-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathCIS.yml
906 lines (885 loc) · 27.3 KB
/
CIS.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
## Variables file
## metadata for benchmark
win2016cis_benchmark:
- "type: CIS"
- "version: '1.2'"
- "os: Windows2016"
#- "epoch: {{ ansible_date_time.epoch }}" # To be populated via wrapper script using inline vars
#- "hostname: {{ ansible_hostname }}" # To be populated via wrapper script using inline vars
# - "server_type: Standalone Server" # To be populated via wrapper script using inline vars
######################
## Server Variables ##
######################
is_domain_controller: false
is_standalone: true
reboot_required: false
win2016cis_use_iis: false
exchange_server_group: false
###################
# Reference files #
###################
gpresult_file: 'c:\goss\gpresult.txt'
auditresult_file: 'c:\goss\audit_pol.txt'
secedit_file: 'c:\goss\secedit_conf.txt'
#########
## CIS ##
#########
##############
# CIS Levels #
##############
win2016cis_level_1: true
win2016cis_level_2: true
win2016cis_NG: true # Note this needs UEFI and virtualication enabled systems - rollback is very manual
################
# Server Roles #
################
# If a Server uses the following set to true
# certification Authority role
win2016cis_cert_auth_role: false
# WINS server Feature Installed
win2016cis_WINS_server: false
win2016_use_domain_firewall: false
win2016_use_private_firewall: false
win2016_use_public_firewall: false
################
# CIS Sections #
################
win2016cis_section_1: true
win2016cis_section_2: true
win2016cis_section_9: true
win2016cis_section_17: true
win2016cis_section_18: true
win2016cis_section_19: true
########################
## Section_1_Controls ##
########################
# 1.1 Password Policy
win2016cis_1_1_1: true
win2016cis_1_1_2: true
win2016cis_1_1_3: true
win2016cis_1_1_4: true
win2016cis_1_1_5: true
win2016cis_1_1_6: true
# 1.2 Account Lockout Policy
win2016cis_1_2_1: true
win2016cis_1_2_2: true
win2016cis_1_2_3: true
########################
## Section_2_Controls ##
########################
# 2.2 User Rights Assignment
win2016cis_2_2_1: true
win2016cis_2_2_2: true # DC_ONLY
win2016cis_2_2_3: true # MS_ONLY
win2016cis_2_2_4: true
win2016cis_2_2_5: true # DC_ONLY
win2016cis_2_2_6: true
win2016cis_2_2_7: true # DC & MS separate controls (see Section_2_Vars)
win2016cis_2_2_8: true # DC_ONLY
win2016cis_2_2_9: true # MS_ONLY
win2016cis_2_2_10: true
win2016cis_2_2_11: true
win2016cis_2_2_12: true
win2016cis_2_2_13: true
win2016cis_2_2_14: true
win2016cis_2_2_15: true
win2016cis_2_2_16: true
win2016cis_2_2_17: true # DC ONLY
win2016cis_2_2_18: true # MS ONLY
win2016cis_2_2_19: true
win2016cis_2_2_20: true # DC ONLY
win2016cis_2_2_21: true
win2016cis_2_2_22: true
win2016cis_2_2_23: true
win2016cis_2_2_24: true
win2016cis_2_2_25: true # DC ONLY
win2016cis_2_2_26: true # MS ONLY
win2016cis_2_2_27: true # DC ONLY
win2016cis_2_2_28: true # MS ONLY
win2016cis_2_2_29: true
win2016cis_2_2_30: true
win2016cis_2_2_31: true # DC ONLY
win2016cis_2_2_32: true # MS ONLY
win2016cis_2_2_33: true
win2016cis_2_2_34: true
win2016cis_2_2_35: true
win2016cis_2_2_36: true # DC ONLY
