONAL = { + expression: 'true', + template: 'The value {value} is informational for this control.', +}; + +const literal = (value) => (typeof value === 'string' ? JSON.stringify(value) : String(value)); +const list = (values) => `[${values.map(literal).join(',')}]`; + +const goldenSchemaTranslations = new Map( + schemaExpressionMap.entries.map((entry) => [ + schemaKey(entry.schema, entry.valueKind), + { expression: entry.expression, template: entry.template, evidence: entry.evidence }, + ]), +); + +/** + * Generic translation of the JSON-Schema shapes the generated baselines use. + * Deliberately narrow: an unrecognised shape throws rather than guessing, so a + * new shape has to be reviewed instead of silently degrading to `true`. + */ +export function translateSchema(schema, kind) { + if (schema === undefined || schema === null) return { ...INFORMATIONAL }; + const keys = Object.keys(schema); + if (keys.length === 0) return { ...INFORMATIONAL }; + + if (Array.isArray(schema.oneOf)) { + const nullable = schema.oneOf.some((branch) => branch?.type === 'null'); + const consts = schema.oneOf + .filter((branch) => branch && Object.prototype.hasOwnProperty.call(branch, 'const')) + .map((branch) => branch.const); + if (nullable && consts.length === 1) { + return { + expression: `((((value == ${literal(consts[0])})) || ((value == null))))`, + template: `The value {value} must be one of ${literal(consts[0])}, (not set).`, + }; + } + } + + if (Object.prototype.hasOwnProperty.call(schema, 'const') && keys.length === 1) { + return { + expression: `(value == ${literal(schema.const)})`, + template: `The value {value} must be ${literal(schema.const)}.`, + }; + } + + if (Array.isArray(schema.enum) && keys.length === 1) { + return { + expression: `(${list(schema.enum)}.exists(item, value == item))`, + template: `The value {value} must be one of ${list(schema.enum)}.`, + }; + } + + if (typeof schema.pattern === 'string' && keys.length === 1) { + return { + expression: `(value != null && value.matches(${JSON.stringify(schema.pattern)}))`, + template: `The value {value} must match the pattern ${JSON.stringify(schema.pattern)}.`, + }; + } + + const hasMin = typeof schema.minimum === 'number'; + const hasMax = typeof schema.maximum === 'number'; + if ((hasMin || hasMax) && keys.every((key) => key === 'minimum' || key === 'maximum')) { + // A string-typed desired value has to be coerced before it can be compared + // numerically; this is the exact form the reviewed WS2025 repair uses. + const operand = kind === 'string' ? 'int(value)' : 'value'; + const guard = kind === 'string' ? ' && value.matches("^-?[0-9]+$")' : ''; + const bounds = []; + if (hasMin) bounds.push(`${operand} >= ${schema.minimum}`); + if (hasMax) bounds.push(`${operand} <= ${schema.maximum}`); + let template; + if (hasMin && hasMax) template = `The value {value} must be between ${schema.minimum} and ${schema.maximum}.`; + else if (hasMin) template = `The value {value} must be greater than or equal to ${schema.minimum}.`; + else template = `The value {value} must be less than or equal to ${schema.maximum}.`; + return { expression: `(value != null${guard} && ${bounds.join(' && ')})`, template }; + } + + throw new Error(`unsupported compliance schema shape: ${JSON.stringify(schema)}`); +} + +function compileSchema(schema, kind) { + const golden = goldenSchemaTranslations.get(schemaKey(schema, kind)); + if (golden) { + return { expression: golden.expression, template: golden.template, source: 'ws2025-reviewed' }; + } + return { ...translateSchema(schema, kind), source: 'derived' }; +} + +/** + * `Microsoft.Windows/UserRightsAssignment` reads back a list of principals, so + * the generated scalar schema has to be restated over a list rather than + * dropped. The only scalar shape the WS2022 profiles use on a user right is + * "empty string or not set", which is exactly "no principals are assigned": + * + * {"oneOf":[{"const":""},{"type":"null"}]} -> value == null || value.size() == 0 + * + * `size()` on a list is standard CEL and is already exercised against a + * `UserRightsAssignment` resource in this repo + * (`packages/core/src/import-export/index.test.ts`, `expression: 'value.size() == 2'`). + * CEL's `||` short-circuits, so the null branch is evaluated before `size()` + * is ever applied to a missing value. + * + * Returns `null` for any other shape so an unreviewed schema still surfaces as + * an explicit downgrade instead of being silently reinterpreted. + */ +export function translatePrincipalListSchema(schema, beforeValue, afterList) { + if (!schema || typeof schema !== 'object') return null; + if (!Array.isArray(afterList) || afterList.length !== 0) return null; + if (beforeValue !== '' && beforeValue !== null) return null; + + const keys = Object.keys(schema); + const isEmptyOrNull = keys.length === 1 + && Array.isArray(schema.oneOf) + && schema.oneOf.length === 2 + && schema.oneOf.some((branch) => branch?.type === 'null') + && schema.oneOf.some( + (branch) => branch + && Object.prototype.hasOwnProperty.call(branch, 'const') + && branch.const === '', + ); + if (!isEmptyOrNull) return null; + + return { + expression: 'value == null || value.size() == 0', + template: 'The value {value} must be unassigned (no principals).', + source: 'principal-list-restatement', + }; +} + +/** Re-type schema constants after a provider-mandated value cast (0 -> false). */ +function retypeSchema(schema, before, after) { + if (!schema || typeof schema !== 'object' || before === after) return schema; + const next = clone(schema); + const cast = (entry) => { + if (String(entry) !== String(before)) return entry; + return after; + }; + const walk = (node) => { + if (!node || typeof node !== 'object') return; + if (Object.prototype.hasOwnProperty.call(node, 'const')) node.const = cast(node.const); + if (Array.isArray(node.enum)) node.enum = node.enum.map(cast); + for (const key of ['oneOf', 'anyOf', 'allOf']) { + if (Array.isArray(node[key])) node[key].forEach(walk); + } + }; + walk(next); + return next; +} + +// ── value reshaping for a destination provider ──────────────────────────── +function toUserRightsList(value, ruleName, report) { + if (Array.isArray(value)) return value.map(String); + if (value === '' || value === null) { + report.reshaped.push(`${ruleName}: "" -> [] (UserRightsAssignment takes a list of principals)`); + return []; + } + const parts = String(value).split(',').map((part) => part.trim()).filter(Boolean); + report.reshaped.push(`${ruleName}: "${value}" -> ${JSON.stringify(parts)} (delimited string -> list)`); + return parts; +} + +function toAccountPolicyValue(value, sampleKind, ruleName, report) { + if (sampleKind === 'boolean' && typeof value !== 'boolean') { + const next = value === 1 || value === '1'; + report.reshaped.push( + `${ruleName}: ${JSON.stringify(value)} -> ${next} (AccountPolicy returns booleans)`, + ); + return next; + } + if (sampleKind === 'number' && isInteger(value)) return Number(String(value).trim()); + return value; +} + +function toRegistryValue(value, valueType, ruleName, report) { + if (value === undefined) return undefined; + if (valueType === 'REG_MULTI_SZ') { + if (Array.isArray(value)) return value.map(String); + return [String(value)]; + } + if (REG_INT_TYPES.has(valueType) && isInteger(value)) { + report.reshaped.push(`${ruleName}: "${value}" -> ${Number(value)} (${valueType})`); + return Number(String(value).trim()); + } + if (REG_STRING_TYPES.has(valueType) && typeof value === 'number') { + report.reshaped.push(`${ruleName}: ${value} -> "${value}" (${valueType})`); + return String(value); + } + return value; +} + +// ── conversion ──────────────────────────────────────────────────────────── +const cspTargets = new Map(cspProviderMap.entries.map((entry) => [entry.cspPath, entry])); + +function convertCsp(rule, report) { + const inner = rule.properties.resource; + const cspPath = String(inner.properties?.path ?? ''); + const hasValue = Object.prototype.hasOwnProperty.call(inner.properties ?? {}, 'value'); + const value = inner.properties?.value; + const schema = rule.properties.schema; + const entry = cspTargets.get(cspPath); + + if (!entry) { + report.residualCsp.push({ name: rule.name, cspPath, reason: 'no reviewed provider mapping' }); + return [rule]; + } + + if (cspPath === LOCKOUT_CSP_PATH) { + const parts = new Map( + String(value ?? '') + .split(',') + .map((part) => part.split(':').map((token) => token.trim())) + .filter((pair) => pair.length === 2), + ); + const produced = []; + for (const [cspKey, policyName] of LOCKOUT_POLICIES) { + if (!parts.has(cspKey)) continue; + const raw = parts.get(cspKey); + produced.push({ + name: produced.length === 0 ? rule.name : `${rule.name}_${policyName}`, + type: TEST, + properties: { + resource: { + type: ACCOUNT, + properties: { name: policyName, value: isInteger(raw) ? Number(raw) : raw }, + }, + ...INFORMATIONAL, + }, + }); + } + if (produced.length !