microsoft / PowerStig

STIG Automation
https://www.powershellgallery.com/packages/PowerSTIG
Other
546 stars 113 forks source link

Generating a checklist with manualchecklist entry behavior is different when using mof versus dsc #752

Open stevehose opened 4 years ago

stevehose commented 4 years ago

When generating a new DISA STIG checklist, PowerStig will inject entries from a supplied manual checklist entries file when using the -DscResult option and supplying DSC results. This also works with -ReferenceConfiguration and supplying a .mof file, but has a different outcome.

This should be consistent.

Expected behavior Creating a checklist with a manual checklist entries file should always inject the manual entries into the checklist, regardless of whether PowerStig has/will automate the rule.

EngThis commented 4 years ago

The Documentation States that the manual entry xml will only inject comments,etc to non automated rules, I didnt see it specify that all manual entries get injected when using -DscResults, However I second this as the comments that are injected by default "Addressed by PowerStig MOF via MSFT_ResourceInDesiredState" are not detailed enough. A security auditor from DCSA doing an inspection probably will not understand this and will want more info on how DSC PowerSTIG is applying these rules. I made this issue #771 before realizing that this request is basically asking for the same functionality.