win2016cis_2_2_37: true # DC ONLY
win2016cis_2_2_38: true # MS ONLY
win2016cis_2_2_39: true
win2016cis_2_2_40: true
win2016cis_2_2_41: true
win2016cis_2_2_42: true
win2016cis_2_2_43: true
win2016cis_2_2_44: true
win2016cis_2_2_45: true
win2016cis_2_2_46: true
win2016cis_2_2_47: true # DC ONLY
win2016cis_2_2_48: true
# 2.3.1 Accounts
win2016cis_2_3_1_1: true # MS Only
win2016cis_2_3_1_2: true
win2016cis_2_3_1_3: true # MS Only
win2016cis_2_3_1_4: true
win2016cis_2_3_1_5: true
win2016cis_2_3_1_6: true
#A 2.3.2 udit
win2016cis_2_3_2_1: true
win2016cis_2_3_2_2: true
# 2.3.3 DCOM
# 2.3.4 Devices
win2016cis_2_3_4_1: true
win2016cis_2_3_4_2: true
# 2.3.5 Domain Controller
win2016cis_2_3_5_1: true
win2016cis_2_3_5_2: true
win2016cis_2_3_5_3: true
# 2.3.6 Domain Member
win2016cis_2_3_6_1: true
win2016cis_2_3_6_2: true
win2016cis_2_3_6_3: true
win2016cis_2_3_6_4: true
win2016cis_2_3_6_5: true
win2016cis_2_3_6_6: true
# 2.3.7 Interactive Login
win2016cis_2_3_7_1: true
win2016cis_2_3_7_2: true
win2016cis_2_3_7_3: true
win2016cis_2_3_7_4: true
win2016cis_2_3_7_5: true
win2016cis_2_3_7_6: true # MS Only
win2016cis_2_3_7_7: true
win2016cis_2_3_7_8: true # MS Only
win2016cis_2_3_7_9: true
# 2.3.8 Microsoft network client SMB
win2016cis_2_3_8_1: true
win2016cis_2_3_8_2: true
win2016cis_2_3_8_3: true
# 2.3.9 Microsoft network server SMB
win2016cis_2_3_9_1: true
win2016cis_2_3_9_2: true
win2016cis_2_3_9_3: true
win2016cis_2_3_9_4: true
win2016cis_2_3_9_5: true
# 2.3.10 Network Access
win2016cis_2_3_10_1: true
win2016cis_2_3_10_2: true
win2016cis_2_3_10_3: true
win2016cis_2_3_10_4: true
win2016cis_2_3_10_5: true
win2016cis_2_3_10_6: true
win2016cis_2_3_10_7: true
win2016cis_2_3_10_8: true
win2016cis_2_3_10_9: true
win2016cis_2_3_10_10: true
win2016cis_2_3_10_11: true
win2016cis_2_3_10_12: true
win2016cis_2_3_10_13: true
# 2.3.11 Network Security
win2016cis_2_3_11_1: true
win2016cis_2_3_11_2: true
win2016cis_2_3_11_3: true
win2016cis_2_3_11_4: true
win2016cis_2_3_11_5: true
win2016cis_2_3_11_6: true
win2016cis_2_3_11_7: true
win2016cis_2_3_11_8: true
win2016cis_2_3_11_9: true
win2016cis_2_3_11_10: true
# 2.2.12 Recovery Console
# 2.3.13 Shutdown
win2016cis_2_3_13_1: true
#2.3.14 Cryptography
# 2.3.15 System Objects
win2016cis_2_3_15_1: true
win2016cis_2_3_15_2: true
# 2.3.16 System Settings
# 2.3.17 User Account Control
win2016cis_2_3_17_1: true
win2016cis_2_3_17_2: true
win2016cis_2_3_17_3: true
win2016cis_2_3_17_4: true
win2016cis_2_3_17_5: true
win2016cis_2_3_17_6: true
win2016cis_2_3_17_7: true
win2016cis_2_3_17_8: true
##################
# Section_2_Vars #
##################
win2016cis_DC_access_from_network: Administrators Authenticated Users ENTERPRISE DOMAIN CONTROLLERS
win2016cis_MS_access_from_network: Administrators Authenticated Users
win2016cis_DC_allow_logon_local_users: Administrators
win2016cis_MS_allow_logon_local_users: Administrators
win2016cis_DC_allow_logon_RDP_users: Administrators
win2016cis_MS_allow_logon_RDP_users: Administrators Remote Desktop Users
win2016_admin_renamed_as: renamed_admin
win2016_guest_renamed_as: renamed_guest
win2016cis_logon_text: 'You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.'
