Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-24 09:28:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 60

Pushing CIS policies for bullets 18.9.108.x.x (#10742)

Browse source 
This relates to #10367
This commit is contained in:
Marcos Oviedo 2023-04-06 17:27:20 -03:00 committed by GitHub
parent 9f6c803b4f
commit 4419820707
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 142 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

142
ee/cis/win-10/cis-policy-queries.yml
View file

@ -6414,6 +6414,148 @@ spec:
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'No auto-restart with logged on users for scheduled automatic updates installations' is set to 'Disabled'
platforms: win10
platform: windows
description: |
This policy setting specifies that Automatic Updates will wait for computers to be restarted by the users who are logged on to them to complete a scheduled installation.
resolution: |
To establish the recommended configuration via GP, set the following UI path to 'Disabled':
'Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update\Legacy Policies\No auto-restart with logged on users for scheduled automatic updates installations'
query: |
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoRebootWithLoggedOnUsers' AND data = 0);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_18.9.108.1.1
contributors: marcosd4h
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'Configure Automatic Updates' is set to 'Enabled: 3'
platforms: win10
platform: windows
description: |
This policy setting specifies whether computers in your environment will receive security updates from Windows Update or WSUS. If you configure this policy setting to Enabled, the operating system will recognize when a network connection is available and then use the network connection to search Windows Update or your designated intranet site for updates that apply to them.
resolution: |
To establish the recommended configuration via GP, set the following UI path to 'Enabled: 3':
'Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update\Manage end user experience\Configure Automatic Updates'
query: |
SELECT EXISTS (
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoUpdate' AND data = 0)
) AND EXISTS (
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AUOptions' AND data = 3)
);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_18.9.108.2.1
contributors: marcosd4h
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'Configure Automatic Updates: Scheduled install day' is set to '0 - Every day'
platforms: win10
platform: windows
description: |
This policy setting specifies when computers in your environment will receive security updates from Windows Update or WSUS.
resolution: |
To establish the recommended configuration via GP, set the following UI path to '0 - Every day':
'Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update\Manage end user experience\Configure Automatic Updates: Scheduled install day'
query: |
SELECT EXISTS (
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoUpdate' AND data = 0)
) AND EXISTS (
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\ScheduledInstallDay' AND data = 0)
);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_18.9.108.2.2
contributors: marcosd4h
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'Remove access to "Pause updates" feature' is set to 'Enabled'
platforms: win10
platform: windows
description: |
This policy removes access to "Pause updates" feature.
resolution: |
To establish the recommended configuration via GP, set the following UI path to 'Enabled':
'Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update\Manage end user experience\Remove access to "Pause updates" feature'
query: |
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\SetDisablePauseUXAccess' AND data = 1);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_18.9.108.2.3
contributors: marcosd4h
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'Manage preview builds' is set to 'Disabled'
platforms: win10
platform: windows
description: |
This policy setting manage which updates that are receive prior to the update being released.
resolution: |
To establish the recommended configuration via GP, set the following UI path to 'Disabled':
'Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update\Manage updates offered from Windows Update\Manage preview builds'
query: |
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\ManagePreviewBuildsPolicyValue' AND data = 1);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_18.9.108.4.1
contributors: marcosd4h
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'Select when Preview Builds and Feature Updates are received' is set to 'Enabled: 180 or more days'
platforms: win10
platform: windows
description: |
This policy setting determines when Preview Build or Feature Updates are received.
resolution: |
To establish the recommended configuration via GP, set the following UI path to 'Enabled: 180 or more days':
'Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update\Manage updates offered from Windows Update\Windows Update for Business\Select when Preview Builds and Feature Updates are received'
query: |
SELECT EXISTS (
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DeferFeatureUpdates' AND data = 1)
) AND EXISTS (
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DeferFeatureUpdatesPeriodInDays' AND data >= 180)
);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_18.9.108.4.2
contributors: marcosd4h
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'Select when Quality Updates are received' is set to 'Enabled: 0 days'
platforms: win10
platform: windows
description: |
This settings controls when Quality Updates are received.
resolution: |
To establish the recommended configuration via GP, set the following UI path to 'Enabled: 0 days':
'Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update\Windows Update for Business\Select when Quality Updates are received'
query: |
SELECT EXISTS (
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DeferQualityUpdates' AND data = 1)
) AND EXISTS (
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DeferQualityUpdatesPeriodInDays' AND data = 0)
);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_18.9.108.4.3
contributors: marcosd4h
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'Do not preserve zone information in file attachments' is set to 'Disabled'