Skip to content

Commit 4acc63d

Browse files
georgenalengeorgenalen
authored
Merge pull request #24 from ansible-lockdown/devel
Updates for issues Signed-off-by: George Nalen <georgen@mindpointgroup.com>
2 parents 7f75b72 + 44c7b74 commit 4acc63d

File tree

4 files changed

+122
-126
lines changed

4 files changed

+122
-126
lines changed

‎defaults/main.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -439,6 +439,11 @@ rule_19_7_26_1: true
439439
rule_19_7_41_1: true
440440
rule_19_7_45_2_1: true
441441

442+
# Global Variables
443+
444+
# is_hyperv_installed is a true/false for having hyper-visor installed
445+
is_hyperv_installed: false
446+
442447
# Section 2 Variables
443448
# Control 2.3.1.5
444449
# win16cis_admin_username is the name the administrator account will be renamed to
@@ -461,6 +466,16 @@ maximumpasswordage: 60
461466
minimumpasswordage: 1
462467
minimumpasswordlength: 14
463468

469+
# Control 18.2.5
470+
# laps_passwordlength is the LAPS tool password length.
471+
# To conform to CIS standards please use a min value of 15 and max value of 127
472+
laps_passwordlength: 15
473+
474+
# Control 18.2.6
475+
# laps_passwordagedays is the LAPS tool password age in days
476+
# To conform to CIS standards please use a max value of 30
477+
laps_passwordagedays: 30
478+
464479
newadministratorname: renamedadmin
465480
newguestname: renamedguest
466481

@@ -515,3 +530,11 @@ public_firewall_log_path: '%SystemRoot%\System32\logfiles\firewall\publicfw.log'
515530
# public_firewall_log_size is the size of the log file
516531
# To conform to CIS stadnards the value should be 16,384 or greater. Value is in KB
517532
public_firewall_log_size: 16,384
533+
534+
535+
# 18.9.102.2
536+
# win16cis_wupdate_options are described below
537+
# value 2 - Notify for download and install, value 3 - Auto download and notify for install
538+
# value 4 - Auto download and schedule install (recommended), value 5 - Allow local admin to choose setting
539+
# value 7 - Auto download, notify to install, notify to restart
540+
win16cis_wupdate_options: 4

‎tasks/section02.yml‎

Lines changed: 28 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -233,15 +233,26 @@
233233
- patch
234234

235235
- name: "SCORED | 2.2.18 | PATCH | (L1) Ensure 'Create symbolic links' is set to 'Administrators, NT VIRTUAL MACHINE/Virtual Machines' (MS only)"
236-
win_user_right:
237-
name: SeCreateSymbolicLinkPrivilege
238-
users:
239-
- Administrators
240-
- NT VIRTUAL MACHINE\Virtual Machines
241-
action: set
236+
block:
237+
- name: "SCORED | 2.2.18 | PATCH | (L1) Ensure 'Create symbolic links' is set to 'Administrators, NT VIRTUAL MACHINE/Virtual Machines' (MS only) | No Hyper-v"
238+
win_user_right:
239+
name: SeCreateSymbolicLinkPrivilege
240+
users:
241+
- Administrators
242+
action: set
243+
when: not is_hyperv_installed
244+
245+
- name: "SCORED | 2.2.18 | PATCH | (L1) Ensure 'Create symbolic links' is set to 'Administrators, NT VIRTUAL MACHINE/Virtual Machines' (MS only) | With Hyper-v"
246+
win_user_right:
247+
name: SeCreateSymbolicLinkPrivilege
248+
users:
249+
- Administrators
250+
- NT VIRTUAL MACHINE\Virtual Machines
251+
action: set
252+
when: is_hyperv_installed
242253
when:
243254
- rule_2_2_18
244-
- ansible_windows_domain_role == "Member server"
255+
- not ansible_windows_domain_role == "Primary domain controller"
245256
tags:
246257
- level1-memberserver
247258
- rule_2.2.18
@@ -285,7 +296,7 @@
285296
action: set
286297
when:
287298
- rule_2_2_21
288-
- ansible_windows_domain_member
299+
- not ansible_windows_domain_role == "Primary domain controller"
289300
tags:
290301
- level1-memberserver
291302
- rule_2.2.21
@@ -442,7 +453,7 @@
442453
action: set
443454
when:
444455
- rule_2_2_32
445-
- ansible_windows_domain_member
456+
- not ansible_windows_domain_role == "Primary domain controller"
446457
tags:
447458
- level1-memberserver
448459
- rule_2.2.32
@@ -654,6 +665,7 @@
654665
when:
655666
- rule_2_3_1_1
656667
- not ansible_windows_domain_role == "Primary domain controller"
668+
- disruption_high
657669
tags:
658670
- level1-memberserver
659671
- rule_2.3.1.1
@@ -827,7 +839,7 @@
827839
type: dword
828840
when:
829841
- rule_2_3_6_1
830-
- not ansible_windows_domain_role == "Primary domain controller"
842+
- ansible_windows_domain_role == "Member Server"
831843
tags:
832844
- level1-domaincontroller
833845
- level1-memberserver
@@ -842,7 +854,7 @@
842854
type: dword
843855
when:
844856
- rule_2_3_6_2
845-
- not ansible_windows_domain_role == "Primary domain controller"
857+
- ansible_windows_domain_role == "Member Server"
846858
tags:
847859
- level1-domaincontroller
848860
- level1-memberserver
@@ -978,7 +990,7 @@
978990
type: string
979991
when:
980992
- rule_2_3_7_6
981-
- not ansible_windows_domain_role == "Primary domain controller"
993+
- ansible_windows_domain_role == "Member server"
982994
tags:
983995
- level2-memberserver
984996
- rule_2.3.7.6
@@ -1123,7 +1135,7 @@
11231135
type: dword
11241136
when:
11251137
- rule_2_3_9_5
1126-
- ansible_windows_domain_role == "Member server"
1138+
- not ansible_windows_domain_role == "Primary domain controller"
11271139
tags:
11281140
- level1-memberserver
11291141
- rule_2.3.9.5
@@ -1240,7 +1252,7 @@
12401252
win_regedit:
12411253
path: HKLM:\System\Currentcontrolset\Control\Securepipeservers\Winreg\Allowedpaths
12421254
name: "Machine"
1243-
data: ['System\CurrentControlSet\Control\Print\Printers', 'System\CurrentControlSet\Services\Eventlog', 'Software\Microsoft\OLAP Server', 'Software\Microsoft\Windows NT\CurrentVersion\Print', 'Software\Microsoft\Windows NT\CurrentVersion\Windows', 'System\CurrentControlSet\Control\ContentIndex', 'System\CurrentControlSet\Control\Terminal Server', 'System\CurrentControlSet\Control\Terminal Server\UserConfig', 'System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration', 'Software\Microsoft\Windows NT\CurrentVersion\Perflib', 'System\CurrentControlSet\Services\WINS', 'System\CurrentControlSet\Services\CertSvc']
1255+
data: ['System\CurrentControlSet\Control\Print\Printers', 'System\CurrentControlSet\Services\Eventlog', 'Software\Microsoft\OLAP Server', 'Software\Microsoft\Windows NT\CurrentVersion\Print', 'Software\Microsoft\Windows NT\CurrentVersion\Windows', 'System\CurrentControlSet\Control\ContentIndex', 'System\CurrentControlSet\Control\Terminal Server', 'System\CurrentControlSet\Control\Terminal Server\UserConfig', 'System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration', 'Software\Microsoft\Windows NT\CurrentVersion\Perflib', 'System\CurrentControlSet\Services\WINS', 'System\CurrentControlSet\Services\CertSvc', 'System\CurrentControlSet\Services\SysmonLog']
12441256
type: multistring
12451257
when: rule_2_3_10_9
12461258
tags:
@@ -1487,8 +1499,8 @@
14871499
- name: "SCORED | 2.3.17.2 | PATCH | (L1) Ensure 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' is set to 'Prompt for consent on the secure desktop'"
14881500
win_regedit:
14891501
path: HKLM:\Software\Microsoft\Windows\Currentversion\Policies\System
1490-
name: EnableUIADesktopToggle
1491-
data: 0
1502+
name: ConsentPromptBehaviorAdmin
1503+
data: 2
14921504
type: dword
14931505
when: rule_2_3_17_2
14941506
tags:

‎tasks/section17.yml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -75,23 +75,22 @@
7575
- name: "SCORED | 17.2.1 | PATCH | (L1) Ensure 'Audit Application Group Management' is set to 'Success and Failure'"
7676
block:
7777
- name: "SCORED | 17.2.1 | AUDIT | (L1) Ensure 'Audit Application Group Management' is set to 'Success and Failure' | Get current settings"
78-
win_shell: AuditPol /get /subcategory:"Security Group Management" -r | ConvertFrom-Csv | Select-Object -expand "Inclusion Setting"
78+
win_shell: AuditPol /get /subcategory:"Application Group Management" -r | ConvertFrom-Csv | Select-Object -expand "Inclusion Setting"
7979
changed_when: false
8080
failed_when: false
8181
register: rule_17_2_1_audit
8282

8383
- name: "SCORED | 17.2.1 | PATCH | (L1) Ensure 'Audit Application Group Management' is set to 'Success and Failure' | Success"
84-
win_shell: AuditPol /set /subcategory:"Security Group Management" /success:enable
84+
win_shell: AuditPol /set /subcategory:"Application Group Management" /success:enable
8585
changed_when: "'Success' not in rule_17_2_1_audit.stdout"
8686
when: "'Success' not in rule_17_2_1_audit.stdout"
8787

8888
- name: "SCORED | 17.2.1 | PATCH | (L1) Ensure 'Audit Application Group Management' is set to 'Success and Failure' | Failure"
89-
win_shell: AuditPol /set /subcategory:"Security Group Management" /failure:enable
89+
win_shell: AuditPol /set /subcategory:"Application Group Management" /failure:enable
9090
changed_when: "'Failure' not in rule_17_2_1_audit.stdout"
9191
when: "'Failure' not in rule_17_2_1_audit.stdout"
9292
when:
9393
- rule_17_2_1
94-
- ansible_windows_domain_role == "Primary domain controller"
9594
tags:
9695
- level1-domaincontroller
9796
- level1-memberserver
@@ -557,7 +556,7 @@
557556
register: rule_17_7_5_audit
558557

559558
- name: "SCORED | 17.7.5 | PATCH | (L1) Ensure 'Audit Other Policy Change Events' is set to include 'Failure' | Set failure"
560-
win_shell: AuditPol /set /subcategory:"Other Policy Change Events" /success:enable
559+
win_shell: AuditPol /set /subcategory:"Other Policy Change Events" /failure:enable
561560
when: "'Failure' not in rule_17_7_5_audit.stdout"
562561
when:
563562
- rule_17_7_5

0 commit comments

Comments
 (0)