== LOCKOUT_POLICIES.length) { + throw new Error(`${rule.name}: expected ${LOCKOUT_POLICIES.length} lockout policies, got ${produced.length}`); + } + report.converted.push({ + name: rule.name, cspPath, to: ACCOUNT, expandedInto: produced.map((r) => r.name), + evidence: entry.evidence, + }); + report.expansionExtra += produced.length - 1; + return produced; + } + + const properties = clone(entry.target.properties) ?? {}; + let nextValue = value; + let compiledSchema = schema; + let restated = null; + let downgrade = null; + + if (entry.target.type === URA) { + if (hasValue) { + const before = valueKind(value); + nextValue = toUserRightsList(value, rule.name, report); + if (before !== 'array' && schema && Object.keys(schema).length > 0) { + restated = translatePrincipalListSchema(schema, value, nextValue); + if (restated) { + report.assertionRestatements.push({ + name: rule.name, + cspPath, + from: schema, + to: restated.expression, + reason: + 'the scalar "empty or not set" schema is restated over the principal list the ' + + 'UserRightsAssignment provider returns', + }); + } else { + downgrade = `scalar compliance schema ${JSON.stringify(schema)} does not apply to a principal list`; + compiledSchema = {}; + } + } + } + } else if (entry.target.type === ACCOUNT) { + if (hasValue) { + const before = nextValue; + nextValue = toAccountPolicyValue(value, valueKind(entry.ws2025Value), rule.name, report); + compiledSchema = retypeSchema(schema, before, nextValue); + } + } else if (entry.target.type === REGISTRY) { + properties.valueType = normalizeRegistryValueType(properties.valueType); + properties.keyPath = normalizeKeyPath(properties.keyPath); + if (hasValue) nextValue = toRegistryValue(value, properties.valueType, rule.name, report); + } else if (hasValue && typeof value === 'string' && isInteger(value)) { + nextValue = Number(value.trim()); + } + + if (hasValue) properties.value = nextValue; + + if (downgrade) { + report.assertionDowngrades.push({ name: rule.name, cspPath, reason: downgrade }); + } + report.converted.push({ + name: rule.name, cspPath, to: entry.target.type, evidence: entry.evidence, + }); + + const compiled = restated + ?? compileSchema(compiledSchema, valueKind(hasValue ? nextValue : undefined)); + return [{ + name: rule.name, + type: TEST, + properties: { + resource: { type: entry.target.type, properties }, + expression: compiled.expression, + template: compiled.template, + }, + }]; +} + +function convertRegistry(rule, report) { + const inner = rule.properties.resource; + const properties = clone(inner.properties) ?? {}; + const before = properties.keyPath; + properties.keyPath = normalizeKeyPath(properties.keyPath); + if (properties.keyPath !== before) report.keyPathNormalized += 1; + properties.valueType = normalizeRegistryValueType(properties.valueType); + + let schema = rule.properties.schema; + const hasValue = Object.prototype.hasOwnProperty.call(properties, 'value'); + + if (hasValue && Array.isArray(properties.value) && REG_INT_TYPES.has(properties.valueType)) { + const repair = REGISTRY_SHAPE_REPAIRS[rule.name]; + if (!repair) { + throw new Error(`${rule.name}: array value declared as ${properties.valueType} with no reviewed repair`); + } + report.shapeRepairs.push({ + name: rule.name, + from: { valueType: properties.valueType, value: properties.value }, + to: { valueType: repair.valueType, value: repair.reshape(properties.value) }, + evidence: repair.evidence, + }); + properties.value = repair.reshape(properties.value); + properties.valueType = repair.valueType; + } + + if (hasValue && !Array.isArray(properties.value)) { + const coerced = toRegistryValue(properties.value, properties.valueType, rule.name, report); + if (coerced !== properties.value) { + schema = retypeSchema(schema, properties.value, coerced); + properties.value = coerced; + } + } + + const compiled = compileSchema(schema, valueKind(hasValue ? properties.value : undefined)); + return [{ + name: rule.name, + type: TEST, + properties: { + resource: { type: REGISTRY, properties }, + expression: compiled.expression, + template: compiled.template, + }, + }]; +} + +function convertOther(rule) { + const inner = rule.properties.resource; + const hasValue = Object.prototype.hasOwnProperty.call(inner.properties ?? {}, 'value'); + const compiled = compileSchema( + rule.properties.schema, + valueKind(hasValue ? inner.properties.value : undefined), + ); + return [{ + name: rule.name, + type: TEST, + properties: { + resource: clone(inner), + expression: compiled.expression, + template: compiled.template, + }, + }]; +} + +function convertList(resources, report) { + const out = []; + for (const rule of resources) { + if (rule?.type === GROUP && Array.isArray(rule.properties?.resources)) { + out.push({ + ...rule, + properties: { ...rule.properties, resources: convertList(rule.properties.resources, report) }, + }); + continue; + } + if (rule?.type !== TEST || !rule.properties?.resource) { + throw new Error(`${rule?.name ?? ''}: expected a Microsoft.OSConfig/Test wrapper`); + } + report.sourceRules += 1; + report.sourceRuleNames.push(rule.name); + const innerProps = rule.properties.resource.properties ?? {}; + if (Object.prototype.hasOwnProperty.call(innerProps, 'value')) { + report.sourceValues[rule.name] = clone(innerProps.value) ?? innerProps.value; + } + const innerType = rule.properties.resource.type; + if (innerType === CSP) { + report.sourceCsp += 1; + out.push(...convertCsp(rule, report)); + } else if (innerType === REGISTRY) { + out.push(...convertRegistry(rule, report)); + } else { + out.push(...convertOther(rule)); + } + } + return out; +} + +export function repairProfile(filename) { + const source = yaml.load(execFileSync( + 'git', + ['show', `${SOURCE_COMMIT}:public/_baselines/${filename}`], + { cwd: REPO, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }, + )); + const report = { + profile: filename, + sourceRules: 0, + sourceCsp: 0, + expansionExtra: 0, + keyPathNormalized: 0, + converted: [], + residualCsp: [], + assertionDowngrades: [], + assertionRestatements: [], + shapeRepairs: [], + reshaped: [], + sourceRuleNames: [], + sourceValues: {}, + }; + const resources = convertList(source.resources ?? [], report); + report.outputRules = resources.length; + report.providerCounts = {}; + for (const rule of resources) { + const type = rule.properties.resource.type; + report.providerCounts[type] = (report.providerCounts[type] ?? 