Executed Hardening HealthCheck for CPM and Report results in Warning despite applying changes

Summary

Applied Hardening HealthCheck Script run ver3.2 for our CPM component. It results with warnings. Upon making the changes and re-run it still results in some Warnings.

Steps to Reproduce

Ran the Healthcheck Harden script in CPM component and made changes to the CPM component permissions / access pertaining to the warning results - but post changes and re-run script warning still persist.

Expected Results

Expected Result is to have compliance in Hardening of the CyberArk components. but results with warnings.

Actual Results

Actual Results attached to the Issue.

Reproducible

Issue has been reported to CyberArk Member : Charles Vinet and he confirmed that in LAB he also have the same result discrepancies in his Health Check reports.

Version/Tag number

*What version of the product are you running? ver 3.2

Environment setup

Can you describe the environment in which this product is running? Is it running on a VM / in a container / in a cloud? CLOUD
Which cloud provider? Which container orchestrator (including version)? Privilege Cloud CyberArk ver 12.2
The more info you can share about your runtime environment, the better we may be able to reproduce the issue. Attached the healthcheck reports.

Additional Information

We earlier tried with older version script and got result discrepancies and now also we face the same.

Below listed warnings occur again despite being applied respective changes

*Credential File Hardening

*Enable ScreenSaver

*FileSystem Permissions

*Registry Permissions

*Remote Desktop Services

Below listed warning changes unable to execute in Server due to restriction

*EventLog Size And Retention CPM hardening already ran during installation - need more info from CyberArk on why the script could not verify the "import INF configuration" section

*Importing INF Configuration As per the CA recommendation, size 100032 can not be set as the system prompts that its either too large or too small

CyberArk Hardening Health Check Report - Run.pdf

CyberArk Hardening Health Check Report - ReRun.pdf

Hello @AK3590,

*Credential File Hardening If I remember correctly this should be applied manually, please verify with your CyberArk representative

*Enable ScreenSaver There could be a group policy blocking or changing the defaults that we expect in the script. If so and it is applied this can be ignored

*FileSystem Permissions Needs verification, could be an error that you might find in the logs. You can run the hardening script using the -verbose switch to see more information on what happened

*Registry Permissions Needs verification, as with previous, run the script with -verbose switch to see more information

*Remote Desktop Services There could be a group policy that has a different value than expected

Hope this helps, Regards, Assaf

On Tue, Feb 22, 2022, 21:45 AK3590 @.***> wrote:

Summary

Applied Hardening HealthCheck Script run ver3.2 for our CPM component. It results with warnings. Upon making the changes and re-run it still results in some Warnings. Steps to Reproduce

Ran the Healthcheck Harden script in CPM component and made changes to the CPM component permissions / access pertaining to the warning results - but post changes and re-run script warning still persist. Expected Results

Expected Result is to have compliance in Hardening of the CyberArk components. but results with warnings. Actual Results

Actual Results attached to the Issue. Reproducible

Issue has been reported to CyberArk Member : Charles Vinet and he confirmed that in LAB he also have the same result discrepancies in his Health Check reports. Version/Tag number

*What version of the product are you running? ver 3.2 Environment setup

Can you describe the environment in which this product is running? Is it running on a VM / in a container / in a cloud? CLOUD

Which cloud provider? Which container orchestrator (including version)? Privilege Cloud CyberArk ver 12.2

The more info you can share about your runtime environment, the better we may be able to reproduce the issue. Attached the healthcheck reports.

Additional Information

We earlier tried with older version script and got result discrepancies and now also we face the same.

Below listed warnings occur again despite being applied respective changes

*Credential File Hardening

*Enable ScreenSaver

*FileSystem Permissions

*Registry Permissions

*Remote Desktop Services

Below listed warning changes unable to execute in Server due to restriction

*EventLog Size And Retention CPM hardening already ran during installation - need more info from CyberArk on why the script could not verify the "import INF configuration" section

*Importing INF Configuration As per the CA recommendation, size 100032 can not be set as the system prompts that its either too large or too small

CyberArk Hardening Health Check Report - Run.pdf https://github.com/cyberark/CYBRHardeningCheck/files/8119697/CyberArk.Hardening.Health.Check.Report.-.Run.pdf

CyberArk Hardening Health Check Report - ReRun.pdf https://github.com/cyberark/CYBRHardeningCheck/files/8119698/CyberArk.Hardening.Health.Check.Report.-.ReRun.pdf

— Reply to this email directly, view it on GitHub https://github.com/cyberark/CYBRHardeningCheck/issues/99, or unsubscribe https://github.com/notifications/unsubscribe-auth/AC3PN3JK42GYFUQLFNU5XITU4PRV3ANCNFSM5PCLGKEA . Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

You are receiving this because you are subscribed to this thread.Message ID: @.***>

cyberark / CYBRHardeningCheck