From ff5eb0c415b4c4fbc24c718253874ff279932d21 Mon Sep 17 00:00:00 2001 From: erjenkin Date: Tue, 28 Jul 2020 16:44:51 -0400 Subject: [PATCH] added Server 2019 V1R5,removed V1R2 --- CHANGELOG.md | 1 + ...Server_2019_DC_STIG_V1R5_Manual-xccdf.log} | 0 ...Server_2019_DC_STIG_V1R5_Manual-xccdf.xml} | 74 +++++++++++++++++-- ...Server_2019_MS_STIG_V1R5_Manual-xccdf.log} | 0 ...Server_2019_MS_STIG_V1R5_Manual-xccdf.xml} | 70 ++++++++++++++++-- ...ws_Server_2019_STIG_V1R5_Manual-xccdf.xml} | 40 ++++++++-- ...WindowsServer-2019-DC-1.5.org.default.xml} | 2 +- ...-1.2.xml => WindowsServer-2019-DC-1.5.xml} | 42 ++++++++++- ...WindowsServer-2019-MS-1.5.org.default.xml} | 2 +- ...-1.2.xml => WindowsServer-2019-MS-1.5.xml} | 40 +++++++++- 10 files changed, 245 insertions(+), 26 deletions(-) rename source/StigData/Archive/Windows.Server.2019/{U_MS_Windows_Server_2019_DC_STIG_V1R2_Manual-xccdf.log => U_MS_Windows_Server_2019_DC_STIG_V1R5_Manual-xccdf.log} (100%) rename source/StigData/Archive/Windows.Server.2019/{U_MS_Windows_Server_2019_DC_STIG_V1R2_Manual-xccdf.xml => U_MS_Windows_Server_2019_DC_STIG_V1R5_Manual-xccdf.xml} (99%) rename source/StigData/Archive/Windows.Server.2019/{U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.log => U_MS_Windows_Server_2019_MS_STIG_V1R5_Manual-xccdf.log} (100%) rename source/StigData/Archive/Windows.Server.2019/{U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.xml => U_MS_Windows_Server_2019_MS_STIG_V1R5_Manual-xccdf.xml} (99%) rename source/StigData/Archive/Windows.Server.2019/{U_MS_Windows_Server_2019_STIG_V1R2_Manual-xccdf.xml => U_MS_Windows_Server_2019_STIG_V1R5_Manual-xccdf.xml} (89%) rename source/StigData/Processed/{WindowsServer-2019-DC-1.2.org.default.xml => WindowsServer-2019-DC-1.5.org.default.xml} (98%) rename source/StigData/Processed/{WindowsServer-2019-DC-1.2.xml => WindowsServer-2019-DC-1.5.xml} (99%) rename source/StigData/Processed/{WindowsServer-2019-MS-1.2.org.default.xml => WindowsServer-2019-MS-1.5.org.default.xml} (98%) rename source/StigData/Processed/{WindowsServer-2019-MS-1.2.xml => WindowsServer-2019-MS-1.5.xml} (99%) diff --git a/CHANGELOG.md b/CHANGELOG.md index c4bed4d9f..725aac980 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## [Unreleased] +* Update PowerSTIG to successfully parse/apply Windows Server 2019 Instance Ver. 1 Rel. 5: [#683](https://github.com/microsoft/PowerStig/issues/683) * Release Process Update: Ensure the nuget package uses explicit DSC Resource Module Versions: [#667](https://github.com/microsoft/PowerStig/issues/667) * Fixed [#668](https://github.com/microsoft/PowerStig/issues/668): Incorrect key for SSL 3.0 rules in SqlServer-2016-Instance.*.xml * Fixed [#669](https://github.com/microsoft/PowerStig/issues/669): Missing TLS 1.2 configuration for rule V-97521 diff --git a/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R2_Manual-xccdf.log b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R5_Manual-xccdf.log similarity index 100% rename from source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R2_Manual-xccdf.log rename to source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R5_Manual-xccdf.log diff --git a/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R2_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R5_Manual-xccdf.xml similarity index 99% rename from source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R2_Manual-xccdf.xml rename to source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R5_Manual-xccdf.xml index 1513ba911..20a293f7b 100644 --- a/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R2_Manual-xccdf.xml +++ b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R5_Manual-xccdf.xml @@ -1,15 +1,15 @@  - accepted + accepted Windows Server 2019 Security Technical Implementation Guide This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil. - + DISA STIG.DOD.MIL - Release: 2 Benchmark Date: 26 Jul 2019 + Release: 5 Benchmark Date: 17 Jun 2020 1 I - Mission Critical Classified @@ -317,6 +317,7 @@ I - Mission Critical Public @@ -624,6 +625,7 @@ I - Mission Critical Sensitive @@ -931,6 +933,7 @@ II - Mission Support Classified @@ -1238,6 +1241,7 @@ II - Mission Support Public @@ -1545,6 +1549,7 @@ II - Mission Support Sensitive @@ -1852,6 +1857,7 @@ III - Administrative Classified @@ -2159,6 +2165,7 @@ III - Administrative Public @@ -2466,6 +2473,7 @@ III - Administrative Sensitive @@ -2773,6 +2781,7 @@ SRG-OS-000028-GPOS-00009 @@ -6254,7 +6263,7 @@ Value: 0x00000001 (1) SRG-OS-000042-GPOS-00020 <GroupDescription></GroupDescription> - + WN19-CC-000460 Windows Server 2019 PowerShell script block logging must be enabled. <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. @@ -6270,12 +6279,12 @@ Enabling PowerShell script block logging will record detailed information from t CCI-000135 Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> "Turn on PowerShell Script Block Logging" to "Enabled". - + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ Value Name: EnableScriptBlockLogging @@ -6853,12 +6862,12 @@ If the "Password Last Set" date is more than one year old, this is a finding. SRG-OS-000480-GPOS-00227 <GroupDescription></GroupDescription> - + WN19-DC-000430 The password for the krbtgt account on a domain must be reset at least every 180 days. <VulnDiscussion>The krbtgt account acts as a service account for the Kerberos Key Distribution Center (KDC) service. The account and password are created when a domain is created and the password is typically not changed. If the krbtgt account is compromised, attackers can create valid Kerberos Ticket Granting Tickets (TGT). -The password must be changed twice to effectively remove the password history. Changing once, waiting for replication to complete and changing again reduces the risk of issues. Changing twice in rapid succession forces clients to re-authenticate (including application services) but is desired if a compromise is suspected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +The password must be changed twice to effectively remove the password history. Changing once, waiting for replication to complete and the amount of time equal to or greater than the maximum Kerberos ticket lifetime, and changing again reduces the risk of issues.