win2016cis_logon_title: 'DoD Notice and Consent Banner'
########################
## Section_9_Controls ##
########################
# 9.1 Domain Profile Firewall
win2016cis_9_1_1: true
win2016cis_9_1_2: true
win2016cis_9_1_3: true
win2016cis_9_1_4: true
win2016cis_9_1_5: true
win2016cis_9_1_6: true
win2016cis_9_1_7: true
win2016cis_9_1_8: true
# 9.2 Private Profile Firewall
win2016cis_9_2_1: true
win2016cis_9_2_2: true
win2016cis_9_2_3: true
win2016cis_9_2_4: true
win2016cis_9_2_5: true
win2016cis_9_2_6: true
win2016cis_9_2_7: true
win2016cis_9_2_8: true
# 9.3 Public Profile Firewall
win2016cis_9_3_1: true
win2016cis_9_3_2: true
win2016cis_9_3_3: true
win2016cis_9_3_4: true
win2016cis_9_3_5: true
win2016cis_9_3_6: true
win2016cis_9_3_7: true
win2016cis_9_3_8: true
win2016cis_9_3_9: true
win2016cis_9_3_10: true
##################
# Section_9_Vars #
##################
#########################
## Section_17_Controls ##
#########################
# Advanced Audit Policy Configuration
# 17.1 Account Logon
win2016cis_17_1_1: true
win2016cis_17_1_2: true
win2016cis_17_1_3: true # DC_Only
# 17.2 Account Management
win2016cis_17_2_1: true
win2016cis_17_2_2: true # DC_Only
win2016cis_17_2_3: true # DC_Only
win2016cis_17_2_4: true # DC_Only
win2016cis_17_2_5: true
win2016cis_17_2_6: true
# 17.3 Detailed Tracking
win2016cis_17_3_1: true
win2016cis_17_3_2: true
# 17.4 DS Access
win2016cis_17_4_1: true # DC Only
win2016cis_17_4_2: true # DC Only
# 17.5 logon/off
win2016cis_17_5_1: true
win2016cis_17_5_2: true
win2016cis_17_5_3: true
win2016cis_17_5_4: true
win2016cis_17_5_5: true
win2016cis_17_5_6: true
# 17.6 Object Access
win2016cis_17_6_1: true
win2016cis_17_6_2: true
win2016cis_17_6_3: true
win2016cis_17_6_4: true
# 17.7 Policy Change
win2016cis_17_7_1: true
win2016cis_17_7_2: true
win2016cis_17_7_3: true
win2016cis_17_7_4: true
win2016cis_17_7_5: true
# 17.8 Privilege Use
win2016cis_17_8_1: true
# 17.9 System
win2016cis_17_9_1: true
win2016cis_17_9_2: true
win2016cis_17_9_3: true
win2016cis_17_9_4: true
win2016cis_17_9_5: true
###################
# Section_17_Vars #
###################
#########################
## Section_18_Controls ##
#########################
# 18 Administrative Templates
# 18.1 Control Panel
# 18.1.1 Personalization
win2016cis_18_1_1_1: true
win2016cis_18_1_1_2: true
# 18.1.2 Regional and Language Options
# 18.1.2.1 Handwriting Personalization
win2016cis_18_1_2_2: true
win2016cis_18_1_3: true
# 18.2 LAPS - Needs LAPS installed per host
win2016cis_18_2_1: true
win2016cis_18_2_2: true
win2016cis_18_2_3: true
win2016cis_18_2_4: true
win2016cis_18_2_5: true
win2016cis_18_2_6: true
# 18.3 MS Security
win2016cis_18_3_1: true
win2016cis_18_3_2: true
win2016cis_18_3_3: true
win2016cis_18_3_4: true
win2016cis_18_3_5: true
win2016cis_18_3_6: true
win2016cis_18_3_7: true
# 18.4 MSS Legacy
win2016cis_18_4_1: true
win2016cis_18_4_2: true
win2016cis_18_4_3: true
win2016cis_18_4_4: true
win2016cis_18_4_5: true
win2016cis_18_4_6: true
win2016cis_18_4_7: true
win2016cis_18_4_8: true
win2016cis_18_4_9: true
win2016cis_18_4_10: true
win2016cis_18_4_11: true
win2016cis_18_4_12: true
# 18.5 Network
# 18.5.1 Background Intelligent Transfer
# 18.5.2 Branch Cache
# 18.5.3 DirectAccess Client Experience Settings
# 18 5.4 DNS Client
win2016cis_18_5_4_1: true
# 18.5.5 Fonts
win2016cis_18_5_5_1: true
# 18.5.6 Hotspot Authentication
# 18.5.7 lanwamn Server
# 18.5.8 Lanman WorkStation
win2016cis_18_5_8_1: true
# 18.5.9 Link-Layer Topology Discovery
win2016cis_18_5_9_1: true
win2016cis_18_5_9_2: true
# 18.5.10 Microsoft Peer-To-Peer Networking Services
# 18.5.10.1 Peer Name Resolution Protocol
win2016cis_18_5_10_2: true
