search

ansible-lockdown / Windows-2019-CIS

CIS Baseline Ansible Role for Windows 2019
MIT License
134 stars 72 forks source link

The control 18.8.28.4 is not executed #33

Closed Julieeeen closed 3 years ago

Julieeeen commented 3 years ago

Not sure why but the control 18.8.28.4 is not executed

Tags looks ok, and the task is in the maln

Really not sure why ....

TASK [/tmp/awx_1138__8s1zfze/project : SCORED | 18.8.28.3 | PATCH | L1 Ensure Do not enumerate connected users on domain-joined computers is set to Enabled] * ok: [*****]

TASK [/tmp/awx_1138__8s1zfze/project : SCORED | 18.8.28.5 | PATCH | L1 Ensure Turn off app notifications on the lock screen is set to Enabled] * ok: [****]

georgenalen commented 3 years ago

Hello, I think that might be something in your local environment, maybe GUI related. Have you checked to see if the control is being set? I ran the control all the ways (reg entry there and not needing a change, reg entry there but needing a value change, and reg entry not there at all) in both Tower and straight Ansible against local vbox images and AWS EC2 instances. All of the tests had the expected results. So I think this one could be something related to the local environment.

Tower output TASK [/tmp/awx_299_wfyynwij/project : SCORED | 18.8.28.3 | PATCH | L1 Ensure Do not enumerate connected users on domain-joined computers is set to Enabled] *** changed: [Windows 2019]

TASK [/tmp/awx_299_wfyynwij/project : SCORED | 18.8.28.4 | PATCH | L1 Ensure Enumerate local users on domain-joined computers is set to Disabled MS only] *** changed: [Windows 2019]

TASK [/tmp/awx_299_wfyynwij/project : SCORED | 18.8.28.5 | PATCH | L1 Ensure Turn off app notifications on the lock screen is set to Enabled] *** changed: [Windows 2019]

George

georgenalen commented 3 years ago

Another thought could be it skipped and you config is setup to not show skipped items, could that be it?

George

Julieeeen commented 3 years ago

Looks like it was an issue on my system