0) + 1; + } + + // Every desired value that is not byte-identical to the source, with the + // provider-contract reason it had to change. Anything outside this list is a + // regression, and the test suite asserts exactly that. + const outputByName = new Map(resources.map((rule) => [rule.name, rule])); + report.valueChanges = []; + for (const [name, sourceValue] of Object.entries(report.sourceValues)) { + const produced = outputByName.get(name)?.properties?.resource?.properties; + const outputValue = produced && Object.prototype.hasOwnProperty.call(produced, 'value') + ? produced.value + : undefined; + if (JSON.stringify(sourceValue) === JSON.stringify(outputValue)) continue; + report.valueChanges.push({ name, from: sourceValue, to: outputValue }); + } + report.expansions = report.converted + .filter((entry) => entry.expandedInto) + .map((entry) => ({ name: entry.name, into: entry.expandedInto })); + const reconciled = report.sourceRules + report.expansionExtra === report.outputRules + && report.converted.length + report.residualCsp.length === report.sourceCsp; + if (!reconciled) { + throw new Error( + `${filename}: rule reconciliation failed ` + + `(source ${report.sourceRules} + expansion ${report.expansionExtra} != output ${report.outputRules})`, + ); + } + const text = yaml.dump({ ...source, resources }, { + indent: 2, lineWidth: 120, noRefs: true, sortKeys: false, quotingType: "'", + }); + return { text, report }; +} + +// ── entry point ─────────────────────────────────────────────────────────── +function main() { + const check = process.argv.includes('--check'); + const wantReport = process.argv.includes('--report'); + // `--check` verifies and `--report` prints; only a bare invocation writes. + const write = !check && !wantReport; + const reports = []; + let drift = 0; + // `* text=auto` + core.autocrlf checks the YAML out with CRLF on Windows, so + // --check compares content, not line endings. + const sameContent = (a, b) => a.replace(/\r\n/g, '\n') === b.replace(/\r\n/g, '\n'); + const preserveLineEndings = (destination, text) => { + const current = readFileSync(destination, 'utf8'); + return current.includes('\r\n') ? text.replace(/\r?\n/g, '\r\n') : text; + }; + + for (const filename of PROFILES) { + const { text, report } = repairProfile(filename); + reports.push(report); + const dest = path.join(BASELINES, filename); + if (check) { + if (!sameContent(readFileSync(dest, 'utf8'), text)) { + drift += 1; + console.error(`DRIFT: ${filename} does not match the deterministic repair output`); + } else { + console.log(`ok: ${filename}`); + } + continue; + } + if (!write) continue; + writeFileSync(dest, preserveLineEndings(dest, text), 'utf8'); + console.log(`wrote: ${filename}`); + } + + const conversionReport = `${JSON.stringify({ + _provenance: { + description: + 'Per-profile provenance for the WS2022 Policy CSP repair. Committed so the ' + + 'shipped baselines can be validated without git history (CI checks out shallow).', + sourceCommit: SOURCE_COMMIT, + source: `${SOURCE_COMMIT}:public/_baselines/ws2022-*.osc.yaml`, + regenerate: 'node scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs', + verify: 'node scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs --check', + liveSmoke: LIVE_SMOKE, + }, + profiles: reports.map((report) => ({ + profile: report.profile, + sourceRules: report.sourceRules, + outputRules: report.outputRules, + sourceCsp: report.sourceCsp, + convertedCsp: report.converted.length, + residualCsp: report.residualCsp, + keyPathNormalized: report.keyPathNormalized, + providerCounts: report.providerCounts, + expansions: report.expansions, + registryShapeRepairs: report.shapeRepairs, + assertionRestatements: report.assertionRestatements, + assertionDowngrades: report.assertionDowngrades, + valueChanges: report.valueChanges, + conversions: report.converted.map(({ name, cspPath, to, evidence }) => ({ + name, cspPath, to, evidence, + })), + sourceRuleNames: report.sourceRuleNames, + sourceValues: report.sourceValues, + })), + }, null, 2)}\n`; + const reportPath = path.join(HERE, 'conversion-report.json'); + if (check) { + if (!sameContent(readFileSync(reportPath, 'utf8'), conversionReport)) { + drift += 1; + console.error('DRIFT: conversion-report.json does not match the deterministic repair output'); + } else { + console.log('ok: conversion-report.json'); + } + } else if (write) { + writeFileSync( + reportPath, + preserveLineEndings(reportPath, conversionReport), + 'utf8', + ); + console.log('wrote: conversion-report.json'); + } + + if (wantReport) console.log('--report is read-only: nothing was written.'); + + for (const report of reports) { + console.log(''); + console.log(`${report.profile}: ${report.sourceRules} -> ${report.outputRules} rules`); + console.log(` CSP in source : ${report.sourceCsp}`); + console.log(` converted : ${report.converted.length}`); + console.log(` residual CSP : ${report.residualCsp.length}`); + console.log(` keyPath normalised : ${report.keyPathNormalized}`); + console.log(` registry shape repair : ${report.shapeRepairs.length}`); + console.log(` assertion restatements: ${report.assertionRestatements.length}`); + console.log(` assertion downgrades : ${report.assertionDowngrades.length}`); + console.log(` providers : ${JSON.stringify(report.providerCounts)}`); + if (wantReport) { + for (const item of report.residualCsp) console.log(` residual: ${item.name} (${item.cspPath})`); + for (const item of report.assertionRestatements) console.log(` restated: ${item.name} -> ${item.to}`); + for (const item of report.assertionDowngrades) console.log(` downgraded: ${item.name} — ${item.reason}`); + for (const line of report.reshaped) console.log(` reshaped: ${line}`); + } + } + + if (check && drift) process.exit(1); +} + +if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) { + main(); +} diff --git a/scripts/ws2022-baseline-repair/repair-ws2022-baselines.test.mjs b/scripts/ws2022-baseline-repair/repair-ws2022-baselines.test.mjs new file mode 100644 index 0000000..2a7349d --- /dev/null +++ b/scripts/ws2022-baseline-repair/repair-ws2022-baselines.test.mjs @@ -0,0 +1,683 @@ +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. + +import { describe, it, expect } from 'vitest'; +import { execFileSync } from 'node:child_process'; +import { readFileSync, statSync } from 'node:fs'; +import path from 'node:path'; +import { fileURLToPath } from 'node:url'; +import { + PROFILES, + SOURCE_COMMIT, + LIVE_SMOKE, + valueKind, + normalizeKeyPath, + normalizeRegistryValueType, + translateSchema, + translatePrincipalListSchema, +} from './repair-ws2022-baselines.mjs'; +import { + EVIDENCE, + WS2025, + assertPinnedAndReachable, + showAt, + valueKind as evidenceValueKind, +} from './derive-maps.mjs'; + +/** + * Unit coverage for the WS2022 baseline repair tooling. + * + * The shipped YAML is asserted separately in + * `apps/desktop/src/data/ws2022-baselines.test.ts`. + * + * DESIGN NOTE — this suite deliberately does NOT check the generated baselines + * against the mapping tables that generated them; that would be circular. Every + * mapping claim is re-derived here by parsing the *pinned evidence commits* + * with `git show`, independently of the committed JSON tables, and the tables + * are then required to agree with that independent reading. + */ + +const HERE = path.dirname(fileURLToPath(import.meta.url)); +const REPO = path.resolve(HERE, '..', '..'); +const SCRIPT = path.join(HERE, 'repair-ws2022-baselines.mjs'); +const readJson = (name) => JSON.parse(readFileSync(path.join(HERE, name), 'utf8')); + +const cspMap = readJson('csp-provider-map.json'); +const schemaMap = readJson('schema-expression-map.json'); +const conversionReport = readJson('conversion-report.json'); + +const DEDICATED_PROVIDERS = [ + 'Microsoft.Windows/AccountPolicy', + 'Microsoft.Windows/AuditPolicy', + 'Microsoft.Windows/UserRightsAssignment', +]; + +const FULL_SHA = /^[0-9a-f]{40}$/; +const CSP_TYPE = 'Microsoft.Windows/CSP'; + +/** + * The pinned commits are only readable when the checkout has history. CI is + * required to provide it (`fetch-depth: 0` on the test job); a developer with a + * shallow or partial clone gets the non-git assertions and an explicit skip. + */ +let evidenceError = null; +try { + assertPinnedAndReachable(EVIDENCE, REPO); + for (const [file] of WS2025) showAt(EVIDENCE.providerAfterCommit, file, REPO); +} catch (error) { + evidenceError = error; +} +const evidenceAvailable = evidenceError === null; + +const byName = (doc) => new Map((doc.resources ?? []).map((rule) => [rule.name, rule])); +const tagToFile = new Map(WS2025.map(([file, tag]) => [tag, file])); +const cacheAt = new Map(); +function rulesAt(commit, tag) { + const key = `${commit}:${tag}`; + if (!cacheAt.has(key)) cacheAt.set(key, byName(showAt(commit, tagToFile.get(tag), REPO))); + return cacheAt.get(key); +} +const parseEvidenceRef = (ref) => { + const match = /^ws2025-([a-z-]+):(.