Content irrelevant IDs falsify the result

[svndh]

What i did

I performed an AuditTAP report for Windows Server 2022 DC with the latest version on a Domain-Controller 2022 and reviewed the result within the area "Hardening settings"

What i noticed

Concerning ID 2.3.10.9 A, 2.3.10.9 B and 2.3.10.9 C all of these split IDs are scored although only one entry can be true. In this case (see following screenshot) two tasks with the status false falsify the result because in the end the combination of 2.3.10.9 A and its status implies that the remaining tasks of 2.3.10.9 B and 2.3.10.9 C can no longer be relevant in terms of content and must therefore be excluded from the scoring --> Status = None

What to do

Please check this behaviour in this and other reports and verify if the interdependencies are taken into account.

[qngngyn]

Fix can only be done for servers 16, 19, 22
12 can't be done.

[TuemmlerKelch]

Hi @qngngyn,
I merged the Pull Request, however I would like to understand the issue when it comes to Server 2012, maybe we can establish a workaround.
Leaving this open for now

[qngngyn]

@TuemmlerKelch
The function used to determine whether a system has CA Services or WINS Role Feature installed is Get-WindowsFeature. I could not find a way to do this in Windows Server 2012.

I consulted the following sources:

• Learning how to remove and install WindowsFeatures: https://learn.microsoft.com/en-us/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features
• Specification on how to activate CA Services on servers: https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/install-the-certification-authority

Both sources used the "Get-WindowsFeature" cmdlet which does not exist on freshly installed Windows Server 2012.

[TuemmlerKelch]

@qngngyn I suppose we do a check if ServerManager module exists on the target system. If that is not the case, we cannot use Get-WindowsFeature and resort to just carrying out of all the checks. Then the user will have to manually check.