search

EvotecIT / Testimo

Testimo is a PowerShell module for running health checks for Active Directory against a bunch of different tests
MIT License
526 stars 58 forks source link

Hardened UNC paths #93

Closed SUBnet192 closed 3 years ago

SUBnet192 commented 4 years ago

I'm guessing the space in the expected value is the problem? The values are right, but the match fails.

    [i][ad.subnet192.com][SVPCHQADS001] Hardened UNC Paths [Informative]
        [t][ad.subnet192.com][SVPCHQADS001] Hardened UNC Paths [Pass] [Data is available.]
        [t][ad.subnet192.com][SVPCHQADS001] Netlogon UNC Hardening [Fail] [Expected value (Equal): RequireMutualAuthentication=1, RequireIntegrity=1, Found value: RequireMutualAuthentication=1,RequireIntegrity=1]
        [t][ad.subnet192.com][SVPCHQADS001] SysVol UNC Hardening [Fail] [Expected value (Equal): RequireMutualAuthentication=1, RequireIntegrity=1, Found value: RequireMutualAuthentication=1,RequireIntegrity=1]
PrzemyslawKlys commented 4 years ago

The big question is what is the correct value and whether or not spaces matter.

The documentation states: RequireMutualAuthentication=1, RequireIntegrity=1 at https://support.microsoft.com/en-us/help/3000483/ms15-011-vulnerability-in-group-policy-could-allow-remote-code-executi but maybe both works?

SUBnet192 commented 4 years ago

I fixed it by adding the space in my GPO. No idea if the space is required or not. I used the STIG GPO as a baseline in my lab, and I assume that was in it like that. Let's go with the documentation, it's an easy "user side fix". Thanks.

PrzemyslawKlys commented 4 years ago

STIG also has space: https://www.stigviewer.com/stig/windows_10/2016-06-24/finding/V-63577

SUBnet192 commented 4 years ago

https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=gpo

In the documentation yes, I meant I used the actual GPO you can download from them, which might have had the setting already in it without the space. No big deal :)

PrzemyslawKlys commented 3 years ago

Closing as I have no clue whether option without space works (cant' find anything saying it does), and docs point to spaces.

jmarstonsl commented 3 years ago

@PrzemyslawKlys The Microsoft Windows Security Baselines have the value as RequireMutualAuthentication=1,RequireIntegrity=1. Any chance we can update this to look for either?

PrzemyslawKlys commented 3 years ago

Yes, will do.

PrzemyslawKlys commented 3 years ago

This should now accept both values.