Skip to content

Commit b5b93c7

Browse files
MrSteve81MrSteve81
authored
Merge pull request #89 from ansible-lockdown/devel
Windows 2022 Major CIS V4 Updates
2 parents b8347dd + e039e8e commit b5b93c7

23 files changed

Lines changed: 3662 additions & 2112 deletions

‎.ansible-lint‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,6 @@ quiet: true
55
skip_list:
66
- 'package-latest'
77
- 'risky-shell-pipe'
8+
- yaml[line-length]
89
use_default_rules: true
910
verbosity: 0

‎.github/workflows/benchmark_tracking_controller.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# GitHub schedules all cron jobs in UTC.
2+
# ──────────────────────────────────────────────────────────────────────────────
3+
# Schedule:
4+
# - '0 13 * * *' runs at 13:00 UTC every day.
5+
# - This corresponds to:
6+
# • 9:00 AM Eastern **during Daylight Saving Time** (mid-Mar → early-Nov)
7+
# • 8:00 AM Eastern **during Standard Time** (early-Nov → mid-Mar)
8+
#
9+
# Job routing:
10+
# - call-benchmark-tracker:
11+
# • Runs on manual dispatch, and on pushes to the 'latest' branch.
12+
# - call-monitor-promotions:
13+
# • Runs on schedule or manual dispatch **only in repos named ansible-lockdown/Private-***.
14+
# • Skips automatically in public repos (e.g., Windows-2022-CIS) to avoid false failures.
15+
#
16+
# Defense-in-depth:
17+
# - The called promotion workflow may still keep its own guard to ensure only Private-* repos execute it.
18+
19+
name: Central Benchmark Orchestrator
20+
21+
on:
22+
push:
23+
branches:
24+
- latest
25+
schedule:
26+
- cron: '0 13 * * *' # 13:00 UTC → 9 AM ET (DST) / 8 AM ET (Standard Time)
27+
workflow_dispatch:
28+
29+
jobs:
30+
call-benchmark-tracker:
31+
# Run on manual dispatch OR when 'latest' branch receives a push
32+
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref_name == 'latest')
33+
name: Start Benchmark Tracker
34+
uses: ansible-lockdown/github_windows_IaC/.github/workflows/benchmark_track.yml@self_hosted
35+
with:
36+
repo_name: ${{ github.repository }}
37+
secrets:
38+
TEAMS_WEBHOOK_URL: ${{ secrets.TEAMS_WEBHOOK_URL }}
39+
BADGE_PUSH_TOKEN: ${{ secrets.BADGE_PUSH_TOKEN }}
40+
DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
41+
42+
call-monitor-promotions:
43+
# Run on schedule or manual dispatch, but only for Private-* repos
44+
if: (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && startsWith(github.repository, 'ansible-lockdown/Private-')
45+
name: Monitor Promotions and Auto-Promote
46+
uses: ansible-lockdown/github_windows_IaC/.github/workflows/benchmark_promote.yml@self_hosted
47+
with:
48+
repo_name: ${{ github.repository }}
49+
secrets:
50+
TEAMS_WEBHOOK_URL: ${{ secrets.TEAMS_WEBHOOK_URL }}
51+
BADGE_PUSH_TOKEN: ${{ secrets.BADGE_PUSH_TOKEN }}
52+
DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}

‎.github/workflows/devel_pipeline_validation.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,12 @@ jobs:
3131
- uses: actions/first-interaction@main
3232
with:
3333
repo-token: ${{ secrets.GITHUB_TOKEN }}
34-
pr-message: |-
35-
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
36-
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
34+
issue_message: |-
35+
Congrats on opening your first issue and thank you for taking the time to help improve Ansible-Lockdown!
36+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
37+
pr_message: |-
38+
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
39+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
3740
3841
build-azure-windows:
3942
# Use the AWS self-hosted runner
@@ -60,7 +63,7 @@ jobs:
6063
steps:
6164
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it.
6265
- name: Clone ${{ github.event.repository.name }}
63-
uses: actions/checkout@v4
66+
uses: actions/checkout@v6.0.2
6467
with:
6568
ref: ${{ github.event.pull_request.head.sha }}
6669

@@ -76,7 +79,7 @@ jobs:
7679
7780
# Pull In OpenTofu Code For Windows Azure
7881
- name: Clone IaC Repository
79-
uses: actions/checkout@v4
82+
uses: actions/checkout@v6.0.2
8083
with:
8184
repository: ansible-lockdown/github_windows_IaC
8285
path: .github/workflows/github_windows_IaC

