controls/advanced_audit_policy_configuration.rb
# frozen_string_literal: true

title 'Advanced Audit Policy Configuration'

control 'windows-146' do
  title 'Ensure \'Audit Credential Validation\' is set to \'Success and Failure\''
  desc 'This subcategory reports the results of validation tests on credentials submitted for a user account logon request. These events occur on the computer that is authoritative for the credentials. For domain accounts, the domain controller is authoritative, whereas for local accounts, the local computer is authoritative. In domain environments, most of the Account Logon events occur in the Security log of the domain controllers that are authoritative for the domain accounts. However, these events can occur on other computers in the organization when local accounts are used to log on. Events for this subcategory include:

  * 4774: An account was mapped for logon.
  * 4775: An account could not be mapped for logon.
  * 4776: The domain controller attempted to validate the credentials for an account.
  * 4777: The domain controller failed to validate the credentials for an account.
  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.1.1'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.1.1'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Credential Validation') { should eq 'Success and Failure' }
  end
end

control 'windows-147' do
  title 'Ensure \'Audit Application Group Management\' is set to \'Success and Failure\''
  desc 'This policy setting allows you to audit events generated by changes to application groups such as the following:

  * Application group is created, changed, or deleted.
  * Member is added or removed from an application group.
  Application groups are utilized by Windows Authorization Manager, which is a flexible framework created by Microsoft for integrating role-based access control (RBAC) into applications. More information on Windows Authorization Manager is available at [MSDN - Windows Authorization Manager](https://msdn.microsoft.com/en-us/library/bb897401.aspx).

  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.2.1'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.2.1'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Application Group Management') { should eq 'Success and Failure' }
  end
end

control 'windows-148' do
  title 'Ensure \'Audit Computer Account Management\' is set to \'Success and Failure\''
  desc 'This subcategory reports each event of computer account management, such as when a computer account is created, changed, deleted, renamed, disabled, or enabled. Events for this subcategory include:

  * 4741: A computer account was created.
  * 4742: A computer account was changed.
  * 4743: A computer account was deleted.
  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.2.2'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.2.2'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Computer Account Management') { should eq 'Success and Failure' }
  end
end

control 'windows-149' do
  title 'Ensure \'Audit Distribution Group Management\' is set to \'Success and Failure\' (DC only)\''
  desc 'This subcategory reports each event of distribution group management, such as when a distribution group is created, changed, or deleted or when a member is added to or removed from a distribution group. If you enable this Audit policy setting, administrators can track events to detect malicious, accidental, and authorized creation of group accounts. Events for this subcategory include:

  - 4744: A security-disabled local group was created.
  - 4745: A security-disabled local group was changed.
  - 4746: A member was added to a security-disabled local group.
  - 4747: A member was removed from a security-disabled local group.
  - 4748: A security-disabled local group was deleted.
  - 4749: A security-disabled global group was created.
  - 4750: A security-disabled global group was changed.
  - 4751: A member was added to a security-disabled global group.
  - 4752: A member was removed from a security-disabled global group.
  - 4753: A security-disabled global group was deleted.
  - 4759: A security-disabled universal group was created.
  - 4760: A security-disabled universal group was changed.
  - 4761: A member was added to a security-disabled universal group.
  - 4762: A member was removed from a security-disabled universal group.
  - 4763: A security-disabled universal group was deleted.

  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.2.3'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.2.3'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  only_if('This Control only executes if attribute(\'ms_or_dc\') is set to MS') do
    input('ms_or_dc') == 'DC'
  end
  describe audit_policy do
    its('Distribution Group Management') { should eq 'Success and Failure' }
  end
end

control 'windows-150' do
  title 'Ensure \'Audit Other Account Management Events\' is set to \'Success and Failure\''
  desc 'This subcategory reports other account management events. Events for this subcategory include:

  * 4782: The password hash an account was accessed.
  * 4793: The Password Policy Checking API was called.
  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.2.4'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.2.4'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Other Account Management Events') { should eq 'Success and Failure' }
  end
end

control 'windows-151' do
  title 'Ensure \'Audit Security Group Management\' is set to \'Success and Failure\''
  desc 'This subcategory reports each event of security group management, such as when a security group is created, changed, or deleted or when a member is added to or removed from a security group. If you enable this Audit policy setting, administrators can track events to detect malicious, accidental, and authorized creation of security group accounts. Events for this subcategory include:

  * 4727: A security-enabled global group was created.
  * 4728: A member was added to a security-enabled global group.
  * 4729: A member was removed from a security-enabled global group.
  * 4730: A security-enabled global group was deleted.
  * 4731: A security-enabled local group was created.
  * 4732: A member was added to a security-enabled local group.
  * 4733: A member was removed from a security-enabled local group.
  * 4734: A security-enabled local group was deleted.
  * 4735: A security-enabled local group was changed.
  * 4737: A security-enabled global group was changed.
  * 4754: A security-enabled universal group was created.
  * 4755: A security-enabled universal group was changed.
  * 4756: A member was added to a security-enabled universal group.
  * 4757: A member was removed from a security-enabled universal group.
  * 4758: A security-enabled universal group was deleted.
  * 4764: A group\'s type was changed.
  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.2.5'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.2.5'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Security Group Management') { should eq 'Success and Failure' }
  end
end

control 'windows-152' do
  title 'Ensure \'Audit User Account Management\' is set to \'Success and Failure\''
  desc 'This subcategory reports each event of user account management, such as when a user account is created, changed, or deleted; a user account is renamed, disabled, or enabled; or a password is set or changed. If you enable this Audit policy setting, administrators can track events to detect malicious, accidental, and authorized creation of user accounts. Events for this subcategory include:

  * 4720: A user account was created.
  * 4722: A user account was enabled.
  * 4723: An attempt was made to change an account\'s password.
  * 4724: An attempt was made to reset an account\'s password.
  * 4725: A user account was disabled.
  * 4726: A user account was deleted.
  * 4738: A user account was changed.
  * 4740: A user account was locked out.
  * 4765: SID History was added to an account.
  * 4766: An attempt to add SID History to an account failed.
  * 4767: A user account was unlocked.
  * 4780: The ACL was set on accounts which are members of administrators groups.
  * 4781: The name of an account was changed:
  * 4794: An attempt was made to set the Directory Services Restore Mode.
  * 5376: Credential Manager credentials were backed up.
  * 5377: Credential Manager credentials were restored from a backup.
  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.2.6'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.2.6'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('User Account Management') { should eq 'Success and Failure' }
  end
end

control 'windows-153' do
  title '(L1) Ensure \'Audit PNP Activity\' is set to \'Success\''
  desc 'This policy setting allows you to audit when plug and play detects an external device.

  The recommended state for this setting is: Success.

  **Note:** A Windows 10, Server 2016 or higher OS is required to access and set this value in Group Policy.'
  impact 1.0
  tag 'windows': %w(2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.3.1'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  only_if('Only for Windows Server 2016, 2019') do
    ((os[:name].include? '2016') || (os[:name].include? '2019'))
  end
  describe audit_policy do
    its('Plug and Play Events') { should eq 'Success' }
  end
end

control 'windows-154' do
  title 'Ensure \'Audit Process Creation\' is set to \'Success\''
  desc 'This subcategory reports the creation of a process and the name of the program or user that created it. Events for this subcategory include:

  * 4688: A new process has been created.
  * 4696: A primary token was assigned to process.
  Refer to Microsoft Knowledge Base article 947226: [Description of security events in Windows Vista and in Windows Server 2008](https://support.microsoft.com/en-us/kb/947226) for the most recent information about this setting.

  The recommended state for this setting is: Success.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.3.1'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.3.2'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']

  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Process Creation') { should eq 'Success' }
  end
end

control 'windows-156' do
  title 'Ensure \'Audit Directory Service Access\' is set to \'Success and Failure\' (DC only)'
  desc 'This subcategory reports when an AD DS object is accessed. Only objects with SACLs cause audit events to be generated, and only when they are accessed in a manner that matches their SACL. These events are similar to the directory service access events in previous versions of Windows Server. This subcategory applies only to Domain Controllers. Events for this subcategory include:

  * 4662 : An operation was performed on an object.
  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.4.1'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.4.1'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  only_if('This Control only executes if attribute(\'ms_or_dc\') is set to MS') do
    input('ms_or_dc') == 'DC'
  end
  describe audit_policy do
    its('Directory Service Access') { should eq 'Success and Failure' }
  end
end

control 'windows-157' do
  title 'Ensure \'Audit Directory Service Changes\' is set to \'Success and Failure\' (DC only)'
  desc 'This subcategory reports changes to objects in Active Directory Domain Services (AD DS). The types of changes that are reported are create, modify, move, and undelete operations that are performed on an object. DS Change auditing, where appropriate, indicates the old and new values of the changed properties of the objects that were changed. Only objects with SACLs cause audit events to be generated, and only when they are accessed in a manner that matches their SACL. Some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. This subcategory applies only to Domain Controllers. Events for this subcategory include:

    * 5136 : A directory service object was modified.
    * 5137 : A directory service object was created.
    * 5138 : A directory service object was undeleted.
    * 5139 : A directory service object was moved.
    The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.4.2'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.4.2'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  only_if('This Control only executes if attribute(\'ms_or_dc\') is set to MS') do
    input('ms_or_dc') == 'DC'
  end
  describe audit_policy do
    its('Directory Service Changes') { should eq 'Success and Failure' }
  end
end

control 'windows-158' do
  title 'Ensure \'Audit Account Lockout\' is set to \'Success and Failure\''
  desc 'This subcategory reports when a user\'s account is locked out as a result of too many failed logon attempts. Events for this subcategory include:

  * 4625: An account failed to log on.
  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.5.1'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.5.1'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Account Lockout') { should eq 'Success and Failure' }
  end
end

control 'windows-159' do
  title 'Ensure \'Audit Group Membership\' is set to \'Success\''
  desc 'This policy allows you to audit the group membership information in the user&#x2019;s logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource.

  The recommended state for this setting is: Success.

  **Note:** A Windows 10, Server 2016 or higher OS is required to access and set this value in Group Policy.'
  impact 1.0
  tag 'windows': %w(2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.5.2'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  only_if('Only for Windows Server 2016, 2019') do
    ((os[:name].include? '2016') || (os[:name].include? '2019'))
  end
  describe audit_policy do
    its('Group Membership') { should eq 'Success' }
  end
end

control 'windows-160' do
  title 'Ensure \'Audit Logoff\' is set to \'Success\''
  desc 'This subcategory reports when a user logs off from the system. These events occur on the accessed computer. For interactive logons, the generation of these events occurs on the computer that is logged on to. If a network logon takes place to access a share, these events generate on the computer that hosts the accessed resource. If you configure this setting to No auditing, it is difficult or impossible to determine which user has accessed or attempted to access organization computers. Events for this subcategory include:

  * 4634: An account was logged off.
  * 4647: User initiated logoff.
  The recommended state for this setting is: Success.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.5.2'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.5.3'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Logoff') { should eq 'Success' }
  end
end

control 'windows-161' do
  title 'Ensure \'Audit Logon\' is set to \'Success and Failure\''
  desc 'This subcategory reports when a user attempts to log on to the system. These events occur on the accessed computer. For interactive logons, the generation of these events occurs on the computer that is logged on to. If a network logon takes place to access a share, these events generate on the computer that hosts the accessed resource. If you configure this setting to No auditing, it is difficult or impossible to determine which user has accessed or attempted to access organization computers. Events for this subcategory include:

  * 4624: An account was successfully logged on.
  * 4625: An account failed to log on.
  * 4648: A logon was attempted using explicit credentials.
  * 4675: SIDs were filtered.
  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.5.3'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.5.4'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Logon') { should eq 'Success and Failure' }
  end
end

control 'windows-162' do
  title 'Ensure \'Audit Other Logon/Logoff Events\' is set to \'Success and Failure\''
  desc 'This subcategory reports other logon/logoff-related events, such as Terminal Services session disconnects and reconnects, using RunAs to run processes under a different account, and locking and unlocking a workstation. Events for this subcategory include:

  * 4649: A replay attack was detected.
  * 4778: A session was reconnected to a Window Station.
  * 4779: A session was disconnected from a Window Station.
  * 4800: The workstation was locked.
  * 4801: The workstation was unlocked.
  * 4802: The screen saver was invoked.
  * 4803: The screen saver was dismissed.
  * 5378: The requested credentials delegation was disallowed by policy.
  * 5632: A request was made to authenticate to a wireless network.
  * 5633: A request was made to authenticate to a wired network.
  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.5.4'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.5.5'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Other Logon/Logoff Events') { should eq 'Success and Failure' }
  end
end

control 'windows-163' do
  title 'Ensure \'Audit Special Logon\' is set to \'Success\''
  desc 'This subcategory reports when a special logon is used. A special logon is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. Events for this subcategory include:

  * 4964 : Special groups have been assigned to a new logon.
  The recommended state for this setting is: Success.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.5.5'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.5.6'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Special Logon') { should eq 'Success' }
  end
end

control 'windows-164' do
  title 'Ensure \'Audit Other Object Access Events\' is set to \'Success and Failure\''
  desc 'This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects.

