fedepacher
commented
2 years ago Second revision by @fedepacher
1.1 Password Policy
1.1.1 (L1) "Ensure 'Enforce password history' is set to '24 or more password(s)' :green_circle:
-
Severity:
Medium -
[x] Fixed
-
[x] Second review
Details
-
ID - :green_circle:
-
Title, description, rationale, remediation - :red_circle: Expected remediation:
Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Enforce password historyCurrent remediation:
Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\Enforce password history- Compliance - :green_circle:
- Rules -
- Expected scan result:
FAIL - Log:
C:\Users\vagrant>net.exe accounts Force user logoff how long after time expires?: Never Minimum password age (days): 0 Maximum password age (days): 42 Minimum password length: 0 Length of password history maintained: None Lockout threshold: Never Lockout duration (minutes): 30 Lockout observation window (minutes): 30 Computer role: WORKSTATION The command completed successfully.
- Expected scan result:
1.1.2 (L1) Ensure 'Maximum password age' is set to '365 or fewer days, but not 0' :green_circle:
-
Severity:
Medium -
[x] Fixed
-
[x] Second review
Details
-
ID - :green_circle:
-
Title, description, rationale, remediation - :red_circle: Expected remediation:
To establish the recommended configuration via GP, set the following UI path to 365 or fewer days, but not 0 : Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Maximum password ageCurrent remediation:
To establish the recommended configuration via GP, set the following UI path to 60 or fewer days, but not 0: Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\Maximum password age- Compliance - :green_circle:
- Rules -
- Expected scan result:
OK - Log: Same as 1.1.1
- Expected scan result:
1.1.3 (L1) Ensure 'Minimum password age' is set to '1 or more day(s)' :green_circle:
-
Severity:
Medium -
[x] Fixed
-
[x] Second review
Details
-
ID - :green_circle:
-
Title, description, rationale, remediation - :red_circle: Expected remediation:
Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Minimum password ageCurrent remediation:
Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\Minimum password age -
Compliance - :green_circle:
-
Rules -
- Expected scan result:
FAIL - Log: Same as 1.1.1
- Expected scan result:
1.1.4 (L1) Ensure 'Minimum password length' is set to '14 or more character(s)' :green_circle:
-
Severity:
Medium -
[x] Fixed
-
[x] Second review
Details
-
ID - :green_circle:
-
Title, description, rationale, remediation - :red_circle: Expected remediation:
Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Minimum password lengthCurrent remediation:
Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Account 'Policies\\Password Policy\\Minimum password length' -
Compliance - :green_circle:
-
Rules -
- Expected scan result:
FAIL - Log: Same as 1.1.1
- Expected scan result:
1.1.5 (L1) Ensure 'Password must meet complexity requirements' is set to 'Enabled' :green_circle:
-
Severity:
Medium -
[x] Fixed
-
[x] Second review
Details
-
ID - :green_circle:
-
Title, description, rationale, remediation - :red_circle: Incomplete description
Expected remediation:
Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirementsCurrent remediation:
Configuration\\Policies\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\Password must meet complexity requirements- Compliance - :green_circle:
- Rules -
- Expected scan result:
FAIL - Log:
C:\Users\vagrant>powershell Get-ADDefaultDomainPasswordPolicy -Current LoggedOnUser Get-ADDefaultDomainPasswordPolicy : The term 'Get-ADDefaultDomainPasswordPolicy' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. At line:1 char:1
- Expected scan result:
- Get-ADDefaultDomainPasswordPolicy -Current LoggedOnUser
-
+ CategoryInfo : ObjectNotFound: (Get-ADDefaultDomainPasswordP olicy:String) [], CommandNotFoundException + FullyQualifiedErrorId : CommandNotFoundException ```
1.1.6 (L1) Ensure 'Relax minimum password length limits' is set to 'Enabled' :green_circle:
-
Severity:
Medium -
[x] Fixed
-
[x] Second review
Details
-
ID - :green_circle:
-
Title, description, rationale, remediation - :red_circle: Incomplete description Expected description
This policy setting determines whether the minimum password length setting can be increased beyond the legacy limit of 14 characters. For more information please see the following Microsoft Security Blog. The recommended state for this setting is: Enabled .Current description
This policy setting determines whether the minimum password length setting can be increased beyond the legacy limit of 14 characters. For more information please see the following Microsoft Security Blog.Expected remediation:
Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Relax minimum password length limitsCurrent remediation:
Computer Configuration\\Policies\\Windows Settings\\Security Settings\\AccountPolicies\\Password Policy\\Relax minimum password length limits -
Compliance - ::green_circle:
-
Rules -
- Expected scan result:
FAIL - Log:
PS C:\Users\vagrant> Get-ItemProperty -PAth 'HKLM:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SAM'
- Expected scan result:
1.1.7 (L1) Ensure 'Store passwords using reversible encryption' is set to 'Disabled' :red_circle:
Not present
fabamatic
damarisg
Description
Windows 10 SCA policies have been updated https://github.com/wazuh/wazuh/issues/13191. On this account, It is necessary to ensure that these policies fit with the CIS Windows 10 Enterprise Release 21H2 Benchmark v1.12.. Also, manual testing for the used SCA rules is required, ensuring the proposed rules work as expected.
For each check in the SCA policy checks:
ymlfile.The installers must also be tested:
Checks
Checks design
Any failing test must be properly addressed with a new issue, detailing the error and the possible cause.
An extended report of the test results can be attached as a ZIP or TXT file. Please attach any documents, screenshots, or tables to the issue update with the results. This report can be used by the auditors to dig deeper into any possible failures and details.
Checks lists
Conclusions
All tests have been executed and the results can be found in the issue updates.
To be completed