‎.github/workflows/devel_pipeline_validation_gpo.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,12 @@ jobs:
3131
- uses: actions/first-interaction@main
3232
with:
3333
repo-token: ${{ secrets.GITHUB_TOKEN }}
34-
pr-message: |-
35-
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
36-
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
34+
issue_message: |-
35+
Congrats on opening your first issue and thank you for taking the time to help improve Ansible-Lockdown!
36+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
37+
pr_message: |-
38+
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
39+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
3740
3841
build-azure-windows-gpo:
3942
# Use the AWS self-hosted runner
@@ -60,7 +63,7 @@ jobs:
6063
steps:
6164
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it.
6265
- name: Clone ${{ github.event.repository.name }}
63-
uses: actions/checkout@v4
66+
uses: actions/checkout@v6.0.2
6467
with:
6568
ref: ${{ github.event.pull_request.head.sha }}
6669

@@ -76,7 +79,7 @@ jobs:
7679
7780
# Pull In OpenTofu Code For Windows Azure
7881
- name: Clone IaC Repository
79-
uses: actions/checkout@v4
82+
uses: actions/checkout@v6.0.2
8083
with:
8184
repository: ansible-lockdown/github_windows_IaC
8285
path: .github/workflows/github_windows_IaC

‎.github/workflows/main_pipeline_validation.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ jobs:
4949
steps:
5050
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it.
5151
- name: Clone ${{ github.event.repository.name }}
52-
uses: actions/checkout@v4
52+
uses: actions/checkout@v6.0.2
5353
with:
5454
ref: ${{ github.event.pull_request.head.sha }}
5555

@@ -65,7 +65,7 @@ jobs:
6565
6666
# Pull In OpenTofu Code For Windows Azure
6767
- name: Clone IaC Repository
68-
uses: actions/checkout@v4
68+
uses: actions/checkout@v6.0.2
6969
with:
7070
repository: ansible-lockdown/github_windows_IaC
7171
path: .github/workflows/github_windows_IaC

‎.github/workflows/main_pipeline_validation_gpo.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ jobs:
4949
steps:
5050
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it.
5151
- name: Clone ${{ github.event.repository.name }}
52-
uses: actions/checkout@v4
52+
uses: actions/checkout@v6.0.2
5353
with:
5454
ref: ${{ github.event.pull_request.head.sha }}
5555

@@ -65,7 +65,7 @@ jobs:
6565
6666
# Pull In OpenTofu Code For Windows Azure
6767
- name: Clone IaC Repository
68-
uses: actions/checkout@v4
68+
uses: actions/checkout@v6.0.2
6969
with:
7070
repository: ansible-lockdown/github_windows_IaC
7171
path: .github/workflows/github_windows_IaC

‎.github/workflows/update_galaxy.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616

1717
steps:
1818
- name: Checkout V4
19-
uses: actions/checkout@v4
19+
uses: actions/checkout@v6.0.2
2020

2121
- name: Update Galaxy
2222
uses: ansible-actions/ansible-galaxy-action@main

‎ChangeLog.md‎

Lines changed: 102 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,106 @@
11
# ChangeLog
22