+)$/.exec(ref); + if (!match) throw new Error(`malformed evidence reference: ${ref}`); + return { tag: match[1], name: match[2] }; +}; + +/** + * Minimal CEL evaluator covering exactly the disjunction grammar used by the + * restored user-rights assertion. `||` short-circuits the way CEL does, so a + * `null` value never reaches `size()`; anything outside the grammar throws + * rather than being silently approximated. + */ +function evalCel(expression, value) { + return expression.split('||').map((part) => part.trim()).some((atom) => { + if (atom === 'value == null') return value === null || value === undefined; + const sized = /^value\.size\(\) == (\d+)$/.exec(atom); + if (sized) { + if (value === null || value === undefined) throw new Error('size() applied to a null value'); + if (!Array.isArray(value)) throw new Error('size() applied to a non-list value'); + return value.length === Number(sized[1]); + } + throw new Error(`unsupported CEL atom for this harness: ${atom}`); + }); +} + +describe('pinned provenance', () => { + it('is reachable in CI, where full history is required', () => { + if (process.env.CI) { + expect(evidenceError, `CI must check out full history: ${evidenceError?.message}`).toBe(null); + } else { + expect(typeof evidenceAvailable).toBe('boolean'); + } + }); + + it('pins the WS2022 repair input to a full SHA', () => { + expect(SOURCE_COMMIT).toBe('173177e9eaa34d0b910b44d0749192859831fd50'); + expect(SOURCE_COMMIT).toMatch(FULL_SHA); + expect(conversionReport._provenance.sourceCommit).toBe(SOURCE_COMMIT); + }); + + it('pins the provider map to the reviewed WS2025 CSP repair, by full SHA', () => { + const p = cspMap._provenance; + expect(p.providerBeforeCommit).toBe('ab71aaf778a87322899a671e6d06bce0fa40aa2a'); + expect(p.providerAfterCommit).toBe('50d469c3cf5e16729f1359538b10ef4bc0b6de78'); + expect(p.ws2022SourceCommit).toBe(SOURCE_COMMIT); + for (const key of ['providerBeforeCommit', 'providerAfterCommit', 'ws2022SourceCommit']) { + expect(p[key], key).toMatch(FULL_SHA); + } + expect(p.reachableFromOriginMain).toBe(true); + expect(p.derivedFrom, 'mutable working-tree provenance must be gone').toBeUndefined(); + }); + + it('pins the schema map to the reviewed WS2025 schema translation, by full SHA', () => { + const p = schemaMap._provenance; + expect(p.schemaBeforeCommit).toBe('50d469c3cf5e16729f1359538b10ef4bc0b6de78'); + expect(p.schemaAfterCommit).toBe('37ab26a74bd7a6aa7f6df9a6ecc0fba3a7521821'); + expect(p.schemaBeforeCommit).toMatch(FULL_SHA); + expect(p.schemaAfterCommit).toMatch(FULL_SHA); + expect(p.reachableFromOriginMain).toBe(true); + }); + + it('matches the pinned SHAs the derivation script actually reads', () => { + expect(EVIDENCE.providerBeforeCommit).toBe(cspMap._provenance.providerBeforeCommit); + expect(EVIDENCE.providerAfterCommit).toBe(cspMap._provenance.providerAfterCommit); + expect(EVIDENCE.schemaBeforeCommit).toBe(schemaMap._provenance.schemaBeforeCommit); + expect(EVIDENCE.schemaAfterCommit).toBe(schemaMap._provenance.schemaAfterCommit); + expect(EVIDENCE.ws2022SourceCommit).toBe(SOURCE_COMMIT); + }); + + it('refuses to read evidence from a mutable ref', () => { + expect(() => showAt('HEAD', 'ws2025-workgroup-member.osc.yaml', REPO)).toThrow(/non-pinned/); + expect(() => showAt('37ab26a', 'ws2025-workgroup-member.osc.yaml', REPO)).toThrow(/non-pinned/); + }); + + it.runIf(evidenceAvailable)('resolves every pinned SHA to an ancestor of origin/main', () => { + for (const [label, sha] of Object.entries(EVIDENCE)) { + expect(sha, label).toMatch(FULL_SHA); + const resolved = execFileSync('git', ['rev-parse', `${sha}^{commit}`], { + cwd: REPO, encoding: 'utf8', + }).trim(); + expect(resolved, label).toBe(sha); + expect( + () => execFileSync('git', ['merge-base', '--is-ancestor', sha, 'origin/main'], { cwd: REPO }), + `${label} ${sha} must be reachable from origin/main`, + ).not.toThrow(); + } + }); + + it.runIf(evidenceAvailable)('rejects an unreachable commit', () => { + expect(() => assertPinnedAndReachable( + { bogus: '0000000000000000000000000000000000000000' }, + REPO, + )).toThrow(); + expect(() => assertPinnedAndReachable({ abbreviated: '37ab26a' }, REPO)) + .toThrow(/full 40-character SHA/); + }); +}); + +describe('csp-provider-map.json', () => { + it('maps every CSP path to exactly one dedicated provider', () => { + const seen = new Set(); + for (const entry of cspMap.entries) { + expect(entry.cspPath).toMatch(/^\.\/Vendor\/MSFT\/Policy\/Result\//); + expect(seen.has(entry.cspPath), `duplicate mapping for ${entry.cspPath}`).toBe(false); + seen.add(entry.cspPath); + expect(DEDICATED_PROVIDERS).toContain(entry.target.type); + } + expect(cspMap.entries.length).toBe(81); + }); + + it('has the expected provider split', () => { + const counts = {}; + for (const entry of cspMap.entries) { + counts[entry.target.type] = (counts[entry.target.type] ?? 0) + 1; + } + expect(counts).toEqual({ + 'Microsoft.Windows/AuditPolicy': 33, + 'Microsoft.Windows/UserRightsAssignment': 37, + 'Microsoft.Windows/AccountPolicy': 11, + }); + }); + + it('addresses each provider the way that provider is addressed', () => { + for (const entry of cspMap.entries) { + const props = entry.target.properties ?? {}; + expect(Object.keys(props), entry.cspPath).not.toContain('value'); + if (entry.target.type === 'Microsoft.Windows/AuditPolicy') { + expect(Object.keys(props), entry.cspPath).toEqual(['subcategory']); + expect(props.subcategory, entry.cspPath).toMatch( + /^\{[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}\}$/, + ); + } else { + expect(Object.keys(props), entry.cspPath).toEqual(['name']); + expect(typeof props.name).toBe('string'); + } + if (entry.target.type === 'Microsoft.Windows/UserRightsAssignment') { + expect(props.name, entry.cspPath).toMatch(/^Se[A-Z][A-Za-z]*(Privilege|Right)$/); + } + } + }); + + it('carries WS2025 evidence for every mapping', () => { + for (const entry of cspMap.entries) { + expect(entry.evidence.length, entry.cspPath).toBeGreaterThan(0); + for (const ref of entry.evidence) expect(ref).toMatch(/^ws2025-[a-z-]+:\S+$/); + } + }); + + it('covers every CSP path the three WS2022 profiles actually used', () => { + const mapped = new Set(cspMap.entries.map((entry) => entry.cspPath)); + for (const profile of conversionReport.profiles) { + for (const conversion of profile.conversions) { + expect(mapped.has(conversion.cspPath), `${profile.profile}: ${conversion.cspPath}`) + .toBe(true); + } + } + }); + + it('states known representative mappings explicitly', () => { + const at = (cspPath) => cspMap.entries.find((entry) => entry.cspPath === cspPath); + expect(at('./Vendor/MSFT/Policy/Result/Audit/AccountLogon_AuditCredentialValidation').target) + .toEqual({ + type: 'Microsoft.Windows/AuditPolicy', + properties: { subcategory: '{0CCE923F-69AE-11D9-BED3-505054503030}' }, + }); + expect(at('./Vendor/MSFT/Policy/Result/UserRights/AccessFromNetwork').target).toEqual({ + type: 'Microsoft.Windows/UserRightsAssignment', + properties: { name: 'SeNetworkLogonRight' }, + }); + expect(at('./Vendor/MSFT/Policy/Result/UserRights/ActAsPartOfTheOperatingSystem').target) + .toEqual({ + type: 'Microsoft.Windows/UserRightsAssignment', + properties: { name: 'SeTcbPrivilege' }, + }); + expect(at('./Vendor/MSFT/Policy/Result/DeviceLock/MaximumPasswordAge').target).toEqual({ + type: 'Microsoft.Windows/AccountPolicy', + properties: { name: 'MaximumPasswordAge' }, + }); + expect(at('./Vendor/MSFT/Policy/Result/DeviceLock/ClearTextPassword').target).toEqual({ + type: 'Microsoft.Windows/AccountPolicy', + properties: { name: 'EnablePasswordReversibleEncryption' }, + }); + }); +}); + +describe('csp-provider-map.json vs. independently parsed pinned baselines', () => { + it.runIf(evidenceAvailable)( + 'reproduces every target address from the pinned before/after WS2025 pair', + () => { + for (const entry of cspMap.entries) { + entry.evidence.forEach((ref, index) => { + const { tag, name } = parseEvidenceRef(ref); + const before = rulesAt(EVIDENCE.providerBeforeCommit, tag).get(name); + const after = rulesAt(EVIDENCE.providerAfterCommit, tag).get(name); + expect(before, `${ref} missing at providerBeforeCommit`).toBeDefined(); + expect(after, `${ref} missing at providerAfterCommit`).toBeDefined(); + + const from = before.properties?.resource; + expect(from?.type, ref).toBe(CSP_TYPE); + expect(from.properties?.path, ref).toBe(entry.cspPath); + + const to = after.properties?.resource; + expect(to?.type, ref).toBe(entry.target.type); + const