  For scheduler jobs, the following are audited:

  * Job created.
  * Job deleted.
  * Job enabled.
  * Job disabled.
  * Job updated.
  For COM+ objects, the following are audited:

  * Catalog object added.
  * Catalog object updated.
  * Catalog object deleted.
  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.6.1'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.6.1'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Other Object Access Events') { should eq 'Success and Failure' }
  end
end

control 'windows-165' do
  title 'Ensure \'Audit Removable Storage\' is set to \'Success and Failure\''
  desc 'This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage.

  The recommended state for this setting is: Success and Failure.

  **Note:** A Windows 8, Server 2012 (non-R2) or higher OS is required to access and set this value in Group Policy.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.6.2'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.6.2'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Removable Storage') { should eq 'Success and Failure' }
  end
end

control 'windows-166' do
  title 'Ensure \'Audit Audit Policy Change\' is set to \'Success and Failure\''
  desc 'This subcategory reports changes in audit policy including SACL changes. Events for this subcategory include:

  * 4715: The audit policy (SACL) on an object was changed.
  * 4719: System audit policy was changed.
  * 4902: The Per-user audit policy table was created.
  * 4904: An attempt was made to register a security event source.
  * 4905: An attempt was made to unregister a security event source.
  * 4906: The CrashOnAuditFail value has changed.
  * 4907: Auditing settings on object were changed.
  * 4908: Special Groups Logon table modified.
  * 4912: Per User Audit Policy was changed.
  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.7.1'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.7.1'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Audit Policy Change') { should eq 'Success and Failure' }
  end
end

control 'windows-167' do
  title 'Ensure \'Audit Authentication Policy Change\' is set to \'Success\''
  desc 'This subcategory reports changes in authentication policy. Events for this subcategory include:

  * 4706: A new trust was created to a domain.
  * 4707: A trust to a domain was removed.
  * 4713: Kerberos policy was changed.
  * 4716: Trusted domain information was modified.
  * 4717: System security access was granted to an account.
  * 4718: System security access was removed from an account.
  * 4739: Domain Policy was changed.
  * 4864: A namespace collision was detected.
  * 4865: A trusted forest information entry was added.
  * 4866: A trusted forest information entry was removed.
  * 4867: A trusted forest information entry was modified.
  The recommended state for this setting is: Success.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.7.2'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.7.2'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Authentication Policy Change') { should eq 'Success' }
  end
end

control 'windows-168' do
  title 'Ensure \'Audit Authorization Policy Change\' is set to \'Success\''
  desc 'This subcategory reports changes in authorization policy. Events for this subcategory include:

  * 4704: A user right was assigned.
  * 4705: A user right was removed.
  * 4706: A new trust was created to a domain.
  * 4707: A trust to a domain was removed.
  * 4714: Encrypted data recovery policy was changed.
  The recommended state for this setting is: Success.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.7.3'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.7.3'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Authorization Policy Change') { should eq 'Success' }
  end
end

control 'windows-169' do
  title 'Ensure \'Audit Sensitive Privilege Use\' is set to \'Success and Failure\''
  desc 'This subcategory reports when a user account or service uses a sensitive privilege. A sensitive privilege includes the following user rights: Act as part of the operating system, Back up files and directories, Create a token object, Debug programs, Enable computer and user accounts to be trusted for delegation, Generate security audits, Impersonate a client after authentication, Load and unload device drivers, Manage auditing and security log, Modify firmware environment values, Replace a process-level token, Restore files and directories, and Take ownership of files or other objects. Auditing this subcategory will create a high volume of events. Events for this subcategory include:

  * 4672: Special privileges assigned to new logon.
  * 4673: A privileged service was called.
  * 4674: An operation was attempted on a privileged object.
  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.8.1'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.8.1'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Sensitive Privilege Use') { should eq 'Success and Failure' }
  end
end

control 'windows-170' do
  title 'Ensure \'Audit IPsec Driver\' is set to \'Success and Failure\''
  desc 'This subcategory reports on the activities of the Internet Protocol security (IPsec) driver. Events for this subcategory include:

  * 4960: IPsec dropped an inbound packet that failed an integrity check. If this problem persists, it could indicate a network issue or that packets are being modified in transit to this computer. Verify that the packets sent from the remote computer are the same as those received by this computer. This error might also indicate interoperability problems with other IPsec implementations.
  * 4961: IPsec dropped an inbound packet that failed a replay check. If this problem persists, it could indicate a replay attack against this computer.
  * 4962: IPsec dropped an inbound packet that failed a replay check. The inbound packet had too low a sequence number to ensure it was not a replay.
  * 4963: IPsec dropped an inbound clear text packet that should have been secured. This is usually due to the remote computer changing its IPsec policy without informing this computer. This could also be a spoofing attack attempt.
  * 4965: IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). This is usually caused by malfunctioning hardware that is corrupting packets. If these errors persist, verify that the packets sent from the remote computer are the same as those received by this computer. This error may also indicate interoperability problems with other IPsec implementations. In that case, if connectivity is not impeded, then these events can be ignored.
  * 5478: IPsec Services has started successfully.
  * 5479: IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks.
  * 5480: IPsec Services failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem.
  * 5483: IPsec Services failed to initialize RPC server. IPsec Services could not be started.
  * 5484: IPsec Services has experienced a critical failure and has been shut down. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks.
  * 5485: IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem.
  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.9.1'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.9.1'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration'] # FIXME: check Baustein
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('IPsec Driver') { should eq 'Success and Failure' }
  end
end

control 'windows-171' do
  title 'Ensure \'Audit Other System Events\' is set to \'Success and Failure\''
  desc 'This subcategory reports on other system events. Events for this subcategory include:

  * 5024 : The Windows Firewall Service has started successfully.
  * 5025 : The Windows Firewall Service has been stopped.
  * 5027 : The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy.
  * 5028 : The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy.
  * 5029: The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy.
  * 5030: The Windows Firewall Service failed to start.
  * 5032: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.
  * 5033 : The Windows Firewall Driver has started successfully.
  * 5034 : The Windows Firewall Driver has been stopped.
  * 5035 : The Windows Firewall Driver failed to start.
  * 5037 : The Windows Firewall Driver detected critical runtime error. Terminating.
  * 5058: Key file operation.
  * 5059: Key migration operation.
  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.9.2'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.9.2'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Other System Events') { should eq 'Success and Failure' }
  end
end

control 'windows-172' do
  title 'Ensure \'Audit Security State Change\' is set to \'Success\''
  desc 'This subcategory reports changes in security state of the system, such as when the security subsystem starts and stops. Events for this subcategory include:

  * 4608: Windows is starting up.
  * 4609: Windows is shutting down.
  * 4616: The system time was changed.
  * 4621: Administrator recovered system from CrashOnAuditFail. Users who are not administrators will now be allowed to log on. Some auditable activity might not have been recorded.
  The recommended state for this setting is: Success.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.9.3'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.9.3'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Security State Change') { should eq 'Success' }
  end
end

control 'windows-173' do
  title 'Ensure \'Audit Security System Extension\' is set to \'Success and Failure\''
  desc 'This subcategory reports the loading of extension code such as authentication packages by the security subsystem. Events for this subcategory include:

  * 4610: An authentication package has been loaded by the Local Security Authority.
  * 4611: A trusted logon process has been registered with the Local Security Authority.
  * 4614: A notification package has been loaded by the Security Account Manager.
  * 4622: A security package has been loaded by the Local Security Authority.
  * 4697: A service was installed in the system.
  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.9.4'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.9.4'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('Security System Extension') { should eq 'Success and Failure' }
  end
end

control 'windows-174' do
  title 'Ensure \'Audit System Integrity\' is set to \'Success and Failure\''
  desc 'This subcategory reports on violations of integrity of the security subsystem. Events for this subcategory include:

  * 4612 : Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.
  * 4615 : Invalid use of LPC port.
  * 4618 : A monitored security event pattern has occurred.
  * 4816 : RPC detected an integrity violation while decrypting an incoming message.
  * 5038 : Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.
  * 5056: A cryptographic self test was performed.
  * 5057: A cryptographic primitive operation failed.
  * 5060: Verification operation failed.
  * 5061: Cryptographic operation.
  * 5062: A kernel-mode cryptographic self test was performed.
  The recommended state for this setting is: Success and Failure.'
  impact 1.0
  tag 'windows': %w(2012R2 2016 2019)
  tag 'profile': ['Domain Controller', 'Member Server']
  tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '17.9.5'
  tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '17.9.5'
  tag 'level': '1'
  tag 'bsi': ['SYS.1.2.2.M4', 'Sichere Konfiguration']
  ref 'IT-Grundschutz-Kompendium', url: 'https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKompendium/itgrundschutzKompendium_node.html'
  ref 'Umsetzungshinweise zum Baustein SYS.1.2.2: Windows Server 2012', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/UH_Windows_Server_2012.html'
  ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'
  describe audit_policy do
    its('System Integrity') { should eq 'Success and Failure' }
  end
end