# 18.5.11 Network Connections
# 18.5.11.1 Windows Defender Firewall (formally Windows Firewall)
win2016cis_18_5_11_2: true
win2016cis_18_5_11_3: true
win2016cis_18_5_11_4: true
# 18.5.12 Network Connectivity Status Indicator
# 18.5.13 Network Isolation
# 18.5.14 Network Provider
win2016cis_18_5_14_1: true # NOte Network Paths will need to ne configured for this to pass
# 18.5.15 Offline Files
# 18.5.16 QoS Packet Scheduler
# 18.5.17 SNMP
# 18.5.18 SSL Configuration Settings
# 18.15.9 TCPIP Settings
# 18.5.19.1 IPv6 Transitoin Technologies
# 18.5.19.2 Paranters
win2016cis_18_5_19_2_1: true
# 18.5 20 Windows Connect Now
win2016cis_18_5_20_1: true
win2016cis_18_5_20_2: true
# 18.5.21 Windows Connection Manager
win2016cis_18_5_21_1: true
win2016cis_18_5_21_2: true
# 18.5.6 Printers
# 18.7.Start Menu and Taskbar
# 18.7.1 Notifications
win2016cis_18_7_1_1: true
# 18.8 System
# 18.8.1 Access-Denied Assistance
# 18.8.2 App-V
# 18.8.3 Audit Process Creation
win2016cis_18_8_3_1: true
# 18.8.4 Credential Delegation
win2016cis_18_8_4_1: true
win2016cis_18_8_4_2: true
# 18.8.5 Device Guard
win2016cis_18_8_5_1: true
win2016cis_18_8_5_2: true
win2016cis_18_8_5_3: true
win2016cis_18_8_5_4: true
win2016cis_18_8_5_5: true
win2016cis_18_8_5_6: true
win2016cis_18_8_5_7: true
# 18.8.6 Device Health Attenstation Servic
# 18.8.7 Device Installation
# 18.8.8 Device Redirection
# 18.8.9 Disk NV Cache
# 18.8.10 Disk Quotas
# 18.8.11 Display
# 18.8.12 Distributed COM
# 18.8.13 Driver Installation
# 18.8.14 Early Launch AntiMalware
win2016cis_18_8_14_1: true
# 18.8.15 Enhanced Storage Access
# 18.8.16 DFile Classification Infrastructure
# 18.7.17 File Share Shadow Copy Agent
# 18.8.18 File Share Shadow Copy Provider
# 18.8.19 FileSystems (Formerly NTFS FileSystem)
# 18.8.20 Folder Redirecion
# 18.8.21 Group Policy
# 18.8.21.1 Logging and Tracing
win2016cis_18_8_21_2: true
win2016cis_18_8_21_3: true
win2016cis_18_8_21_4: true
win2016cis_18_8_21_5: true
# 18.8.22 Internet Communication Managemnet
# 18.8.22.1 Internet Communication Settings
win2016cis_18_8_22_1_1: true
win2016cis_18_8_22_1_2: true
win2016cis_18_8_22_1_3: true
win2016cis_18_8_22_1_4: true
win2016cis_18_8_22_1_5: true
win2016cis_18_8_22_1_6: true
win2016cis_18_8_22_1_7: true
win2016cis_18_8_22_1_8: true
win2016cis_18_8_22_1_9: true
win2016cis_18_8_22_1_10: true
win2016cis_18_8_22_1_11: true
win2016cis_18_8_22_1_12: true
win2016cis_18_8_22_1_13: true
# 18.8.23 iSCSI
# 18.8.24 KDC
# 18.8.25 Kerberos
win2016cis_18_8_25_1: true
# 18.8.26 Kernel DMA Protection
# 18.8.27 Locale Services
win2016cis_18_8_27_1: true
# 18.8.28 Login
win2016cis_18_8_28_1: true
win2016cis_18_8_28_2: true
win2016cis_18_8_28_3: true
win2016cis_18_8_28_4: true
win2016cis_18_8_28_5: true
win2016cis_18_8_28_6: true
win2016cis_18_8_28_7: true
# 18.8.29 Mitigation Options
# 18.8.30 Net Logon
# 18.8.31 OS Policies
# 18.8.32 Performance Control Panel
# 18.8.33 PIN Complexity
# 18.8.34 Power Management
# 18.8.34.1 Button Settings
# 18.8.34.2 Energy Saver Settings
# 18.8.34.3 Hard Disk Settings
# 18.8.34.4 Notification Settings
# 18.8.34.5 Power Throttling Settings
# 18.8.34.6 Sleep Settings
win2016cis_18_8_34_6_1: true
win2016cis_18_8_34_6_2: true
win2016cis_18_8_34_6_3: true
win2016cis_18_8_34_6_4: true
# 18.8.35 Recovery
# 18.8.36 Remote Assistance
win2016cis_18_8_36_1: true
win2016cis_18_8_36_2: true
# 18.8.37 Remote Procedure Call
win2016cis_18_8_37_1: true
win2016cis_18_8_37_2: true