address = { ...to.properties }; + delete address.value; + expect(address, ref).toEqual(entry.target.properties); + // `ws2025Value` is recorded from the first evidence profile only, and is + // never carried into WS2022 — the later profiles legitimately differ. + if (index === 0) { + expect(to.properties?.value, `${ref} desired value`).toEqual(entry.ws2025Value); + } + }); + } + }, + ); + + it.runIf(evidenceAvailable)('reads the representative mappings straight out of git', () => { + const wg = rulesAt(EVIDENCE.providerAfterCommit, 'workgroup-member'); + expect(wg.get('AuditCredentialValidation').properties.resource).toEqual({ + type: 'Microsoft.Windows/AuditPolicy', + properties: { subcategory: '{0CCE923F-69AE-11D9-BED3-505054503030}', value: 3 }, + }); + expect(wg.get('UserRightsAccessFromNetwork').properties.resource).toEqual({ + type: 'Microsoft.Windows/UserRightsAssignment', + properties: { name: 'SeNetworkLogonRight', value: ['*S-1-5-32-544', '*S-1-5-11'] }, + }); + expect(wg.get('DeviceLockMaximumPasswordAge').properties.resource.properties.name) + .toBe('MaximumPasswordAge'); + + const beforeWg = rulesAt(EVIDENCE.providerBeforeCommit, 'workgroup-member'); + expect(beforeWg.get('AuditCredentialValidation').properties.resource.properties.path) + .toBe('./Vendor/MSFT/Policy/Result/Audit/AccountLogon_AuditCredentialValidation'); + }); + + it.runIf(evidenceAvailable)('leaves no unmapped WS2025 CSP conversion behind', () => { + const mapped = new Set(cspMap.entries.map((entry) => entry.cspPath)); + const used = new Set( + conversionReport.profiles.flatMap((p) => p.conversions.map((c) => c.cspPath)), + ); + for (const cspPath of mapped) { + expect(used.has(cspPath), `${cspPath} is mapped but unused — stale map entry`).toBe(true); + } + }); +}); + +describe('schema-expression-map.json', () => { + it('translates every reviewed schema shape to a CEL expression and template', () => { + for (const entry of schemaMap.entries) { + expect(typeof entry.expression).toBe('string'); + expect(entry.expression.length).toBeGreaterThan(0); + expect(entry.template).toContain('{value}'); + expect(entry.evidence.length).toBeGreaterThan(0); + expect(new Set(entry.evidence).size).toBe(entry.evidence.length); + } + expect(schemaMap.entries.length).toBe(49); + }); + + it('is unambiguous — one translation per (schema, value kind) pair', () => { + const seen = new Set(); + for (const entry of schemaMap.entries) { + const key = `${JSON.stringify(entry.schema)}|${entry.valueKind}`; + expect(seen.has(key), `ambiguous translation for ${key}`).toBe(false); + seen.add(key); + } + }); + + it('states known representative translations explicitly', () => { + const at = (schema, kind) => schemaMap.entries.find( + (entry) => JSON.stringify(entry.schema) === JSON.stringify(schema) && entry.valueKind === kind, + ); + expect(at({ const: 0 }, 'number').expression).toBe('(value == 0)'); + expect(at({ const: '1' }, 'string').expression).toBe('(value == "1")'); + expect(at({ enum: [0, 1] }, 'number').expression) + .toBe('([0,1].exists(item, value == item))'); + }); + + it.runIf(evidenceAvailable)( + 'reproduces every translation from the pinned before/after WS2025 pair', + () => { + for (const entry of schemaMap.entries) { + for (const name of entry.evidence) { + // The same rule name lives in more than one WS2025 profile and can carry a + // different schema in each, so the claim is "some pinned profile shows this + // exact (schema, valueKind) -> (expression, template) pair". + const pairs = []; + for (const [, tag] of WS2025) { + const before = rulesAt(EVIDENCE.schemaBeforeCommit, tag).get(name); + const after = rulesAt(EVIDENCE.schemaAfterCommit, tag).get(name); + if (before && after) pairs.push({ tag, before, after }); + } + expect(pairs.length, `${name} missing from the pinned WS2025 baselines`) + .toBeGreaterThan(0); + + const match = pairs.find(({ before, after }) => ( + JSON.stringify(before.properties?.schema) === JSON.stringify(entry.schema) + && evidenceValueKind(after.properties?.resource?.properties?.value) === entry.valueKind + )); + expect( + match, + `${name}: no pinned profile carries schema ${JSON.stringify(entry.schema)} ` + + `with a ${entry.valueKind} value`, + ).toBeDefined(); + expect(match.after.properties?.expression, `${name} @${match.tag}`) + .toBe(entry.expression); + expect(match.after.properties?.template, `${name} @${match.tag}`).toBe(entry.template); + expect( + match.after.properties?.schema, + `${name} still carries a legacy schema at schemaAfterCommit`, + ).toBeUndefined(); + } + } + }, + ); + + it.runIf(evidenceAvailable)( + 'confirms the pinned after-commit really is the expression+template form', + () => { + for (const [, tag] of WS2025) { + const after = rulesAt(EVIDENCE.schemaAfterCommit, tag); + let expressions = 0; + let templates = 0; + let schemas = 0; + let resultCsp = 0; + let configCsp = 0; + for (const rule of after.values()) { + if (typeof rule.properties?.expression === 'string') expressions += 1; + if (typeof rule.properties?.template === 'string') templates += 1; + if (rule.properties?.schema !== undefined) schemas += 1; + const inner = rule.properties?.resource; + if (inner?.type !== CSP_TYPE) continue; + const cspPath = String(inner.properties?.path ?? ''); + if (cspPath.startsWith('./Vendor/MSFT/Policy/Result/')) resultCsp += 1; + else if (cspPath.startsWith('./Vendor/MSFT/Policy/Config/')) configCsp += 1; + else throw new Error(`${tag}: unexpected CSP path ${cspPath}`); + } + expect(schemas, `${tag} must have no legacy schema blocks`).toBe(0); + expect(expressions, tag).toBe(after.size); + expect(templates, tag).toBe(after.size); + // `Policy/Result` is the MDM-resultant path that fails to read on a + // standalone machine and is what this repair eliminates. The five + // remaining `Policy/Config` rules read back what was written and are the + // documented, reviewed residual in shipped WS2025. + expect(resultCsp, `${tag} must have no Policy/Result CSP rules left`).toBe(0); + expect(configCsp, `${tag} reviewed Policy/Config residual`).toBe(5); + } + }, + ); +}); + +describe('deterministic normalisers', () => { + it('adds the colon that the standalone registry provider requires', () => { + expect(normalizeKeyPath('HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa')).toBe( + 'HKEY_LOCAL_MACHINE:\\System\\CurrentControlSet\\Control\\Lsa', + ); + expect(normalizeKeyPath('HKLM\\SOFTWARE\\Policies')).toBe('HKLM:\\SOFTWARE\\Policies'); + }); + + it('leaves an already-normalised keyPath untouched (idempotent)', () => { + const normalized = 'HKEY_LOCAL_MACHINE:\\SYSTEM\\CurrentControlSet\\Services'; + expect(normalizeKeyPath(normalized)).toBe(normalized); + }); + + it('maps legacy value-type aliases onto the REG_* names WS2025 ships', () => { + expect(normalizeRegistryValueType('Dword')).toBe('REG_DWORD'); + expect(normalizeRegistryValueType('String')).toBe('REG_SZ'); + expect(normalizeRegistryValueType('MultiString')).toBe('REG_MULTI_SZ'); + expect(normalizeRegistryValueType('REG_BINARY')).toBe('REG_BINARY'); + }); + + it('classifies desired values the way the schema map is keyed', () => { + expect(valueKind(1)).toBe('number'); + expect(valueKind('1')).toBe('string'); + expect(valueKind([])).toBe('array'); + expect(valueKind(true)).toBe('boolean'); + }); + + it('renders informational, const, range and enum schemas in WS2025 CEL form', () => { + expect(translateSchema({}, 'number')).toEqual({ + expression: 'true', + template: 'The value {value} is informational for this control.', + }); + expect(translateSchema({ const: 0 }, 'number').expression).toBe('(value == 0)'); + expect(translateSchema({ minimum: 14 }, 'number').expression).toBe( + '(value != null && value >= 14)', + ); + expect(translateSchema({ minimum: 1, maximum: 70 }, 'number').expression).toBe( + '(value != null && value >= 1 && value <= 70)', + ); + }); + + it('refuses to guess at an unrecognised schema shape', () => { + expect(() => translateSchema({ multipleOf: 3 }, 'number')).toThrow(); + }); +}); + +describe('user-rights "unassigned" assertion', () => { + const EMPTY_OR_NULL = { oneOf: [{ const: '' }, { type: 'null' }] }; + const EXPECTED = 'value == null || value.size() == 