From ae91a50fb6c5cf562e5f9b9ac4d28e76eb1e15d1 Mon Sep 17 00:00:00 2001 From: Amir Bredy Date: Sun, 9 Aug 2026 20:19:55 -0700 Subject: [PATCH 1/2] fix(baselines): make Windows profiles enforceable Use safe Test wrappers for legacy account-policy and value-less controls, accept effective firewall defaults, and treat role-managed NTP state as informational. The full 12-baseline Azure Machine Configuration matrix passes Audit and ApplyAndAutoCorrect with OSConfig 1.4.3. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 48993ee6-f068-4c4a-b317-2cd940fab804 --- .../windows-baseline-enforceability.test.ts | 126 +++++++++ .../ws2016-domain-controller.osc.yaml | 263 ++++++++++++------ .../_baselines/ws2016-domain-member.osc.yaml | 261 +++++++++++------ .../ws2016-workgroup-member.osc.yaml | 120 +++++--- .../ws2019-domain-controller.osc.yaml | 263 ++++++++++++------ .../_baselines/ws2019-domain-member.osc.yaml | 261 +++++++++++------ .../ws2019-workgroup-member.osc.yaml | 120 +++++--- .../ws2022-domain-controller.osc.yaml | 12 +- .../_baselines/ws2022-domain-member.osc.yaml | 12 +- .../ws2025-domain-controller.osc.yaml | 4 +- .../_baselines/ws2025-member-server.osc.yaml | 4 +- 11 files changed, 996 insertions(+), 450 deletions(-) create mode 100644 apps/desktop/src/data/windows-baseline-enforceability.test.ts diff --git a/apps/desktop/src/data/windows-baseline-enforceability.test.ts b/apps/desktop/src/data/windows-baseline-enforceability.test.ts new file mode 100644 index 0000000..11acaea --- /dev/null +++ b/apps/desktop/src/data/windows-baseline-enforceability.test.ts @@ -0,0 +1,126 @@ +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. + +import { describe, expect, it } from "vitest"; +import { readFileSync } from "node:fs"; +import path from "node:path"; +import { fileURLToPath } from "node:url"; +import yaml from "js-yaml"; + +interface OscResource { + name: string; + type: string; + properties?: { + value?: unknown; + expression?: string; + template?: string; + resource?: { + type?: string; + properties?: Record; + }; + }; +} + +const HERE = path.dirname(fileURLToPath(import.meta.url)); +const BASELINE_DIR = path.resolve(HERE, "../../../../public/_baselines"); +const LEGACY_PROFILES = [ + ["ws2016-domain-controller.osc.yaml", 13], + ["ws2016-domain-member.osc.yaml", 13], + ["ws2016-workgroup-member.osc.yaml", 9], + ["ws2019-domain-controller.osc.yaml", 13], + ["ws2019-domain-member.osc.yaml", 13], + ["ws2019-workgroup-member.osc.yaml", 9], +] as const; +const WINDOWS_PROFILES = [ + ...LEGACY_PROFILES.map(([file]) => file), + "ws2022-domain-controller.osc.yaml", + "ws2022-domain-member.osc.yaml", + "ws2022-workgroup-member.osc.yaml", + "ws2025-domain-controller.osc.yaml", + "ws2025-member-server.osc.yaml", + "ws2025-workgroup-member.osc.yaml", +]; +const INFORMATIONAL_TEMPLATE = + "The value {value} is informational for this control."; +const FIREWALL_DEFAULT_EXPRESSION = + "((((value == 1)) || ((value == null))))"; +const FIREWALL_DEFAULT_TEMPLATE = + "The value {value} must be one of 1, (not set)."; + +function readResources(file: string): OscResource[] { + const document = yaml.load( + readFileSync(path.join(BASELINE_DIR, file), "utf8"), + ) as { resources?: OscResource[] }; + return document.resources ?? []; +} + +function findResource(resources: OscResource[], name: string): OscResource { + const resource = resources.find((candidate) => candidate.name === name); + expect(resource, name).toBeDefined(); + return resource!; +} + +describe("Windows baseline enforceability", () => { + it.each(WINDOWS_PROFILES)( + "%s has no direct AccountPolicy or null-valued direct resources", + (file) => { + const resources = readResources(file); + expect( + resources.filter( + (resource) => resource.type === "Microsoft.Windows/AccountPolicy", + ), + ).toEqual([]); + expect( + resources.filter( + (resource) => + resource.type !== "Microsoft.OSConfig/Test" && + resource.type !== "Microsoft.OSConfig/Group" && + resource.properties !== undefined && + Object.hasOwn(resource.properties, "value") && + resource.properties.value === null, + ), + ).toEqual([]); + }, + ); + + it.each(LEGACY_PROFILES)( + "%s wraps all %i account-policy controls as Tests", + (file, expectedCount) => { + const resources = readResources(file); + const accountPolicyTests = resources.filter( + (resource) => + resource.type === "Microsoft.OSConfig/Test" && + resource.properties?.resource?.type === + "Microsoft.Windows/AccountPolicy", + ); + expect(accountPolicyTests).toHaveLength(expectedCount); + }, + ); + + it.each([ + "ws2022-domain-controller.osc.yaml", + "ws2022-domain-member.osc.yaml", + ])("%s accepts the effective default firewall inbound action", (file) => { + const resources = readResources(file); + for (const name of [ + "FirewallDomainProfileInboundConnection", + "FirewallPrivateProfileInboundConnection", + "FirewallPublicProfileInboundConnection", + ]) { + const resource = findResource(resources, name); + expect(resource.properties?.expression).toBe( + FIREWALL_DEFAULT_EXPRESSION, + ); + expect(resource.properties?.template).toBe(FIREWALL_DEFAULT_TEMPLATE); + } + }); + + it.each([ + "ws2025-domain-controller.osc.yaml", + "ws2025-member-server.osc.yaml", + ])("%s treats role-managed NTP client state as informational", (file) => { + const resource = findResource(readResources(file), "EnabledNTPClient"); + expect(resource.properties?.expression).toBe("true"); + expect(resource.properties?.template).toBe(INFORMATIONAL_TEMPLATE); + }); +}); diff --git a/public/_baselines/ws2016-domain-controller.osc.yaml b/public/_baselines/ws2016-domain-controller.osc.yaml index 1258d1e..b1ffa56 100644 --- a/public/_baselines/ws2016-domain-controller.osc.yaml +++ b/public/_baselines/ws2016-domain-controller.osc.yaml @@ -947,11 +947,16 @@ resources: properties: name: SeTrustedCredManAccessPrivilege value: [] - - name: "Accounts: Guest account status" - type: Microsoft.Windows/AccountPolicy - properties: - name: EnableGuestAccount - value: false + - name: 'Accounts: Guest account status' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnableGuestAccount + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: Act as part of the operating system type: Microsoft.Windows/UserRightsAssignment properties: @@ -1008,10 +1013,15 @@ resources: value: - "*S-1-5-32-546" - name: Enforce password history - type: Microsoft.Windows/AccountPolicy - properties: - name: PasswordHistoryLength - value: 24 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: PasswordHistoryLength + value: 24 + expression: (value != null && value >= 24) + template: The value {value} must be greater than or equal to 24. - name: Force shutdown from a remote system type: Microsoft.Windows/UserRightsAssignment properties: @@ -1045,20 +1055,35 @@ resources: name: SeLockMemoryPrivilege value: [] - name: Maximum password age - type: Microsoft.Windows/AccountPolicy - properties: - name: MaximumPasswordAge - value: 42 