# 18.8.38 Removable Storage Access
# 18.8.39 Scripts
# 18.8.40 Server Manager
# 18.8.41 Service Control Manager Settings
# 18.8.42 Shutdown
# 18.8.43 Shutdown Options
# 18.8.44 Storage Health
# 18.8.45 Storage Sense
# 18.8.46 System Restore
# 18.8.47 Troubleshooting and Diagnostics
# 18.8.47.1 Application Compatibility Diagnostics
# 18.8.47.2 Corrupted File Recovery
# 18.8.47.3 Disk Diagnostic
# 18.8.47.4 Fault Tolerant Heap
# 18.8.47.5 Microsoft Support Diagnostic Tool
win2016cis_18_8_47_5_1: true
# 18.8.47.6 MSI Corrupted File Recovery
# 18.8.47.7 Scheduled Maintenance
# 18.8.47.8 Scripted Diagnostics
# 18.8.47.9 Windows Boot Performance Diagnostics
# 18.8.47.10 Windows Memory Leak Diagnosis
# 18.8.47.11 Windows Performance PerfTrack
win2016cis_18_8_47_11_1: true
# 18.8.48 Trusted Platform Module Services
# 18.8.49 User Profiles
win2016cis_18_8_49_1: true
# 18.8.50 Windows File Protection
# 18.8.51 Windows HotStart
# 18.8.52 Windows Time Service
# 18.8.52.1 Time Providers
win2016cis_18_8_52_1_1: true
win2016cis_18_8_52_1_2: true
# 18.9 Windows Components
# 18.9.1 Active Directory Federation Services
# 18.9.2 ActiveX Installer Service
# 18.9.3 Add features to Windows 8 / 8.1 / 10 (formerly Windows Anytime Upgrade)
# 18.9.4 App Package Deployment
win2016cis_18_9_4_1: true
# 18.9.5 App Privacy
# 18.9.6 App runtime
win2016cis_18_9_6_1: true
# 18.9.7 Application Compatibility
# 18.9.8 AutoPlay Policies
win2016cis_18_9_8_1: true
win2016cis_18_9_8_2: true
win2016cis_18_9_8_3: true
# 18.9.9 Backup
# 18.9.10 Biometrics
# 18.9.10.1 Facial Features
win2016cis_18_9_10_1_1: true
# 18.9.11 BitLocker Drive Encryption
# 18.9.12 Camera
win2016cis_18_9_12_1: true
# 18.9.13 Cloud Content
# 18.9.14 Connect
win2016cis_18_9_14_1: true
# 18.9.15 Credential User Interface
win2016cis_18_9_15_1: true
win2016cis_18_9_15_2: true
# 18.9.16 Data Collection and Preview Builds
win2016cis_18_9_16_1: true
win2016cis_18_9_16_2: true
win2016cis_18_9_16_3: true
win2016cis_18_9_16_4: true
# 18.9.17 Delivery Optimization
# 18.9.18 Desktop Gadgets
# 18.9.19 Desktop Window Manager
# 18.9.20 Device and Driver Compatibility
# 18.9.21 Device Registration (formerly Workplace Join)
# 18.9.22 Digital Locker
# 18.9.23 Edge UI
# 18.9.24 EMET
# 18.9.25 Event Forwarding
# 18.9.26 Event Log Service
# 18.9.26.1 Application
win2016cis_18_9_26_1_1: true
win2016cis_18_9_26_1_2: true
# 18.9.26.2 Security
win2016cis_18_9_26_2_1: true
win2016cis_18_9_26_2_2: true
# 18.9.26.3 Setup
win2016cis_18_9_26_3_1: true
win2016cis_18_9_26_3_2: true
# 18.9.26.4 System
win2016cis_18_9_26_4_1: true
win2016cis_18_9_26_4_2: true
# 18.9.27 Event Logging
# 18.9.28 Event Viewer
# 18.9.29 Family Safety (formerly Parental Controls)
# 18.9.30 File Explorer (formerly Windows Explorer)
# 18.9.30.1 Previous Versions
win2016cis_18_9_30_2: true
win2016cis_18_9_30_3: true
win2016cis_18_9_30_4: true
# 18.9.31 File History
# 18.9.32 Find My Device
# 18.9.33 Game Explorer
# 18.9.34 Handwriting
# 18.9.35 HomeGroup
# 18.9.36 Import Video
# 18.9.37 Internet Explorer
# 18.9.38 Internet Information Services
# 18.9.39 Location and Sensors
win2016cis_18_9_39_1: true
# 18.9.40 Maintenance Scheduler
# 18.9.41 Maps
# 18.9.42 MDM
# 18.9.43 Messaging
win2016cis_18_9_43_1: true
# 18.9.44 Microsoft account
win2016cis_18_9_44_1: true
# 18.9.45 Microsoft Edge
# 18.9.46 Microsoft FIDO Authentication
# 18.9.47 Microsoft Secondary Authentication Factor
# 18.9.48 Microsoft User Experience Virtualization
# 18.9.49 NetMeeting
# 18.9.50 Network Access Protection
# 18.9.51 Network Projector
# 18.9.52 OneDrive (formerly SkyDrive)
win2016cis_18_9_52_1: true