0'; + + it('restates "empty string or not set" over a principal list', () => { + expect(translatePrincipalListSchema(EMPTY_OR_NULL, '', [])).toEqual({ + expression: EXPECTED, + template: 'The value {value} must be unassigned (no principals).', + source: 'principal-list-restatement', + }); + expect(translatePrincipalListSchema(EMPTY_OR_NULL, null, [])?.expression).toBe(EXPECTED); + }); + + it('declines anything it has not been given evidence for', () => { + expect(translatePrincipalListSchema({}, '', [])).toBe(null); + expect(translatePrincipalListSchema(EMPTY_OR_NULL, '', ['*S-1-5-32-544'])).toBe(null); + expect(translatePrincipalListSchema(EMPTY_OR_NULL, 'Administrators', [])).toBe(null); + expect(translatePrincipalListSchema({ const: '' }, '', [])).toBe(null); + expect(translatePrincipalListSchema({ oneOf: [{ const: 'x' }, { type: 'null' }] }, '', [])) + .toBe(null); + expect(translatePrincipalListSchema(null, '', [])).toBe(null); + }); + + it('passes for an unset or empty assignment and fails for any assigned principal', () => { + expect(evalCel(EXPECTED, null)).toBe(true); + expect(evalCel(EXPECTED, undefined)).toBe(true); + expect(evalCel(EXPECTED, [])).toBe(true); + expect(evalCel(EXPECTED, ['*S-1-5-32-544'])).toBe(false); + expect(evalCel(EXPECTED, ['*S-1-5-32-544', '*S-1-5-11'])).toBe(false); + }); + + it('short-circuits, so size() is never applied to a null value', () => { + expect(() => evalCel(EXPECTED, null)).not.toThrow(); + expect(() => evalCel('value.size() == 0', null)).toThrow(/size\(\) applied to a null/); + }); + + it('is never an informational downgrade in any profile report', () => { + const expected = { 'ws2022-domain-member': 7, 'ws2022-domain-controller': 6, 'ws2022-workgroup-member': 7 }; + for (const profile of conversionReport.profiles) { + const key = profile.profile.replace('.osc.yaml', ''); + expect(profile.assertionDowngrades, `${key} must have no downgrades left`).toEqual([]); + expect(profile.assertionRestatements.length, key).toBe(expected[key]); + for (const item of profile.assertionRestatements) { + expect(item.to, `${key}:${item.name}`).toBe(EXPECTED); + expect(item.from, `${key}:${item.name}`).toEqual(EMPTY_OR_NULL); + expect(item.name, `${key}:${item.name}`).toMatch(/^UserRights/); + } + } + }); + + it.runIf(evidenceAvailable)( + 'restates exactly the rules that were "empty or not set" in the pinned source', + () => { + for (const profile of conversionReport.profiles) { + const source = showAt(EVIDENCE.ws2022SourceCommit, profile.profile, REPO); + const src = byName(source); + const eligible = [...src.values()].filter((rule) => { + const schema = rule.properties?.schema; + const inner = rule.properties?.resource; + if (inner?.type !== CSP_TYPE) return false; + if (!String(inner.properties?.path ?? '').includes('/UserRights/')) return false; + return JSON.stringify(schema) === JSON.stringify(EMPTY_OR_NULL); + }).map((rule) => rule.name).sort(); + const restated = profile.assertionRestatements.map((item) => item.name).sort(); + expect(restated, profile.profile).toEqual(eligible); + for (const name of eligible) { + expect(src.get(name).properties?.resource?.properties?.value, name).toBe(''); + } + } + }, + ); +}); + +describe('conversion report', () => { + it('covers all three bundled WS2022 profiles', () => { + expect(conversionReport.profiles.map((p) => p.profile)).toEqual([...PROFILES]); + }); + + it('leaves no residual Policy CSP rule in any profile', () => { + for (const profile of conversionReport.profiles) { + expect(profile.residualCsp, profile.profile).toEqual([]); + expect(profile.convertedCsp, profile.profile).toBe(profile.sourceCsp); + } + }); + + it('reconciles every rule-count delta through a declared expansion', () => { + for (const profile of conversionReport.profiles) { + const extra = profile.expansions.reduce((sum, e) => sum + e.into.length - 1, 0); + expect(profile.sourceRules + extra, profile.profile).toBe(profile.outputRules); + } + }); + + it('pins the exact per-profile rule and provider counts', () => { + const expected = { + 'ws2022-domain-member.osc.yaml': { + sourceRules: 257, + outputRules: 259, + providerCounts: { + 'Microsoft.Windows/Registry': 184, + 'Microsoft.Windows/AuditPolicy': 26, + 'Microsoft.Windows/UserRightsAssignment': 36, + 'Microsoft.Windows/AccountPolicy': 13, + }, + }, + 'ws2022-domain-controller.osc.yaml': { + sourceRules: 242, + outputRules: 244, + providerCounts: { + 'Microsoft.Windows/Registry': 171, + 'Microsoft.Windows/AuditPolicy': 32, + 'Microsoft.Windows/UserRightsAssignment': 28, + 'Microsoft.Windows/AccountPolicy': 13, + }, + }, + 'ws2022-workgroup-member.osc.yaml': { + sourceRules: 200, + outputRules: 202, + providerCounts: { + 'Microsoft.Windows/Registry': 129, + 'Microsoft.Windows/AuditPolicy': 26, + 'Microsoft.Windows/UserRightsAssignment': 36, + 'Microsoft.Windows/AccountPolicy': 11, + }, + }, + }; + for (const profile of conversionReport.profiles) { + const want = expected[profile.profile]; + expect(want, profile.profile).toBeDefined(); + expect(profile.sourceRules, profile.profile).toBe(want.sourceRules); + expect(profile.outputRules, profile.profile).toBe(want.outputRules); + const total = Object.values(profile.providerCounts).reduce((a, b) => a + b, 0); + expect(total, profile.profile).toBe(profile.outputRules); + for (const [type, count] of Object.entries(want.providerCounts)) { + expect(profile.providerCounts[type], `${profile.profile}:${type}`).toBe(count); + } + } + }); + + it('justifies every registry shape repair with a WS2025 contract', () => { + for (const profile of conversionReport.profiles) { + for (const repair of profile.registryShapeRepairs) { + expect(repair.evidence, `${profile.profile}:${repair.name}`).toMatch(/^ws2025-/); + expect(repair.from.valueType).not.toBe(repair.to.valueType); + } + } + }); + + it('records the live smoke run as labelled, non-native evidence', () => { + const smoke = conversionReport._provenance.liveSmoke; + expect(smoke).toEqual(LIVE_SMOKE); + expect(smoke.profile).toBe('ws2022-workgroup-member.osc.yaml'); + expect(smoke.oscfgVersion).toBe('1.3.12-preview5'); + expect(smoke.shipped).toEqual({ compliant: 171, readErrors: 29 }); + expect(smoke.repaired).toEqual({ compliant: 200, nonCompliant: 2, readErrors: 0 }); + expect(smoke.host).toMatch(/Windows Server 2025/); + expect(smoke.host).toMatch(/not Windows Server 2022/); + expect(smoke.caveat).toMatch(/not.*native.*Windows Server 2022 validation/i); + const totals = smoke.repaired.compliant + smoke.repaired.nonCompliant + smoke.repaired.readErrors; + expect(totals, 'the smoke run must account for every rule in the profile').toBe(202); + }); +}); + +describe('--report is read-only', () => { + const watched = [ + path.join(REPO, 'public', '_baselines', 'ws2022-domain-member.osc.yaml'), + path.join(REPO, 'public', '_baselines', 'ws2022-domain-controller.osc.yaml'), + path.join(REPO, 'public', '_baselines', 'ws2022-workgroup-member.osc.yaml'), + path.join(HERE, 'conversion-report.json'), + path.join(HERE, 'csp-provider-map.json'), + path.join(HERE, 'schema-expression-map.json'), + ]; + const snapshot = () => watched.map((file) => { + const stat = statSync(file); + return { file, size: stat.size, mtimeMs: stat.mtimeMs, content: readFileSync(file, 'utf8') }; + }); + + it.runIf(evidenceAvailable)('prints a summary without touching a single file', () => { + const before = snapshot(); + const stdout = execFileSync(process.execPath, [SCRIPT, '--report'], { + cwd: REPO, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, + }); + const after = snapshot(); + + expect(stdout).toContain('--report is read-only: nothing was written.'); + expect(stdout).not.toContain('wrote:'); + for (const profile of PROFILES) expect(stdout).toContain(profile); + expect(stdout).toContain('assertion restatements'); + expect(stdout).toMatch(/restated: UserRights\w+ -> value == null \|\| value\.size\(\) == 0/); + + for (let i = 0; i < watched.length; i += 1) { + expect(after[i].content, `${watched[i]} content changed`).toBe(before[i].content); + expect(after[i].size, `${watched[i]} size changed`).toBe(before[i].size); + expect(after[i].mtimeMs, `${watched[i]} was rewritten`).toBe(before[i].mtimeMs); + } + }, 