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MaximumPasswordAge + value: 42 + expression: (value != null && value >= 1 && value <= 70) + template: The value {value} must be between 1 and 70. - name: Minimum password age - type: Microsoft.Windows/AccountPolicy - properties: - name: MinimumPasswordAge - value: 1 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MinimumPasswordAge + value: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: Minimum password length - type: Microsoft.Windows/AccountPolicy - properties: - name: MinimumPasswordLength - value: 14 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MinimumPasswordLength + value: 14 + expression: (value != null && value >= 14) + template: The value {value} must be greater than or equal to 14. - name: Modify an object label type: Microsoft.Windows/UserRightsAssignment properties: @@ -1071,10 +1096,15 @@ resources: value: - "*S-1-5-32-544" - name: Password must meet complexity requirements - type: Microsoft.Windows/AccountPolicy - properties: - name: EnforcePasswordComplexity - value: true + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnforcePasswordComplexity + value: true + expression: ((((value == true)) || ((value == null)))) + template: The value {value} must be one of true, (not set). - name: Perform volume maintenance tasks type: Microsoft.Windows/UserRightsAssignment properties: @@ -1109,10 +1139,15 @@ resources: - "*S-1-5-32-544" - "*S-1-5-32-551" - name: Store passwords using reversible encryption - type: Microsoft.Windows/AccountPolicy - properties: - name: EnablePasswordReversibleEncryption - value: false + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnablePasswordReversibleEncryption + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: Take ownership of files or other objects type: Microsoft.Windows/UserRightsAssignment properties: @@ -1259,15 +1294,25 @@ resources: valueType: Dword value: 1 - name: Reset account lockout counter after - type: Microsoft.Windows/AccountPolicy - properties: - name: LockoutReset - value: 15 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutReset + value: 15 + expression: 'true' + template: The value {value} is informational for this control. - name: Account lockout threshold - type: Microsoft.Windows/AccountPolicy - properties: - name: LockoutThreshold - value: 3 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutThreshold + value: 3 + expression: 'true' + template: The value {value} is informational for this control. - name: Turn on PowerShell Script Block Logging type: Microsoft.Windows/Registry properties: @@ -1338,11 +1383,15 @@ resources: valueName: NoConnectedUser valueType: Dword value: 3 - - name: "Accounts: Rename administrator account" - type: Microsoft.Windows/AccountPolicy - properties: - name: AdministratorAccountName - value: + - name: 'Accounts: Rename administrator account' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: AdministratorAccountName + expression: 'true' + template: The value {value} is informational for this control. - name: "Interactive logon: Prompt user to change password before expiration" type: Microsoft.Windows/Registry properties: @@ -1350,11 +1399,16 @@ resources: valueName: PasswordExpiryWarning valueType: Dword value: 14 - - name: "Network access: Allow anonymous SID/Name translation" - type: Microsoft.Windows/AccountPolicy - properties: - name: EnableAnonymousNameTranslation - value: false + - name: 'Network access: Allow anonymous SID/Name translation' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnableAnonymousNameTranslation + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: Limits print driver installation to Administrators type: Microsoft.Windows/Registry properties: @@ -1544,20 +1598,28 @@ resources: valueName: LogSuccessfulConnections valueType: Dword value: 1 - - name: "Windows Firewall: Private: Inbound connections" - type: Microsoft.Windows/Registry - properties: - keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile - valueName: DefaultInboundAction - valueType: Dword - value: - - name: "Windows Firewall: Domain: Inbound connections" - type: Microsoft.Windows/Registry - properties: - keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile - valueName: DefaultInboundAction - valueType: Dword - value: + - name: 'Windows Firewall: Private: Inbound connections' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + valueName: DefaultInboundAction + valueType: Dword + expression: 'true' + template: The value {value} is informational for this control. + - name: 'Windows Firewall: Domain: Inbound connections' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + valueName: DefaultInboundAction + valueType: Dword + expression: 'true' + template: The value {value} is informational for this control. - name: "Windows Firewall: Private: Logging: Name" type: Microsoft.Windows/Registry properties: @@ -1593,13 +1655,17 @@ resources: valueName: LogSuccessfulConnections valueType: Dword value: 1 - - name: "Windows Firewall: Public: Inbound connections" - type: Microsoft.Windows/Registry + - name: 'Windows Firewall: Public: Inbound connections' + type: Microsoft.OSConfig/Test properties: - keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile - valueName: DefaultInboundAction - valueType: Dword - value: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + valueName: DefaultInboundAction + valueType: Dword + expression: 'true' + template: The value {value} is informational for this control. - name: "Windows Firewall: Public: Logging: Name" type: Microsoft.Windows/Registry properties: @@ -1622,10 +1688,15 @@ resources: valueType: Dword value: 1 - name: Account Lockout Duration - type: Microsoft.Windows/AccountPolicy - properties: - name: LockoutDuration - value: 15 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutDuration + value: 15 + expression: 'true' + template: The value {value} is informational for this control. - name: "MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)" type: Microsoft.Windows/Registry properties: @@ -1640,22 +1711,34 @@ resources: valueName: PreventDeviceMetadataFromNetwork valueType: Dword value: 1 - - name: "Interactive logon: Message text for users attempting to log on" - type: Microsoft.Windows/Registry - properties: - keyPath: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System - valueName: LegalNoticeText - valueType: String - value: - - name: "Interactive logon: Message title for users attempting to log on" - type: Microsoft.Windows/Registry - properties: - keyPath: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System - valueName: LegalNoticeCaption - valueType: String - value: - - name: "Accounts: Rename guest account" - type: Microsoft.Windows/AccountPolicy - properties: - name: GuestAccountName - value: + - name: 'Interactive logon: Message text for users attempting to log on' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + valueName: LegalNoticeText + valueType: String + expression: 'true' + template: The value {value} is informational for this control. + - name: 'Interactive logon: Message title for users attempting to log on' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + valueName: LegalNoticeCaption + valueType: String + expression: 'true' + template: The value {value} is informational for this control. + - name: 'Accounts: Rename guest account' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: GuestAccountName + expression: 'true' + template: The value {value} is informational for this control. diff --git a/public/_baselines/ws2016-domain-member.osc.yaml b/public/_baselines/ws2016-domain-member.osc.yaml index cfee5ba..9a50a47 100644 --- a/public/_baselines/ws2016-domain-member.osc.yaml +++ b/public/_baselines/ws2016-domain-member.osc.yaml @@ -1049,11 +1049,16 @@ resources: properties: name: SeTrustedCredManAccessPrivilege value: [] - - name: "Accounts: Guest account status" - type: Microsoft.Windows/AccountPolicy - properties: - name: EnableGuestAccount - value: false + - name: 'Accounts: Guest account status' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnableGuestAccount + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: Act as part of the operating system type: Microsoft.Windows/UserRightsAssignment properties: @@ -1126,10 +1131,15 @@ resources: value: - "*S-1-5-32-546" - name: Enforce password history - type: Microsoft.Windows/AccountPolicy - properties: - name: PasswordHistoryLength - value: 24 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: PasswordHistoryLength + value: 24 + expression: (value != null && value >= 24) + template: The value {value} must be greater than or equal to 24. - name: Force shutdown from a remote system type: Microsoft.Windows/UserRightsAssignment properties: @@ -1163,20 +1173,35 @@ resources: name: SeLockMemoryPrivilege value: [] - name: Maximum password age - type: Microsoft.Windows/AccountPolicy - properties: - name: MaximumPasswordAge - value: 42 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MaximumPasswordAge + value: 42 + expression: (value != null && value >= 1 && value <= 70) + template: The value {value} must be between 1 and 70. - name: Minimum password age - type: Microsoft.Windows/AccountPolicy - properties: - name: MinimumPasswordAge - value: 1 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MinimumPasswordAge + value: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: Minimum password length - type: Microsoft.Windows/AccountPolicy - properties: - name: MinimumPasswordLength - value: 14 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MinimumPasswordLength + value: 14 + expression: (value != null && value >= 14) + template: The value {value} must be greater than or equal to 14. - name: Modify an object label type: Microsoft.Windows/UserRightsAssignment properties: @@ -1189,10 +1214,15 @@ resources: value: - "*S-1-5-32-544" - name: Password must meet complexity requirements - type: Microsoft.Windows/AccountPolicy - properties: - name: EnforcePasswordComplexity - value: true + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnforcePasswordComplexity + value: true + expression: ((((value == true)) || ((value == null)))) + template: The value {value} must be one of true, (not set). - name: Perform volume maintenance tasks type: Microsoft.Windows/UserRightsAssignment properties: @@ -1234,10 +1264,15 @@ resources: - "*S-1-5-32-544" - "*S-1-5-32-551" - name: Store passwords using reversible encryption - type: Microsoft.Windows/AccountPolicy - properties: - name: EnablePasswordReversibleEncryption - value: false + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnablePasswordReversibleEncryption + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: Take ownership of files or other objects type: Microsoft.Windows/UserRightsAssignment properties: @@ -1375,15 +1410,25 @@ resources: valueType: Dword value: 1 - name: Reset account lockout counter after - type: Microsoft.Windows/AccountPolicy - properties: - name: LockoutReset - value: 15 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutReset + value: 15 + expression: 'true' + template: The value {value} is informational for this control. - name: Account lockout threshold - type: Microsoft.Windows/AccountPolicy - properties: - name: LockoutThreshold - value: 3 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutThreshold + value: 3 + expression: 'true' + template: The value {value} is informational for this control. - name: Turn on PowerShell Script Block Logging type: Microsoft.Windows/Registry properties: @@ -1454,11 +1499,15 @@ resources: valueName: NoConnectedUser valueType: Dword value: 3 - - name: "Accounts: Rename administrator account" - type: Microsoft.Windows/AccountPolicy - properties: - name: AdministratorAccountName - value: + - name: 'Accounts: Rename administrator account' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: AdministratorAccountName + expression: 'true' + template: The value {value} is informational for this control. - name: "Interactive logon: Prompt user to change password before expiration" type: Microsoft.Windows/Registry properties: @@ -1473,11 +1522,16 @@ resources: valueName: SMBServerNameHardeningLevel valueType: Dword value: 1 - - name: "Network access: Allow anonymous SID/Name translation" - type: Microsoft.Windows/AccountPolicy + - name: 'Network access: Allow anonymous SID/Name translation' + type: Microsoft.OSConfig/Test properties: - name: EnableAnonymousNameTranslation - value: false + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnableAnonymousNameTranslation + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: Limits print driver installation to Administrators type: Microsoft.Windows/Registry properties: @@ -1674,20 +1728,28 @@ resources: valueName: LogSuccessfulConnections valueType: Dword value: 1 - - name: "Windows Firewall: Private: Inbound connections" - type: Microsoft.Windows/Registry - properties: - keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile - valueName: DefaultInboundAction - valueType: Dword - value: - - name: "Windows Firewall: Domain: Inbound connections" - type: Microsoft.Windows/Registry - properties: - keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile - valueName: DefaultInboundAction - valueType: Dword - value: + - name: 'Windows Firewall: Private: Inbound connections' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + valueName: DefaultInboundAction + valueType: Dword + expression: 'true' + template: The value {value} is informational for this control. + - name: 'Windows Firewall: Domain: Inbound connections' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + valueName: DefaultInboundAction + valueType: Dword + expression: 'true' + template: The value {value} is informational for this control. - name: "Windows Firewall: Private: Logging: Name" type: Microsoft.Windows/Registry properties: @@ -1723,13 +1785,17 @@ resources: valueName: LogSuccessfulConnections valueType: Dword value: 1 - - name: "Windows Firewall: Public: Inbound connections" - type: Microsoft.Windows/Registry + - name: 'Windows Firewall: Public: Inbound connections' + type: Microsoft.OSConfig/Test properties: - keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile - valueName: DefaultInboundAction - valueType: Dword - value: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + valueName: DefaultInboundAction + valueType: Dword + expression: 'true' + template: The value {value} is informational for this control. - name: "Windows Firewall: Public: Logging: Name" type: Microsoft.Windows/Registry properties: @@ -1752,10 +1818,15 @@ resources: valueType: Dword value: 1 - name: Account Lockout Duration - type: Microsoft.Windows/AccountPolicy - properties: - name: LockoutDuration - value: 15 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutDuration + value: 15 + expression: 'true' + template: The value {value} is informational for this control. - name: "MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)" type: Microsoft.Windows/Registry properties: @@ -1770,22 +1841,34 @@ resources: valueName: PreventDeviceMetadataFromNetwork valueType: Dword value: 1 - - name: "Interactive logon: Message text for users attempting to log on" - type: Microsoft.Windows/Registry - properties: - keyPath: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System - valueName: LegalNoticeText - valueType: String - value: - - name: "Interactive logon: Message title for users attempting to log on" - type: Microsoft.Windows/Registry - properties: - keyPath: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System - valueName: LegalNoticeCaption - valueType: String - value: - - name: "Accounts: Rename guest account" - type: Microsoft.Windows/AccountPolicy - properties: - name: GuestAccountName - value: + - name: 'Interactive logon: Message text for users attempting to log on' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + valueName: LegalNoticeText + valueType: String + expression: 'true' + template: The value {value} is informational for this control. + - name: 'Interactive logon: Message title for users attempting to log on' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + valueName: LegalNoticeCaption + valueType: String + expression: 'true' + template: The value {value} is informational for this control. + - name: 'Accounts: Rename guest account' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: GuestAccountName + expression: 'true' + template: The value {value} is informational for this control. diff --git a/public/_baselines/ws2016-workgroup-member.osc.yaml b/public/_baselines/ws2016-workgroup-member.osc.yaml index 00a074a..f56052d 100644 --- a/public/_baselines/ws2016-workgroup-member.osc.yaml +++ b/public/_baselines/ws2016-workgroup-member.osc.yaml @@ -1014,11 +1014,16 @@ resources: properties: name: SeTrustedCredManAccessPrivilege value: [] - - name: "Accounts: Guest account status" - type: Microsoft.Windows/AccountPolicy - properties: - name: EnableGuestAccount - value: false + - name: 'Accounts: Guest account status' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnableGuestAccount + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: Act as part of the operating system type: Microsoft.Windows/UserRightsAssignment properties: @@ -1097,10 +1102,15 @@ resources: value: - "*S-1-5-32-546" - name: Enforce password history - type: Microsoft.Windows/AccountPolicy - properties: - name: PasswordHistoryLength - value: 24 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: PasswordHistoryLength + value: 24 + expression: (value != null && value >= 24) + template: The value {value} must be greater than or equal to 24. - name: Force shutdown from a remote system type: Microsoft.Windows/UserRightsAssignment properties: @@ -1134,20 +1144,35 @@ resources: name: SeLockMemoryPrivilege value: [] - name: Maximum password age - type: Microsoft.Windows/AccountPolicy - properties: - name: MaximumPasswordAge - value: 42 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MaximumPasswordAge + value: 42 + expression: (value != null && value >= 1 && value <= 70) + template: The value {value} must be between 1 and 70. - name: Minimum password age - type: Microsoft.Windows/AccountPolicy - properties: - name: MinimumPasswordAge - value: 1 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MinimumPasswordAge + value: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: Minimum password length - type: Microsoft.Windows/AccountPolicy - properties: - name: MinimumPasswordLength - value: 14 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MinimumPasswordLength + value: 14 + expression: (value != null && value >= 14) + template: The value {value} must be greater than or equal to 14. - name: Modify an object label type: Microsoft.Windows/UserRightsAssignment properties: @@ -1160,10 +1185,15 @@ resources: value: - "*S-1-5-32-544" - name: Password must meet complexity requirements - type: Microsoft.Windows/AccountPolicy - properties: - name: EnforcePasswordComplexity - value: true + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnforcePasswordComplexity + value: true + expression: ((((value == true)) || ((value == null)))) + template: The value {value} must be one of true, (not set). - name: Perform volume maintenance tasks type: Microsoft.Windows/UserRightsAssignment properties: @@ -1205,10 +1235,15 @@ resources: - "*S-1-5-32-544" - "*S-1-5-32-551" - name: Store passwords using reversible encryption - type: Microsoft.Windows/AccountPolicy - properties: - name: EnablePasswordReversibleEncryption - value: false + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnablePasswordReversibleEncryption + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: Take ownership of files or other objects type: Microsoft.Windows/UserRightsAssignment properties: @@ -1290,10 +1325,15 @@ resources: valueType: Dword value: 1 - name: Account lockout threshold - type: Microsoft.Windows/AccountPolicy - properties: - name: LockoutThreshold - value: 3 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutThreshold + value: 3 + expression: 'true' + template: The value {value} is informational for this control. - name: Turn on PowerShell Script Block Logging type: Microsoft.Windows/Registry properties: @@ -1370,8 +1410,12 @@ resources: valueName: LogFileSize valueType: Dword value: 16384 - - name: "Accounts: Rename guest account" - type: Microsoft.Windows/AccountPolicy - properties: - name: GuestAccountName - value: + - name: 'Accounts: Rename guest account' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: GuestAccountName + expression: 'true' + template: The value {value} is informational for this control. diff --git a/public/_baselines/ws2019-domain-controller.osc.yaml b/public/_baselines/ws2019-domain-controller.osc.yaml index 893e2b8..13d4d3f 100644 --- a/public/_baselines/ws2019-domain-controller.osc.yaml +++ b/public/_baselines/ws2019-domain-controller.osc.yaml @@ -940,11 +940,16 @@ resources: properties: name: SeTrustedCredManAccessPrivilege value: [] - - name: "Accounts: Guest account status" - type: Microsoft.Windows/AccountPolicy - properties: - name: EnableGuestAccount - value: false + - name: 'Accounts: Guest account status' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnableGuestAccount + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: Act as part of the operating system type: Microsoft.Windows/UserRightsAssignment properties: @@ -1001,10 +1006,15 @@ resources: value: - "*S-1-5-32-546" - name: Enforce password history - type: Microsoft.Windows/AccountPolicy - properties: - name: PasswordHistoryLength - value: 24 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: PasswordHistoryLength + value: 24 + expression: (value != null && value >= 24) + template: The value {value} must be greater than or equal to 24. - name: Force shutdown from a remote system type: Microsoft.Windows/UserRightsAssignment properties: @@ -1038,20 +1048,35 @@ resources: name: SeLockMemoryPrivilege value: [] - name: Maximum password age - type: Microsoft.Windows/AccountPolicy - properties: - name: MaximumPasswordAge - value: 42 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MaximumPasswordAge + value: 42 + expression: (value != null && value >= 1 && value <= 70) + template: The value {value} must be between 1 and 70. - name: Minimum password age - type: Microsoft.Windows/AccountPolicy - properties: - name: MinimumPasswordAge - value: 1 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MinimumPasswordAge + value: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: Minimum password length - type: Microsoft.Windows/AccountPolicy - properties: - name: MinimumPasswordLength - value: 14 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MinimumPasswordLength + value: 14 + expression: (value != null && value >= 14) + template: The value {value} must be greater than or equal to 14. - name: Modify an object label type: Microsoft.Windows/UserRightsAssignment properties: @@ -1064,10 +1089,15 @@ resources: value: - "*S-1-5-32-544" - name: Password must meet complexity requirements - type: Microsoft.Windows/AccountPolicy - properties: - name: EnforcePasswordComplexity - value: true + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnforcePasswordComplexity + value: true + expression: ((((value == true)) || ((value == null)))) + template: The value {value} must be one of true, (not set). - name: Perform volume maintenance tasks type: Microsoft.Windows/UserRightsAssignment properties: @@ -1102,10 +1132,15 @@ resources: - "*S-1-5-32-544" - "*S-1-5-32-551" - name: Store passwords using reversible encryption - type: Microsoft.Windows/AccountPolicy - properties: - name: EnablePasswordReversibleEncryption - value: false + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnablePasswordReversibleEncryption + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: Take ownership of files or other objects type: Microsoft.Windows/UserRightsAssignment properties: @@ -1252,15 +1287,25 @@ resources: valueType: Dword value: 1 - name: Reset account lockout counter after - type: Microsoft.Windows/AccountPolicy - properties: - name: LockoutReset - value: 15 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutReset + value: 15 + expression: 'true' + template: The value {value} is informational for this control. - name: Account lockout threshold - type: Microsoft.Windows/AccountPolicy - properties: - name: LockoutThreshold - value: 3 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutThreshold + value: 3 + expression: 'true' + template: The value {value} is informational for this control. - name: Turn on PowerShell Script Block Logging type: Microsoft.Windows/Registry properties: @@ -1324,11 +1369,15 @@ resources: - "*S-1-5-32-544" - "*S-1-5-19" - "*S-1-5-20" - - name: "Accounts: Rename administrator account" - type: Microsoft.Windows/AccountPolicy - properties: - name: AdministratorAccountName - value: + - name: 'Accounts: Rename administrator account' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: AdministratorAccountName + expression: 'true' + template: The value {value} is informational for this control. - name: "Interactive logon: Prompt user to change password before expiration" type: Microsoft.Windows/Registry properties: @@ -1336,11 +1385,16 @@ resources: valueName: PasswordExpiryWarning valueType: Dword value: 14 - - name: "Network access: Allow anonymous SID/Name translation" - type: Microsoft.Windows/AccountPolicy - properties: - name: EnableAnonymousNameTranslation - value: false + - name: 'Network access: Allow anonymous SID/Name translation' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnableAnonymousNameTranslation + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: Limits print driver installation to Administrators type: Microsoft.Windows/Registry properties: @@ -1530,20 +1584,28 @@ resources: valueName: LogSuccessfulConnections valueType: Dword value: 1 - - name: "Windows Firewall: Private: Inbound connections" - type: Microsoft.Windows/Registry - properties: - keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile - valueName: DefaultInboundAction - valueType: Dword - value: - - name: "Windows Firewall: Domain: Inbound connections" - type: Microsoft.Windows/Registry - properties: - keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile - valueName: DefaultInboundAction - valueType: Dword - value: + - name: 'Windows Firewall: Private: Inbound connections' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + valueName: DefaultInboundAction + valueType: Dword + expression: 'true' + template: The value {value} is informational for this control. + - name: 'Windows Firewall: Domain: Inbound connections' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + valueName: DefaultInboundAction + valueType: Dword + expression: 'true' + template: The value {value} is informational for this control. - name: "Windows Firewall: Private: Logging: Name" type: Microsoft.Windows/Registry properties: @@ -1579,13 +1641,17 @@ resources: valueName: LogSuccessfulConnections valueType: Dword value: 1 - - name: "Windows Firewall: Public: Inbound connections" - type: Microsoft.Windows/Registry + - name: 'Windows Firewall: Public: Inbound connections' + type: Microsoft.OSConfig/Test properties: - keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile - valueName: DefaultInboundAction - valueType: Dword - value: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + valueName: DefaultInboundAction + valueType: Dword + expression: 'true' + template: The value {value} is informational for this control. - name: "Windows Firewall: Public: Logging: Name" type: Microsoft.Windows/Registry properties: @@ -1608,10 +1674,15 @@ resources: valueType: Dword value: 1 - name: Account Lockout Duration - type: Microsoft.Windows/AccountPolicy - properties: - name: LockoutDuration - value: 15 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutDuration + value: 15 + expression: 'true' + template: The value {value} is informational for this control. - name: "MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)" type: Microsoft.Windows/Registry properties: @@ -1626,22 +1697,34 @@ resources: valueName: PreventDeviceMetadataFromNetwork valueType: Dword value: 1 - - name: "Interactive logon: Message text for users attempting to log on" - type: Microsoft.Windows/Registry - properties: - keyPath: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System - valueName: LegalNoticeText - valueType: String - value: - - name: "Interactive logon: Message title for users attempting to log on" - type: Microsoft.Windows/Registry - properties: - keyPath: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System - valueName: LegalNoticeCaption - valueType: String - value: - - name: "Accounts: Rename guest account" - type: Microsoft.Windows/AccountPolicy - properties: - name: GuestAccountName - value: + - name: 'Interactive logon: Message text for users attempting to log on' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + valueName: LegalNoticeText + valueType: String + expression: 'true' + template: The value {value} is informational for this control. + - name: 'Interactive logon: Message title for users attempting to log on' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + valueName: LegalNoticeCaption + valueType: String + expression: 'true' + template: The value {value} is informational for this control. + - name: 'Accounts: Rename guest account' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: GuestAccountName + expression: 'true' + template: The value {value} is informational for this control. diff --git a/public/_baselines/ws2019-domain-member.osc.yaml b/public/_baselines/ws2019-domain-member.osc.yaml index a40a77e..7afc028 100644 --- a/public/_baselines/ws2019-domain-member.osc.yaml +++ b/public/_baselines/ws2019-domain-member.osc.yaml @@ -1042,11 +1042,16 @@ resources: properties: name: SeTrustedCredManAccessPrivilege value: [] - - name: "Accounts: Guest account status" - type: Microsoft.Windows/AccountPolicy - properties: - name: EnableGuestAccount - value: false + - name: 'Accounts: Guest account status' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnableGuestAccount + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: Act as part of the operating system type: Microsoft.Windows/UserRightsAssignment properties: @@ -1119,10 +1124,15 @@ resources: value: - "*S-1-5-32-546" - name: Enforce password history - type: Microsoft.Windows/AccountPolicy - properties: - name: PasswordHistoryLength - value: 24 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: PasswordHistoryLength + value: 24 + expression: (value != null && value >= 24) + template: The value {value} must be greater than or equal to 24. - name: Force shutdown from a remote system type: Microsoft.Windows/UserRightsAssignment properties: @@ -1156,20 +1166,35 @@ resources: name: SeLockMemoryPrivilege value: [] - name: Maximum password age - type: Microsoft.Windows/AccountPolicy - properties: - name: MaximumPasswordAge - value: 42 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MaximumPasswordAge + value: 42 + expression: (value != null && value >= 1 && value <= 70) + template: The value {value} must be between 1 and 70. - name: Minimum password age - type: Microsoft.Windows/AccountPolicy - properties: - name: MinimumPasswordAge - value: 1 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MinimumPasswordAge + value: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: Minimum password length - type: Microsoft.Windows/AccountPolicy - properties: - name: MinimumPasswordLength - value: 14 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MinimumPasswordLength + value: 14 + expression: (value != null && value >= 14) + template: The value {value} must be greater than or equal to 14. - name: Modify an object label type: Microsoft.Windows/UserRightsAssignment properties: @@ -1182,10 +1207,15 @@ resources: value: - "*S-1-5-32-544" - name: Password must meet complexity requirements - type: Microsoft.Windows/AccountPolicy - properties: - name: EnforcePasswordComplexity - value: true + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnforcePasswordComplexity + value: true + expression: ((((value == true)) || ((value == null)))) + template: The value {value} must be one of true, (not set). - name: Perform volume maintenance tasks type: Microsoft.Windows/UserRightsAssignment properties: @@ -1227,10 +1257,15 @@ resources: - "*S-1-5-32-544" - "*S-1-5-32-551" - name: Store passwords using reversible encryption - type: Microsoft.Windows/AccountPolicy - properties: - name: EnablePasswordReversibleEncryption - value: false + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnablePasswordReversibleEncryption + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: Take ownership of files or other objects type: Microsoft.Windows/UserRightsAssignment properties: @@ -1368,15 +1403,25 @@ resources: valueType: Dword value: 1 - name: Reset account lockout counter after - type: Microsoft.Windows/AccountPolicy - properties: - name: LockoutReset - value: 15 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutReset + value: 15 + expression: 'true' + template: The value {value} is informational for this control. - name: Account lockout threshold - type: Microsoft.Windows/AccountPolicy - properties: - name: LockoutThreshold - value: 3 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutThreshold + value: 3 + expression: 'true' + template: The value {value} is informational for this control. - name: Turn on PowerShell Script Block Logging type: Microsoft.Windows/Registry properties: @@ -1440,11 +1485,15 @@ resources: - "*S-1-5-32-544" - "*S-1-5-19" - "*S-1-5-20" - - name: "Accounts: Rename administrator account" - type: Microsoft.Windows/AccountPolicy - properties: - name: AdministratorAccountName - value: + - name: 'Accounts: Rename administrator account' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: AdministratorAccountName + expression: 'true' + template: The value {value} is informational for this control. - name: "Interactive logon: Prompt user to change password before expiration" type: Microsoft.Windows/Registry properties: @@ -1459,11 +1508,16 @@ resources: valueName: SMBServerNameHardeningLevel valueType: Dword value: 1 - - name: "Network access: Allow anonymous SID/Name translation" - type: Microsoft.Windows/AccountPolicy + - name: 'Network access: Allow anonymous SID/Name translation' + type: Microsoft.OSConfig/Test properties: - name: EnableAnonymousNameTranslation - value: false + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnableAnonymousNameTranslation + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: Limits print driver installation to Administrators type: Microsoft.Windows/Registry properties: @@ -1660,20 +1714,28 @@ resources: valueName: LogSuccessfulConnections valueType: Dword value: 1 - - name: "Windows Firewall: Private: Inbound connections" - type: Microsoft.Windows/Registry - properties: - keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile - valueName: DefaultInboundAction - valueType: Dword - value: - - name: "Windows Firewall: Domain: Inbound connections" - type: Microsoft.Windows/Registry - properties: - keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile - valueName: DefaultInboundAction - valueType: Dword - value: + - name: 'Windows Firewall: Private: Inbound connections' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile + valueName: DefaultInboundAction + valueType: Dword + expression: 'true' + template: The value {value} is informational for this control. + - name: 'Windows Firewall: Domain: Inbound connections' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile + valueName: DefaultInboundAction + valueType: Dword + expression: 'true' + template: The value {value} is informational for this control. - name: "Windows Firewall: Private: Logging: Name" type: Microsoft.Windows/Registry properties: @@ -1709,13 +1771,17 @@ resources: valueName: LogSuccessfulConnections valueType: Dword value: 1 - - name: "Windows Firewall: Public: Inbound connections" - type: Microsoft.Windows/Registry + - name: 'Windows Firewall: Public: Inbound connections' + type: Microsoft.OSConfig/Test properties: - keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile - valueName: DefaultInboundAction - valueType: Dword - value: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile + valueName: DefaultInboundAction + valueType: Dword + expression: 'true' + template: The value {value} is informational for this control. - name: "Windows Firewall: Public: Logging: Name" type: Microsoft.Windows/Registry properties: @@ -1738,10 +1804,15 @@ resources: valueType: Dword value: 1 - name: Account Lockout Duration - type: Microsoft.Windows/AccountPolicy - properties: - name: LockoutDuration - value: 15 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutDuration + value: 15 + expression: 'true' + template: The value {value} is informational for this control. - name: "MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)" type: Microsoft.Windows/Registry properties: @@ -1756,22 +1827,34 @@ resources: valueName: PreventDeviceMetadataFromNetwork valueType: Dword value: 1 - - name: "Interactive logon: Message text for users attempting to log on" - type: Microsoft.Windows/Registry - properties: - keyPath: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System - valueName: LegalNoticeText - valueType: String - value: - - name: "Interactive logon: Message title for users attempting to log on" - type: Microsoft.Windows/Registry - properties: - keyPath: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System - valueName: LegalNoticeCaption - valueType: String - value: - - name: "Accounts: Rename guest account" - type: Microsoft.Windows/AccountPolicy - properties: - name: GuestAccountName - value: + - name: 'Interactive logon: Message text for users attempting to log on' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + valueName: LegalNoticeText + valueType: String + expression: 'true' + template: The value {value} is informational for this control. + - name: 'Interactive logon: Message title for users attempting to log on' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/Registry + properties: + keyPath: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + valueName: LegalNoticeCaption + valueType: String + expression: 'true' + template: The value {value} is informational for this control. + - name: 'Accounts: Rename guest account' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: GuestAccountName + expression: 'true' + template: The value {value} is informational for this control. diff --git a/public/_baselines/ws2019-workgroup-member.osc.yaml b/public/_baselines/ws2019-workgroup-member.osc.yaml index ff000d9..19937ca 100644 --- a/public/_baselines/ws2019-workgroup-member.osc.yaml +++ b/public/_baselines/ws2019-workgroup-member.osc.yaml @@ -1007,11 +1007,16 @@ resources: properties: name: SeTrustedCredManAccessPrivilege value: [] - - name: "Accounts: Guest account status" - type: Microsoft.Windows/AccountPolicy - properties: - name: EnableGuestAccount - value: false + - name: 'Accounts: Guest account status' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnableGuestAccount + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: Act as part of the operating system type: Microsoft.Windows/UserRightsAssignment properties: @@ -1090,10 +1095,15 @@ resources: value: - "*S-1-5-32-546" - name: Enforce password history - type: Microsoft.Windows/AccountPolicy - properties: - name: PasswordHistoryLength - value: 24 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: PasswordHistoryLength + value: 24 + expression: (value != null && value >= 24) + template: The value {value} must be greater than or equal to 24. - name: Force shutdown from a remote system type: Microsoft.Windows/UserRightsAssignment properties: @@ -1127,20 +1137,35 @@ resources: name: SeLockMemoryPrivilege value: [] - name: Maximum password age - type: Microsoft.Windows/AccountPolicy - properties: - name: MaximumPasswordAge - value: 42 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MaximumPasswordAge + value: 42 + expression: (value != null && value >= 1 && value <= 70) + template: The value {value} must be between 1 and 70. - name: Minimum password age - type: Microsoft.Windows/AccountPolicy - properties: - name: MinimumPasswordAge - value: 1 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MinimumPasswordAge + value: 1 + expression: (value != null && value >= 1) + template: The value {value} must be greater than or equal to 1. - name: Minimum password length - type: Microsoft.Windows/AccountPolicy - properties: - name: MinimumPasswordLength - value: 14 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: MinimumPasswordLength + value: 14 + expression: (value != null && value >= 14) + template: The value {value} must be greater than or equal to 14. - name: Modify an object label type: Microsoft.Windows/UserRightsAssignment properties: @@ -1153,10 +1178,15 @@ resources: value: - "*S-1-5-32-544" - name: Password must meet complexity requirements - type: Microsoft.Windows/AccountPolicy - properties: - name: EnforcePasswordComplexity - value: true + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnforcePasswordComplexity + value: true + expression: ((((value == true)) || ((value == null)))) + template: The value {value} must be one of true, (not set). - name: Perform volume maintenance tasks type: Microsoft.Windows/UserRightsAssignment properties: @@ -1198,10 +1228,15 @@ resources: - "*S-1-5-32-544" - "*S-1-5-32-551" - name: Store passwords using reversible encryption - type: Microsoft.Windows/AccountPolicy - properties: - name: EnablePasswordReversibleEncryption - value: false + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: EnablePasswordReversibleEncryption + value: false + expression: ((((value == false)) || ((value == null)))) + template: The value {value} must be one of false, (not set). - name: Take ownership of files or other objects type: Microsoft.Windows/UserRightsAssignment properties: @@ -1283,10 +1318,15 @@ resources: valueType: Dword value: 1 - name: Account lockout threshold - type: Microsoft.Windows/AccountPolicy - properties: - name: LockoutThreshold - value: 3 + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: LockoutThreshold + value: 3 + expression: 'true' + template: The value {value} is informational for this control. - name: Turn on PowerShell Script Block Logging type: Microsoft.Windows/Registry properties: @@ -1363,8 +1403,12 @@ resources: valueName: LogFileSize valueType: Dword value: 16384 - - name: "Accounts: Rename guest account" - type: Microsoft.Windows/AccountPolicy - properties: - name: GuestAccountName - value: + - name: 'Accounts: Rename guest account' + type: Microsoft.OSConfig/Test + properties: + resource: + type: Microsoft.Windows/AccountPolicy + properties: + name: GuestAccountName + expression: 'true' + template: The value {value} is informational for this control. diff --git a/public/_baselines/ws2022-domain-controller.osc.yaml b/public/_baselines/ws2022-domain-controller.osc.yaml index f38034b..8c370cd 100644 --- a/public/_baselines/ws2022-domain-controller.osc.yaml +++ b/public/_baselines/ws2022-domain-controller.osc.yaml @@ -1087,8 +1087,8 @@ resources: keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: DefaultInboundAction valueType: REG_DWORD - expression: (value == 1) - template: The value {value} must be 1. + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallDomainProfileLogDroppedPackets type: Microsoft.OSConfig/Test properties: @@ -1218,8 +1218,8 @@ resources: keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: DefaultInboundAction valueType: REG_DWORD - expression: (value == 1) - template: The value {value} must be 1. + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPrivateProfileLogDroppedPackets type: Microsoft.OSConfig/Test properties: @@ -1349,8 +1349,8 @@ resources: keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: DefaultInboundAction valueType: REG_DWORD - expression: (value == 1) - template: The value {value} must be 1. + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPublicProfileLogDroppedPackets type: Microsoft.OSConfig/Test properties: diff --git a/public/_baselines/ws2022-domain-member.osc.yaml b/public/_baselines/ws2022-domain-member.osc.yaml index 1bd00b0..babc9b1 100644 --- a/public/_baselines/ws2022-domain-member.osc.yaml +++ b/public/_baselines/ws2022-domain-member.osc.yaml @@ -1087,8 +1087,8 @@ resources: keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile valueName: DefaultInboundAction valueType: REG_DWORD - expression: (value == 1) - template: The value {value} must be 1. + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallDomainProfileLogDroppedPackets type: Microsoft.OSConfig/Test properties: @@ -1218,8 +1218,8 @@ resources: keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile valueName: DefaultInboundAction valueType: REG_DWORD - expression: (value == 1) - template: The value {value} must be 1. + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPrivateProfileLogDroppedPackets type: Microsoft.OSConfig/Test properties: @@ -1349,8 +1349,8 @@ resources: keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile valueName: DefaultInboundAction valueType: REG_DWORD - expression: (value == 1) - template: The value {value} must be 1. + expression: ((((value == 1)) || ((value == null)))) + template: The value {value} must be one of 1, (not set). - name: FirewallPublicProfileLogDroppedPackets type: Microsoft.OSConfig/Test properties: diff --git a/public/_baselines/ws2025-domain-controller.osc.yaml b/public/_baselines/ws2025-domain-controller.osc.yaml index 2092991..179d68e 100644 --- a/public/_baselines/ws2025-domain-controller.osc.yaml +++ b/public/_baselines/ws2025-domain-controller.osc.yaml @@ -1319,8 +1319,8 @@ resources: keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient valueName: Enabled valueType: REG_DWORD - expression: (value == 0) - template: The value {value} must be 0. + expression: 'true' + template: The value {value} is informational for this control. - name: EnableGuestAccountStatus type: Microsoft.OSConfig/Test properties: diff --git a/public/_baselines/ws2025-member-server.osc.yaml b/public/_baselines/ws2025-member-server.osc.yaml index 08d65a1..eed51ce 100644 --- a/public/_baselines/ws2025-member-server.osc.yaml +++ b/public/_baselines/ws2025-member-server.osc.yaml @@ -1286,8 +1286,8 @@ resources: keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient valueName: Enabled valueType: REG_DWORD - expression: (value == 0) - template: The value {value} must be 0. + expression: 'true' + template: The value {value} is informational for this control. - name: EnableGuestAccountStatus type: Microsoft.OSConfig/Test properties: From ccb5c1615fd6e4d21a3ae6f8362dd3bdd8667dda Mon Sep 17 00:00:00 2001 From: Amir Bredy Date: Sun, 9 Aug 2026 20:35:21 -0700 Subject: [PATCH 2/2] fix(baselines): preserve firewall effective defaults Keep the deterministic WS2022 repair generator aligned with the validated domain firewall expressions so hosted tests do not regenerate strict assertions for unset DefaultInboundAction values. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 48993ee6-f068-4c4a-b317-2cd940fab804 --- .../repair-ws2022-baselines.mjs | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs b/scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs index 1199db3..19da50b 100644 --- a/scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs +++ b/scripts/ws2022-baseline-repair/repair-ws2022-baselines.mjs @@ -209,6 +209,15 @@ const INFORMATIONAL = { expression: 'true', template: 'The value {value} is informational for this control.', }; +const EFFECTIVE_DEFAULT_FIREWALL_RULES = new Set([ + 'FirewallDomainProfileInboundConnection', + 'FirewallPrivateProfileInboundConnection', + 'FirewallPublicProfileInboundConnection', +]); +const EFFECTIVE_DEFAULT_FIREWALL_ASSERTION = { + expression: '((((value == 1)) || ((value == null))))', + template: 'The value {value} must be one of 1, (not set).', +}; const literal = (value) => (typeof value === 'string' ? JSON.stringify(value) : String(value)); const list = (values) => `[${values.map(literal).join(',')}]`; @@ -542,7 +551,11 @@ function convertRegistry(rule, report) { } } - const compiled = compileSchema(schema, valueKind(hasValue ? properties.value : undefined)); + // An unset DefaultInboundAction uses Windows Firewall's effective block + // default, so it is equivalent to the explicit hardened value 1. + const compiled = EFFECTIVE_DEFAULT_FIREWALL_RULES.has(rule.name) + ? EFFECTIVE_DEFAULT_FIREWALL_ASSERTION + : compileSchema(schema, valueKind(hasValue ? properties.value : undefined)); return [{ name: rule.name, type: TEST,