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> DPMS Target Windows 2019 DISA @@ -13705,6 +13714,55 @@ The configuration requirements will be determined by the applicable firewall STI + + WN19-CC-000451 + <GroupDescription></GroupDescription> + + WN19-CC-000451 + The Windows Explorer Preview pane must be disabled for Windows Server 2019. + <VulnDiscussion>A known vulnerability in Windows could allow the execution of malicious code by either opening a compromised document or viewing it in the Windows Preview pane. + +Organizations must disable the Windows Preview pane and Windows Detail pane.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following settings are configured for Windows Server 2019 locally or applied through group policy. + +Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane "Turn off Preview Pane" to "Enabled". + +Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane "Turn on or off details pane" to "Enabled" and "Configure details pane" to "Always hide". + + + + + If the following registry values do not exist or are not configured as specified, this is a finding: + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + +Value Name: NoPreviewPane + +Value Type: REG_DWORD + +Value: 1 + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + +Value Name: NoReadingPane + +Value Type: REG_DWORD + +Value: 1 + + + + SRG-OS-000297-GPOS-00115 <GroupDescription></GroupDescription> diff --git a/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.log b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R5_Manual-xccdf.log similarity index 100% rename from source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.log rename to source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R5_Manual-xccdf.log diff --git a/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R5_Manual-xccdf.xml similarity index 99% rename from source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.xml rename to source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R5_Manual-xccdf.xml index 258db95ac..2c2a06478 100644 --- a/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.xml +++ b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R5_Manual-xccdf.xml @@ -1,16 +1,16 @@  - accepted + accepted Windows Server 2019 Security Technical Implementation Guide This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil. - + DISA STIG.DOD.MIL - Release: 2 Benchmark Date: 26 Jul 2019 + Release: 5 Benchmark Date: 17 Jun 2020 1 I - Mission Critical Classified @@ -318,6 +318,7 @@ I - Mission Critical Public @@ -625,6 +626,7 @@ I - Mission Critical Sensitive @@ -932,6 +934,7 @@ II - Mission Support Classified @@ -1239,6 +1242,7 @@ II - Mission Support Public @@ -1546,6 +1550,7 @@ II - Mission Support Sensitive @@ -1853,6 +1858,7 @@ III - Administrative Classified @@ -2160,6 +2166,7 @@ III - Administrative Public @@ -2467,6 +2474,7 @@ III - Administrative Sensitive @@ -2774,6 +2782,7 @@ SRG-OS-000028-GPOS-00009 @@ -5022,7 +5031,7 @@ Value: 0x00000001 (1) SRG-OS-000042-GPOS-00020 <GroupDescription></GroupDescription> - + WN19-CC-000460 Windows Server 2019 PowerShell script block logging must be enabled. <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. @@ -5038,12 +5047,12 @@ Enabling PowerShell script block logging will record detailed information from t CCI-000135 Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> "Turn on PowerShell Script Block Logging" to "Enabled". - + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ Value Name: EnableScriptBlockLogging @@ -11892,6 +11901,55 @@ The configuration requirements will be determined by the applicable firewall STI + + WN19-CC-000451 + <GroupDescription></GroupDescription> + + WN19-CC-000451 + The Windows Explorer Preview pane must be disabled for Windows Server 2019. + <VulnDiscussion>A known vulnerability in Windows could allow the execution of malicious code by either opening a compromised document or viewing it in the Windows Preview pane. + +Organizations must disable the Windows Preview pane and Windows Detail pane.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following settings are configured for Windows Server 2019 locally or applied through group policy. + +Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane "Turn off Preview Pane" to "Enabled". + +Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane "Turn on or off details pane" to "Enabled" and "Configure details pane" to "Always hide". + + + + + If the following registry values do not exist or are not configured as specified, this is a finding: + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + +Value Name: NoPreviewPane + +Value Type: REG_DWORD + +Value: 1 + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + +Value Name: NoReadingPane + +Value Type: REG_DWORD + +Value: 1 + + + + SRG-OS-000297-GPOS-00115 <GroupDescription></GroupDescription> diff --git a/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_STIG_V1R2_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_STIG_V1R5_Manual-xccdf.xml similarity index 89% rename from source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_STIG_V1R2_Manual-xccdf.xml rename to source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_STIG_V1R5_Manual-xccdf.xml index 82cd3126e..13c9e3533 100644 --- a/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_STIG_V1R2_Manual-xccdf.xml +++ b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_STIG_V1R5_Manual-xccdf.xml @@ -1,4 +1,4 @@ -acceptedWindows Server 2019 Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 2 Benchmark Date: 26 Jul 20191I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>