120_000); + + it.runIf(evidenceAvailable)('still writes when no mode flag is given', () => { + const before = snapshot(); + const stdout = execFileSync(process.execPath, [SCRIPT], { + cwd: REPO, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, + }); + const after = snapshot(); + expect(stdout).toContain('wrote:'); + for (let i = 0; i < 4; i += 1) { + expect(after[i].content, `${watched[i]} must be regenerated identically`) + .toBe(before[i].content); + } + }, 120_000); +}); diff --git a/scripts/ws2022-baseline-repair/schema-expression-map.json b/scripts/ws2022-baseline-repair/schema-expression-map.json new file mode 100644 index 0000000..6c3ed86 --- /dev/null +++ b/scripts/ws2022-baseline-repair/schema-expression-map.json @@ -0,0 +1,748 @@ +{ + "_provenance": { + "description": "Legacy JSON-Schema compliance shape -> CEL expression + human template, extracted from the reviewed WS2025 schema translation. Keyed by schema shape AND the kind of the desired value, because string-typed values use an int() coercion form.", + "schemaBeforeCommit": "50d469c3cf5e16729f1359538b10ef4bc0b6de78", + "schemaAfterCommit": "37ab26a74bd7a6aa7f6df9a6ecc0fba3a7521821", + "paths": [ + "public/_baselines/ws2025-workgroup-member.osc.yaml", + "public/_baselines/ws2025-member-server.osc.yaml", + "public/_baselines/ws2025-domain-controller.osc.yaml" + ], + "reachableFromOriginMain": true, + "regenerate": "node scripts/ws2022-baseline-repair/derive-maps.mjs" + }, + "entries": [ + { + "schema": { + "const": "1" + }, + "valueKind": "string", + "expression": "(value == \"1\")", + "template": "The value {value} must be \"1\".", + "evidence": [ + "SmartCardRemovalBehavior", + "WinVerityTrustSignatureValidationVulnerabilityMitigation1", + "WinVerityTrustSignatureValidationVulnerabilityMitigation2" + ] + }, + { + "schema": { + "const": 0 + }, + "valueKind": "absent", + "expression": "(value == 0)", + "template": "The value {value} must be 0.", + "evidence": [ + "EnabledNTPClient", + "ClearVirtualMemoryPageFile", + "SystemEnableSoftwareRestrictionPolicies" + ] + }, + { + "schema": { + "const": 0 + }, + "valueKind": "number", + "expression": "(value == 0)", + "template": "The value {value} must be 0.", + "evidence": [ + "NetBTNodeTypeConfiguration", + "ServerSPNTargetNameValidationLevel" + ] + }, + { + "schema": { + "enum": [ + 0, + 1, + 2, + 99, + 100 + ] + }, + "valueKind": "number", + "expression": "([0,1,2,99,100].exists(item, value == item))", + "template": "The value {value} must be one of [0,1,2,99,100].", + "evidence": [ + "DODownloadMode" + ] + }, + { + "schema": { + "enum": [ + 0, + 1 + ] + }, + "valueKind": "number", + "expression": "([0,1].exists(item, value == item))", + "template": "The value {value} must be one of [0,1].", + "evidence": [ + "DmaGuardDeviceEnumerationPolicy" + ] + }, + { + "schema": { + "enum": [ + 1, + 3 + ] + }, + "valueKind": "number", + "expression": "([1,3].exists(item, value == item))", + "template": "The value {value} must be one of [1,3].", + "evidence": [ + "AuditAuthenticationPolicyChange", + "AuditAuthorizationPolicyChange", + "AuditGroupMembership" + ] + }, + { + "schema": { + "enum": [ + 2, + 3 + ] + }, + "valueKind": "number", + "expression": "([2,3].exists(item, value == item))", + "template": "The value {value} must be one of [2,3].", + "evidence": [ + "AuditAccountLockout", + "AuditDetailedFileShare", + "AuditOtherPolicyChangeEvents" + ] + }, + { + "schema": { + "enum": [ + 2147483624, + 2147483632, + 2147483640 + ] + }, + "valueKind": "number", + "expression": "([2147483624,2147483632,2147483640].exists(item, value == item))", + "template": "The value {value} must be one of [2147483624,2147483632,2147483640].", + "evidence": [ + "CryptographyAllowedKerberosEncryptionTypes" + ] + }, + { + "schema": { + "enum": [ + 768, + 770, + 785 + ] + }, + "valueKind": "number", + "expression": "([768,770,785].exists(item, value == item))", + "template": "The value {value} must be one of [768,770,785].", + "evidence": [ + "MinimumSMBClientVersion", + "MinimumSMBServerVersion" + ] + }, + { + "schema": { + "minimum": 0, + "maximum": 1 + }, + "valueKind": "number", + "expression": "(value != null && value >= 0 && value <= 1)", + "template": "The value {value} must be between 0 and 1.", + "evidence": [ + "BlockNTLM", + "RequireEncryption", + "SystemAllowTelemetry" + ] + }, + { + "schema": { + "minimum": 0, + "maximum": 4 + }, + "valueKind": "string", + "expression": "(value != null && value.matches(\"^-?[0-9]+$\") && int(value) >= 0 && int(value) <= 4)", + "template": "The value {value} must be between 0 and 4.", + "evidence": [ + "SystemLogonCacheSize" + ] + }, + { + "schema": { + "minimum": 0 + }, + "valueKind": "number", + "expression": "(value != null && value >= 0)", + "template": "The value {value} must be greater than or equal to 0.", + "evidence": [ + "AuditDirectoryServiceReplication" + ] + }, + { + "schema": { + "minimum": 1, + "maximum": 15 + }, + "valueKind": "number", + "expression": "(value != null && value >= 1 && value <= 15)", + "template": "The value {value} must be between 1 and 15.", + "evidence": [ + "AmountOfIdleTimeRequiredBeforeSuspendingSession" + ] + }, + { + "schema": { + "minimum": 1, + "maximum": 2 + }, + "valueKind": "number", + "expression": "(value != null && value >= 1 && value <= 2)", + "template": "The value {value} must be between 1 and 2.", + "evidence": [ + "BehaviorOfTheElevationPromptForAdministrators", + "ConfigureKernelShadowStacksLaunch", + "DeviceGuardLsaCfgFlags" + ] + }, + { + "schema": { + "minimum": 1, + "maximum": 60 + }, + "valueKind": "number", + "expression": "(value != null && value >= 1 && value <= 60)", + "template": "The value {value} must be between 1 and 60.", + "evidence": [ + "DeviceLockMaximumPasswordAge" + ] + }, + { + "schema": { + "minimum": 1, + "maximum": 70 + }, + "valueKind": "number", + "expression": "(value != null && value >= 1 && value <= 70)", + "template": "The value {value} must be between 1 and 70.", + "evidence": [ + "DeviceLockMaximumPasswordAge" + ] + }, + { + "schema": { + "minimum": 1, + "maximum": 900 + }, + "valueKind": "number", + "expression": "(value != null && value >= 1 && value <= 900)", + "template": "The value {value} must be between 1 and 900.", + "evidence": [ + "MachineInactivityLimit" + ] + }, + { + "schema": { + "minimum": 1 + }, + "valueKind": "number", + "expression": "(value != null && value >= 1)", + "template": "The value {value} must be greater than or equal to 1.", + "evidence": [ + "DeviceLockMinimumPasswordAge" + ] + }, + { + "schema": { + "minimum": 14 + }, + "valueKind": "number", + "expression": "(value != null && value >= 14)", + "template": "The value {value} must be greater than or equal to 14.", + "evidence": [ + "DeviceLockMinimumPasswordLength" + ] + }, + { + "schema": { + "minimum": 16384 + }, + "valueKind": "number", + "expression": "(value != null && value >= 16384)", + "template": "The value {value} must be greater than or equal to 16384.", + "evidence": [ + "FirewallPrivateProfileLogFileMaxSize", + "FirewallPublicProfileLogFileMaxSize", + "FirewallDomainProfileLogFileMaxSize" + ] + }, + { + "schema": { + "minimum": 196608 + }, + "valueKind": "number", + "expression": "(value != null && value >= 196608)", + "template": "The value {value} must be greater than or equal to 196608.", + "evidence": [ + "EventLogServiceSpecifyMaximumFileSizeSecurityLog" + ] + }, + { + "schema": { + "minimum": 2000, + "maximum": 5000 + }, + "valueKind": "number", + "expression": "(value != null && value >= 2000 && value <= 5000)", + "template": "The value {value} must be between 2000 and 5000.", + "evidence": [ + "EnableAuthRateLimiterTimeout" + ] + }, + { + "schema": { + "minimum": 3, + "maximum": 4 + }, + "valueKind": "number", + "expression": "(value != null && value >= 3 && value <= 4)", + "template": "The value {value} must be between 3 and 4.", + "evidence": [ + "RemoteDesktopServicesClientConnectionEncryptionLevel" + ] + }, + { + "schema": { + "minimum": 32768 + }, + "valueKind": "number", + "expression": "(value != null && value >= 32768)", + "template": "The value {value} must be greater than or equal to 32768.", + "evidence": [ + "EventLogChannelSetupLogMaxSize", + "EventLogServiceSpecifyMaximumFileSizeApplicationLog", + "EventLogServiceSpecifyMaximumFileSizeSystemLog" + ] + }, + { + "schema": { + "minimum": 5, + "maximum": 14 + }, + "valueKind": "number", + "expression": "(value != null && value >= 5 && value <= 14)", + "template": "The value {value} must be between 5 and 14.", + "evidence": [ + "PromptUserToChangePasswordBeforeExpiration" + ] + }, + { + "schema": { + "minimum": 50, + "maximum": 90 + }, + "valueKind": "number", + "expression": "(value != null && value >= 50 && value <= 90)", + "template": "The value {value} must be between 50 and 90.", + "evidence": [ + "EventLogPercentageThresholdSecurityEventLogMaximumSizeReached" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": "*" + }, + { + "type": "null" + } + ] + }, + "valueKind": "string", + "expression": "((((value == \"*\")) || ((value == null))))", + "template": "The value {value} must be one of \"*\", (not set).", + "evidence": [ + "RemoteManagementAllowRemoteServerManagement_IPv4Filter", + "RemoteManagementAllowRemoteServerManagement_IPv6Filter" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": "1.2" + }, + { + "type": "null" + } + ] + }, + "valueKind": "string", + "expression": "((((value == \"1.2\")) || ((value == null))))", + "template": "The value {value} must be one of \"1.2\", (not set).", + "evidence": [ + "OverrideMinimumEnabledDTLSVersionClient", + "OverrideMinimumEnabledDTLSVersionServer" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": "1000000000000" + }, + { + "type": "null" + } + ] + }, + "valueKind": "string", + "expression": "((((value == \"1000000000000\")) || ((value == null))))", + "template": "The value {value} must be one of \"1000000000000\", (not set).", + "evidence": [ + "MitigationOptionsFontBlocking" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": "Block" + }, + { + "type": "null" + } + ] + }, + "valueKind": "string", + "expression": "((((value == \"Block\")) || ((value == null))))", + "template": "The value {value} must be one of \"Block\", (not set).", + "evidence": [ + "SmartScreenPreventOverrideForFilesInShell" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": "MDA=" + }, + { + "type": "null" + } + ] + }, + "valueKind": "string", + "expression": "[\"MDA=\",\"AA==\"].exists(item, value == item)", + "template": "The value {value} must represent disabled backup and restore privilege auditing.", + "evidence": [ + "AuditBackupAndRestorePrivilege" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": 0 + }, + { + "type": "null" + } + ] + }, + "valueKind": "number", + "expression": "((((value == 0)) || ((value == null))))", + "template": "The value {value} must be one of 0, (not set).", + "evidence": [ + "AllowICMPRedirectsToOverrideOSPFGeneratedRoutes", + "AllowUIAccessApplicationsToPromptForElevation", + "BehaviorOfTheElevationPromptForStandardUsers" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": 1 + }, + { + "type": "null" + } + ] + }, + "valueKind": "number", + "expression": "((((value == 1)) || ((value == null))))", + "template": "The value {value} must be one of 1, (not set).", + "evidence": [ + "AfdDisableAddressSharing", + "AllowCustomSSPAPIntoLSASS", + "AllowLocalSystemToUseComputerIdentityForNTLM" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": 2 + }, + { + "type": "null" + } + ] + }, + "valueKind": "number", + "expression": "((((value == 2)) || ((value == null))))", + "template": "The value {value} must be one of 2, (not set).", + "evidence": [ + "ApplicationIdentityStartupType", + "CryptographyForceStrongKeyProtection", + "IPSourceRoutingProtectionLevel" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": 24 + }, + { + "type": "null" + } + ] + }, + "valueKind": "number", + "expression": "((((value == 24)) || ((value == null))))", + "template": "The value {value} must be one of 24, (not set).", + "evidence": [ + "DeviceLockPasswordHistorySize" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": 255 + }, + { + "type": "null" + } + ] + }, + "valueKind": "number", + "expression": "((((value == 255)) || ((value == null))))", + "template": "The value {value} must be one of 255, (not set).", + "evidence": [ + "AutoplayTurnOffAutoPlay" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": 3 + }, + { + "type": "null" + } + ] + }, + "valueKind": "number", + "expression": "((((value == 3)) || ((value == null))))", + "template": "The value {value} must be one of 3, (not set).", + "evidence": [ + "AuditCredentialValidation", + "AuditFileShare", + "AuditIPsecDriver" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": 30 + }, + { + "type": "null" + } + ] + }, + "valueKind": "number", + "expression": "((((value == 30)) || ((value == null))))", + "template": "The value {value} must be one of 30, (not set).", + "evidence": [ + "MaximumMachineAccountPasswordAge" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": 3389 + }, + { + "type": "null" + } + ] + }, + "valueKind": "number", + "expression": "((((value == 3389)) || ((value == null))))", + "template": "The value {value} must be one of 3389, (not set).", + "evidence": [ + "RDPPortNumber" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": 4 + }, + { + "type": "null" + } + ] + }, + "valueKind": "number", + "expression": "((((value == 4)) || ((value == null))))", + "template": "The value {value} must be one of 4, (not set).", + "evidence": [ + "ConfigureSMBV1ClientDriver", + "SystemWindowsSearchService" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": 5 + }, + { + "type": "null" + } + ] + }, + "valueKind": "number", + "expression": "((((value == 5)) || ((value == null))))", + "template": "The value {value} must be one of 5, (not set).", + "evidence": [ + "LANManagerAuthenticationLevel" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": 537395200 + }, + { + "type": "null" + } + ] + }, + "valueKind": "number", + "expression": "((((value == 537395200)) || ((value == null))))", + "template": "The value {value} must be one of 537395200, (not set).", + "evidence": [ + "MinimumSessionSecurityForNTLMSSPBasedClients", + "MinimumSessionSecurityForNTLMSSPBasedServers" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": false + }, + { + "type": "null" + } + ] + }, + "valueKind": "boolean", + "expression": "((((value == false)) || ((value == null))))", + "template": "The value {value} must be one of false, (not set).", + "evidence": [ + "AllowAnonymousSIDOrNameTranslation", + "DeviceLockClearTextPassword", + "EnableGuestAccountStatus" + ] + }, + { + "schema": { + "oneOf": [ + { + "const": true + }, + { + "type": "null" + } + ] + }, + "valueKind": "boolean", + "expression": "((((value == true)) || ((value == null))))", + "template": "The value {value} must be one of true, (not set).", + "evidence": [ + "DeviceLockPasswordComplexity" + ] + }, + { + "schema": { + "pattern": ".log" + }, + "valueKind": "string", + "expression": "(value != null && value.matches(\".log\"))", + "template": "The value {value} must match the pattern \".log\".", + "evidence": [ + "FirewallPrivateProfileLogFileName", + "FirewallPublicProfileLogFileName", + "FirewallDomainProfileLogFileName" + ] + }, + { + "schema": {}, + "valueKind": "absent", + "expression": "true", + "template": "The value {value} is informational for this control.", + "evidence": [ + "RenameAdministratorAccount", + "RenameGuestAccount" + ] + }, + { + "schema": {}, + "valueKind": "array", + "expression": "true", + "template": "The value {value} is informational for this control.", + "evidence": [ + "BlockNTLMServerExceptionList", + "CryptographyEccCurve", + "DisableSMBv1Client" + ] + }, + { + "schema": {}, + "valueKind": "number", + "expression": "true", + "template": "The value {value} is informational for this control.", + "evidence": [ + "AllowLocalSystemNULLSessionFallback", + "AllowSystemToBeShutDownWithoutHavingToLogOn", + "ApplicationManagementMSIAllowUserControlOverInstall" + ] + }, + { + "schema": {}, + "valueKind": "string", + "expression": "true", + "template": "The value {value} is informational for this control.", + "evidence": [ + "AllowedToFormatAndEjectRemovableMedia", + "CryptographySSLCipherSuites", + "EventLogChannelSecurityLogRetention" + ] + } + ] +}