search

scipag / HardeningKitty

HardeningKitty - Checks and hardens your Windows configuration
MIT License
1.26k stars 148 forks source link

finding_list_cis_microsoft_windows_server_2022_21h2_1.0.0_machine.csv - ID 2.3.10.9, Network access: Remotely accessible registry paths and sub-paths #40

Open nekodas opened 1 year ago

nekodas commented 1 year ago

[] Windows: Microsoft Windows Server 2022 Standard Evaluation [] Windows edition: ServerStandardEval [*] Windows version: 2009 Finding list - finding_list_cis_microsoft_windows_server_2022_21h2_1.0.0_machine.csv

After changing settings to recommended; it still flagging as incorrect:

[$] ID 2.3.10.9, Network access: Remotely accessible registry paths and sub-paths, Result=System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog, Recommended=System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog, Severity=Medium

It's a bit hard to see with that blurb of text so I will paste again with easier formatting for visibility:

Result: System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog

Recommended: System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog

Any idea's what went wrong here?

nekodas commented 1 year ago

Also having a similar issue with:

Result: The current configuration allows remote access to the following registry paths:

System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion

Recommended: The recommended configuration suggests limiting remote access to the following registry paths:

System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion

0x6d69636b commented 1 year ago

Could you please test the version in the development repo, the issue should be fixed: https://github.com/0x6d69636b/windows_hardening

nekodas commented 1 year ago

Just tried it from the link you provided and you were correct; it fixed the issue!