# 18.9.53 Online Assistance
# 18.9.54 OOBE
# 18.9.55 Password Synchronization
# 18.9.56 Portable Operating System
# 18.9.57 Presentation Settings
# 18.9.58 Push To Install
# 18.9.59 Remote Desktop Services (formerly Terminal Services)
# 18.9.59.1 RD Licensing (formerly TS Licensing)
# 18.9.59.2 Remote Desktop Connection Client
# 18.9.59.2.1 RemoteFX USB Device Redirection
win2016cis_18_9_59_2_2: true
# 18.9.59.3 Remote Desktop Session Host (formerly Terminal Server)
# 18.9.59.3.1 Application Compatibility
# 18.9.59.3.2 Connections
win2016cis_18_9_59_3_2_1: true
# 18.9.59.3.3 Device and Resource Redirection
win2016cis_18_9_59_3_3_1: true
win2016cis_18_9_59_3_3_2: true
win2016cis_18_9_59_3_3_3: true
win2016cis_18_9_59_3_3_4: true
# 18.9.59.3.4 Licensing
# 18.9.59.3.5 Printer Redirection
# 18.9.59.3.6 Profiles
# 18.9.59.3.7 RD Connection Broker (formerly TS Connection Broker)
# 18.9.59.3.8 Remote Session Environment
# 18.9.59.3.9 Security
win2016cis_18_9_59_3_9_1: true
win2016cis_18_9_59_3_9_2: true
win2016cis_18_9_59_3_9_3: true
win2016cis_18_9_59_3_9_4: true
win2016cis_18_9_59_3_9_5: true
# 18.9.59.3.10 Session Time Limits
win2016cis_18_9_59_3_10_1: true
win2016cis_18_9_59_3_10_2: true
# 18.9.59.3.11 Temporary Folders
win2016cis_18_9_59_3_11_1: true
win2016cis_18_9_59_3_11_2: true
# 18.9.60 RSS Feeds
win2016cis_18_9_60_1: true
# 18.9.61 Search
# 18.9.61.1 OCR
win2016cis_18_9_61_2: true
win2016cis_18_9_61_3: true
# 18.9.62 Security Center
# 18.9.63 Server for NIS
# 18.9.64 Shutdown Options
# 18.9.65 Smart Card
# 18.9.66 Software Protection Platform
win2016cis_18_9_66_1: true
# 18.9.67 Sound Recorder
# 18.9.68 Speech
# 18.9.69 Store
# 18.9.70 Sync Your Tablet
# 18.9.71 Tablet PC
# 18.9.72 Task Scheduler
# 18.9.73 Text Input
# 18.9.74 Windows Calendar
# 18.9.75 Windows Color System
# 18.9.76 Windows Customer Experience Program
# 18.9.77 Windows Defender AntiVirus (formally Windows Defender)
# 18.9.77.1 Client Interface
# 18.9.77.2 Exclusions
# 18.9.77.3 MAPS
win2016cis_18_9_77_3_1: true
win2016cis_18_9_77_3_2: true
# 18.9.77.4 MpEngine
# 18.9.77.5 Network Inspection System
# 18.9.77.6 Quarantine
win2016cis_18_9_77_7_1: true
# 18.9.77.8 Remediation
# 18.9.77.9 Reporting
win2016cis_18_9_77_9_1: true
win2016cis_18_9_77_10_1: true
win2016cis_18_9_77_10_2: true
# 18.9.77.11 Security Intelligence Updates (formerly Signature Updates)
# 18.9.77.12 Threats
# 18.9.77.13 Windows Defender Exploit Guard
# 18.9.77.13.1 Attack Surface Reduction
# 18.9.77.13.2 Controlled Folder Access
# 18.9.77.13.3 Network Protection
win2016cis_18_9_77_13_3_1: true
win2016cis_18_9_77_14: true
win2016cis_18_9_77_15: true
# 18.9.78 Windows Defender Application Guard
# 18.9.79 Windows Defender Exploit Guard
# 18.9.80 Windows Defender SmartScreen
# 18.9.80.1 Explorer
win2016cis_18_9_80_1_1: true
# 18.9.81 Windows Error Reporting
# 18.9.82 Windows Game Recording and Broadcasting
# 18.9.83 Windows Hello for Business (formerly Microsoft Passport for Work)
# 18.9.84 Windows Ink Workspace
win2016cis_18_9_84_1: true
win2016cis_18_9_84_2: true
# 18.9.85 Windows Installer
win2016cis_18_9_85_1: true
win2016cis_18_9_85_2: true
win2016cis_18_9_85_3: true
# 18.9.86 Windows Logon Options
win2016cis_18_9_86_1: true
# 18.9.87 Windows Mail
# 18.9.88 Windows Media Center
# 18.9.89 Windows Media Digital Rights Management
# 18.9.90 Windows Media Player
# 18.9.91 Windows Meeting Space
# 18.9.92 Windows Messenger
# 18.9.93 Windows Mobility Center
# 18.9.94 Windows Movie Maker
# 18.9.95 Windows PowerShell
win2016cis_18_9_95_1: true
win2016cis_18_9_95_2: true
# 18.9.96 Windows Reliability Analysis
# 18.9.97 Windows Remote Management (WinRM)
# 18.9.97.1 WinRM Client
win2016cis_18_9_97_1_1: true
