Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-23 17:08:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 83

Update workstations.yml (#17906)

Browse source 
- Add policies Windows 11 CIS Benchmarks
- Remove Windows device health policies
This commit is contained in:
Noah Talerman 2024-03-27 15:50:47 -04:00 committed by GitHub
parent 8aa1dcf84b
commit cf531a242a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 1 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
it-and-security/lib/windows-device-health.policies.yml
View file

@ -1,24 +0,0 @@
- name: Windows - Enable screen saver after 20 minutes
query: SELECT 1 FROM mdm_bridge where mdm_command_input = "<SyncBody><Get><CmdID>1</CmdID><Item><Target><LocURI>./Device/Vendor/MSFT/Policy/Result/DeviceLock/MaxInactivityTimeDeviceLock</LocURI></Target></Item></Get></SyncBody>" and CAST(mdm_command_output AS INT) <= 20;
critical: false
description: This policy checks if maximum amount of time (in minutes) the device is allowed to sit idle before the screen is locked. End users can select any value less than the specified maximum.
resolution: "As an IT admin, to deploy a Windows profile with the MaxInactivityTimeDeviceLock option documented here: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-devicelock#maxinactivitytimedevicelock"
platform: windows
- name: Windows - Enable BitLocker
query: SELECT * FROM bitlocker_info WHERE drive_letter='C:' AND protection_status = 1;
critical: false
description: As an IT admin, turn on disk encryption in Fleet.
resolution: Ask your system administrator to turn on disk encryption in Fleet
platform: windows
- name: Windows - Disable guest account
query: SELECT 1 FROM mdm_bridge where mdm_command_input = "<SyncBody><Get><CmdID>1</CmdID><Item><Target><LocURI>./Device/Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus</LocURI></Target></Item></Get></SyncBody>" and CAST(mdm_command_output AS INT) = 0;
critical: false
description: This policy checks if the guest account is disabled. The Guest account allows unauthenticated network users to gain access to the system.
resolution: "As an IT admin, deploy a Windows profile with the Accounts_EnableGuestAccountStatus option documented here: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#accounts_enableguestaccountstatus"
platform: windows
- name: Windows - Require 10 character password
query: SELECT 1 FROM mdm_bridge where mdm_command_input = "<SyncBody><Get><CmdID>1</CmdID><Item><Target><LocURI>./Device/Vendor/MSFT/Policy/Result/DeviceLock/DevicePasswordEnabled</LocURI></Target></Item></Get></SyncBody>" and CAST(mdm_command_output AS INT) = 0;
critical: false
description: This policy checks if the end user is required to enter a password, with at least 10 characters, to unlock the host.
resolution: "As an IT admin, deploy a Windows profile with the DevicePasswordEnabled and MinDevicePasswordLength option documented here: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-devicelock"
platform: windows

2
it-and-security/teams/workstations.yml
View file

@ -55,8 +55,8 @@ controls:
- path: ../lib/windows-turn-off-mdm.ps1
policies:
- path: ../lib/macos-device-health.policies.yml
- path: ../lib/windows-device-health.policies.yml
- path: ../lib/linux-device-health.policies.yml
- path: ../../ee/cis/win-11/cis-policy-queries.yml
queries:
- path: ../lib/collect-failed-login-attempts.queries.yml
- path: ../lib/collect-usb-devices.queries.yml