win2016cis_18_9_97_1_2: true
win2016cis_18_9_97_1_3: true
# 18.9.97.2 WinRM Service
win2016cis_18_9_97_2_1: true
win2016cis_18_9_97_2_2: true
win2016cis_18_9_97_2_3: true
win2016cis_18_9_97_2_4: true
# 18.9.98 Windows Remote Shell
win2016cis_18_9_98_1: true
# 18.9.99 Windows Security (formerly Windows Defender Security Center)
# 18.9.99.1 Account protection
# 18.9.99.2 App and browser protection
win2016cis_18_9_99_2_1: true
# 18.9.100 Windows SideShow
# 18.9.101 Windows System Resource Manager
# 18.9.102 Windows Update
# 18.9.102.1 Windows Update for Business (formerly Defer Windows Updates)
win2016cis_18_9_102_1_1: true
win2016cis_18_9_102_1_2: true
win2016cis_18_9_102_1_3: true
win2016cis_18_9_102_2: true
win2016cis_18_9_102_3: true
win2016cis_18_9_102_4: true
###################
# Section_18_Vars #
###################
win2016_eventlog_app_max_size: 65538
win2016_eventlog_sec_max_size: 196608
win2016_eventlog_setup_max_size: 32768
win2016_eventlog_sys_max_size: 65538
win2016cis_autoupdate_enabled: '0'
win2016cis_autoupdate_option: '0' # 2 - Notify for download and auto install # 3 -Auto download and notify for instal # 4 - Auto download and schedule the install
win2016cis_autoupdate_day: 0 # 0 - everyday
##############
# Section_19 #
##############
# 19 Administrative Templates (User)
# 19.1 Control Panel
# 19.1.1 Add or Remove Programs
# 19.1.2 Display
# 19.1.3 Personalization (formerly Desktop Themes)
win2016cis_19_1_3_1: true
win2016cis_19_1_3_2: true
win2016cis_19_1_3_3: true
win2016cis_19_1_3_4: true
# 19.2 Desktop
# 19.3 Network
# 19.4 Shared Folders
# 19.5 Start Menu and Taskbar
# 19.5.1 Notifications
win2016cis_19_5_1_1: true
# 19.6 System
# 19.6.1 Ctrl+Alt+Del Options
# 19.6.2 Display
# 19.6.3 Driver Installation
# 19.6.4 Folder Redirection
# 19.6.5 Group Policy
# 19.6.6 Internet Communication Management
# 19.6.6.1 Internet Communication settings
win2016cis_19_6_6_1_1: true
# 19.7 Windows Components
# 19.7.1 Add features to Windows 8 / 8.1 / 10 (formerly Windows Anytime Upgrade)
# 19.7.2 App runtime
# 19.7.3 Application Compatibility
# 19.7.4 Attachment Manager
win2016cis_19_7_4_1: true
win2016cis_19_7_4_2: true
# 19.7.5 AutoPlay Policies
# 19.7.6 Backup
# 19.7.7 Cloud Content
win2016cis_19_7_7_1: true
win2016cis_19_7_7_2: true
win2016cis_19_7_7_3: true
win2016cis_19_7_7_4: true
# 19.7.8 Credential User Interface
# 19.7.9 Data Collection and Preview Builds
# 19.7.10 Desktop Gadgets
# 19.7.11 Desktop Window Manager
# 19.7.12 Digital Locker
# 19.7.13 Edge UI
# 19.7.14 File Explorer (formerly Windows Explorer)
# 19.7.15 File Revocation
# 19.7.16 IME
# 19.7.17 Import Video
# 19.7.18 Instant Search
# 19.7.19 Internet Explorer
# 19.7.20 Location and Sensors
# 19.7.21 Microsoft Edge
# 19.7.22 Microsoft Management Console
# 19.7.23 Microsoft User Experience Virtualization
# 19.7.24 NetMeeting
# 19.7.25 Network Projector
# 19.7.26 Network Sharing
win2016cis_19_7_26_1: true
# 19.7.27 OOBE
# 19.7.28 Presentation Settings
# 19.7.29 Remote Desktop Services (formerly Terminal Services)
# 19.7.30 RSS Feeds
# 19.7.31 Search
# 19.7.32 Sound Recorder
# 19.7.33 Store
# 19.7.34 Tablet PC
# 19.7.35 Task Scheduler
# 19.7.36 Windows Calendar
# 19.7.37 Windows Color System
# 19.7.38 Windows Defender SmartScreen
# 19.7.39 Windows Error Reporting
# 19.7.40 Windows Hello for Business (formerly Microsoft Passport for Work)
# 19.7.41 Windows Installer
win2016cis_19_7_41_1: true
# 19.7.42 Windows Logon Options
# 19.7.43 Windows Mail
# 19.7.44 Windows Media Center
# 19.7.45 Windows Media Player
# 19.7.45.1 Networking
# 19.7.45.2 Playback
win2016cis_19_7_45_2_1: true
###################
# Section_19_Vars #
###################
win2016cis_screensaver_file: scrnsave.scr
win2016cis_screensaver_timeout: '900'
##############################
## Global command Variables ##
##############################
# powershell commands
reboot_check: 'powershell -c (./scripts/pending_reboot.ps1 localhost).IsPendingReboot'
ps_regcheck: 'powershell -noprofile -noninteractive -command'
gpo_regex_script: 'powershell ./scripts/gpo_regex.ps1'
standalone_script: 'powershell ./scripts/standalone.ps1'
audit_ps_cmd: Select-String -Path
# Registry_paths
# CurrentControlSet/Lsa
# Get Parameter
HKLM_CCS_LANWORK: get-itempropertyValue -path 'HKLM:/SYSTEM/CurrentControlSet/Services/LanmanWorkStation/Parameters'
HKLM_CCS_LANSERVER: get-itempropertyValue -path 'HKLM:/SYSTEM/CurrentControlSet/Services/LanmanServer/Parameters'
HKLM_CCS_LDAP: get-itempropertyValue -path 'HKLM:/SYSTEM/CurrentControlSet/Services/LDAP/'
HKLM_CCS_LSA: get-itempropertyValue -path 'HKLM:/SYSTEM/CurrentControlSet/Control/Lsa/'
HKLM_CCS_NETLOGON: 'HKLM:/SYSTEM/CurrentControlSet/Services/Netlogon/Parameters'
HKLM_CV_SYSTEM: get-itempropertyValue -path 'HKLM:/SOFTWARE/Microsoft/Windows/CurrentVersion/Policies/System/'
HKLM_KERB: get-itempropertyValue -path 'HKLM:/SOFTWARE/Microsoft/Windows/CurrentVersion/Policies/System/Kerberos/Parameters'
HKLM_NT_WINLOGON: get-itempropertyValue -path 'HKLM:/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon'
HKLM_WIN_PERSON: get-itempropertyValue -path 'HKLM:/SOFTWARE/Policies/Microsoft/Windows/Personalization'
HKLM_MS_SVCS: get-itempropertyValue -path 'HKLM:/SOFTWARE/Policies/Microsoft Services/AdmPwd'
HKLM_TCPIP4: get-itempropertyValue -path 'HKLM:/SYSTEM/CurrentControlSet/Services/Tcpip/Parameters'
HKLM_TCPIP6: get-itempropertyValue -path 'HKLM:/SYSTEM/CurrentControlSet/Services/Tcpip6/Parameters'
HKLM_DEV_GUARD: get-ItempropertyValue -path 'HKLM:/SOFTWARE/Policies/Microsoft/Windows/DeviceGuard'
HKLM_WIN_SYSTEM: get-ItempropertyValue -path 'HKLM:/SOFTWARE/Policies/Microsoft/Windows/System'
HKLM_EXPLORER: get-itempropertyValue -path 'HKLM:/SOFTWARE/Policies/Microsoft/Windows/Explorer'
HKLM_CV_EXPLORER: get-itempropertyValue -path 'HKLM:/SOFTWARE/Microsoft/Windows/CurrentVersion/Policies/Explorer'
HKLM_TERM_SVCS: get-itempropertyValue -path 'HKLM:/SOFTWARE/Policies/Microsoft/Windows NT/Terminal Services'
HKLM_WINRM_CLT: get-itempropertyValue -path 'HKLM:/SOFTWARE/Policies/Microsoft/Windows/WinRM/Client'
HKLM_WINRM_SVC: get-itempropertyValue -path 'HKLM:/SOFTWARE/Policies/Microsoft/Windows/WinRM/Service'
HKLM_WIN_UPDATE: get-itempropertyValue -path 'HKLM:/SOFTWARE/Policies/Microsoft/Windows/WindowsUpdate'
HKCU_CP_PERSONAL: get-itempropertyvalue -path 'HKCU:/SOFTWARE/Policies/Microsoft/Windows/Personalization/'
HKCU_CP_DESKTOP: get-itempropertyvalue -path 'HKCU:/SOFTWARE/Policies/Microsoft/Windows/Control Panel/Desktop'
HKLM_POL_FW_DOM: get-itempropertyvalue -path 'HKLM:/SOFTWARE/Policies/Microsoft/WindowsFirewall/DomainProfile'
HKLM_POL_FW_PRV: get-itempropertyvalue -path 'HKLM:/SOFTWARE/Policies/Microsoft/WindowsFirewall/PrivateProfile'
HKLM_POL_FW_PUB: get-itempropertyvalue -path 'HKLM:/SOFTWARE/Policies/Microsoft/WindowsFirewall/PublicProfile'
# Known Security identified names
## https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/security-identifiers-in-windows
everyone_sid: '*S-1-1-0'
auth_users_sid: '*S-1-5-11'
local_svc_sid: '*S-1-5-19'
local_net_sid: '*S-1-5-20'
admin_sid: '*S-1-5-32-544'
user_sid: '*S-1-5-32-545'
guest_sid: '*S-1-5-32-546'
backup_sid: '*S-1-5-32-551'
remote_desktop_sid: '*S-1-5-32-555'
nt_svc_sid: '*S-1-5-80-'