3+
## Release 4.1.0
4+
5+
April 2026
6+
- Updated the cloud based system check for manual overrides. New variable now in the defualt main. Please read the comments for the new variable.
7+
- Updated 18.10.57.3.10.1 variable accept anything between 1 and 900000 in Hardening & GPO.
8+
- Updated Section 2 GPO for win_skip_for_test controls. Read comments in default/main.
9+
- Issues Addressed:
10+
- [#2](https://github.com/ansible-lockdown/Windows-2025-CIS/issues/2) - Thanks @davidstanaway
11+
- [#7](https://github.com/ansible-lockdown/Windows-2025-CIS/issues/7) - Thanks @R2J2 (Updated When Statement to take into account Bool now)
12+
- [#86](https://github.com/ansible-lockdown/Windows-2022-CIS/issues/86) - Thanks @git-cgallagher (Windows 2022 Issue Added Here To Update 2025)
13+
- [#84](https://github.com/ansible-lockdown/Windows-2022-CIS/issues/84) - Thanks @Randriy-bulynko (Windows 2022 Issue Added Here To Update 2025)
14+
- [#87](https://github.com/ansible-lockdown/Windows-2022-CIS/issues/87) - Thanks @Randriy-bulynko (Windows 2022 Issue Added Here To Update 2025)
15+
- [#83](https://github.com/ansible-lockdown/Windows-2022-CIS/issues/83) - Thanks @exu-g (Windows 2022 Issue Added Here To Update 2025)
16+
- PR's Addressed:
17+
- [#3](https://github.com/ansible-lockdown/Windows-2025-CIS/pull/3) - Thanks @MatthieuLeboeuf
18+
19+
September 2025
20+
- Updated When For Control 18.4.6
21+
- Updated Title 2.3.10.10
22+
- Updated 2.3.6.5 Task
23+
- PR's Addressed:
24+
- [#79](https://github.com/ansible-lockdown/Windows-2022-CIS/pull/79/files) - Thanks @ShawnHardwick
25+
26+
## Release 4.0.0
27+
28+
June 2025
29+
- This Release is based on CIS Benchmark v4.0.0
30+
- Internal 90 Auto Promotion Workflows Added
31+
- Fixed Tags from _ to . in he control numbers to align with other controls.
32+
- Issues Addressed:
33+
- Fixed GPO 18.9.26.2 to enter the correct registry entry.
34+
- CIS Control Changes Summary (v4.0.0 vs v3.0.0) - Please review them in the CIS documentation and adjust your playbooks.
35+
- Removed
36+
- 2.3.1.1: Accounts: Block Microsoft accounts removed; all controls in the section shifted up
37+
- 18.4.2: Removed; all subsequent controls moved up
38+
- 18.10.15.8: Removed in v4.0.0
39+
- 18.10.42.17: Removed in v4.0.0
40+
- Added
41+
- 2.3.11.8: Network security: LDAP client encryption requirements
42+
- 2.3.11.14: New control
43+
- 2.3.17.2: Valid variable checking
44+
- 18.4.6: Valid variable checking
45+
- 18.6.4.4: IPV6 DNS Servers
46+
- 18.6.7.1: Lanman Server SMB
47+
- 18.6.8.2: Lanman Workstation Encryption
48+
- 18.10.18.4: Malware Scan Override
49+
- 18.10.18.6: MSS Certificate Validation Bypass
50+
- 18.10.18.7: Windows Package Manager command line
51+
- 18.10.29.2: Mark of the Web tag
52+
- 18.10.43.4.1: Enable EDR in block mode
53+
- 18.10.43.8.1: Convert warn verdict
54+
- 18.10.43.10.1: Configure real-time protection during OOBE
55+
- 18.10.43.11.1.1.1: Configure Brute-Force Protection aggressiveness
56+
- 18.10.43.11.1.1.2: Configure Remote Encryption Protection Mode
57+
- 18.10.43.11.1.2.1: Remote Encryption Protection blocks threats
58+
- 18.10.43.13.1: Scan excluded files and directories
59+
- 18.10.43.13.4: Trigger a quick scan after X days
60+
- 18.10.43.17: Control whether exclusions are visible to local users
61+
- 18.10.58.2: Enable Basic feed authentication over HTTP
62+
- Updated
63+
- 2.2.38: Title updated in Remediate and GPO
64+
- 18.6.4.1: Replaced in v4.0.0
65+
- 18.7.2, 18.7.3, 18.7.5: Title updates
66+
- 18.9.13.1, 18.9.19.2: Title updates
67+
- 18.10.18.1: Level changed to Level 2
68+
- 18.10.28.2 → 18.10.29.3: Moved due to new 18.10.29.2
69+
- 18.10.42.6.1: Removed One of the ASR's
70+
- Renumbered / Moved
71+
- 18.10.5.1 → 18.10.6.1
72+
- 18.10.7.1–3 → 18.10.8.1–3
73+
- 18.10.8.1.1 → 18.10.9.1.1
74+
- 18.10.10.1 → 18.10.11.1
75+
- 18.10.12.1–3 → 18.10.13.1–3
76+
- 18.10.13.1 → 18.10.14.1
77+
- 18.10.14.1–2 → 18.10.15.1–2
78+
- 18.10.15.1–7 → 18.10.16.1–7
79+
- 18.10.17.x → 18.10.18.x
80+
- 18.10.25.x.x → 18.10.26.x.x
81+
- 18.10.36.x → 18.10.37.x
82+
- 18.10.40.x → 18.10.41.x
83+
- 18.10.41.x → 18.10.42.x
84+
- 18.10.42.5.x → 18.10.43.5.x
85+
- 18.10.42.x.x.x → 18.10.43.x.x.x
86+
- 18.10.50.x → 18.10.51.x
87+
- 18.10.55.x → 18.10.56.x
88+
- 18.10.56.x → 18.10.57.x
89+
- 18.10.57.x → 18.10.58.x
90+
- 18.10.58.x → 18.10.59.x
91+
- 18.10.62.x → 18.10.63.x
92+
- 18.10.75.x.x → 18.10.76.x.x
93+
- 18.10.79.x → 18.10.80.x
94+
- 18.10.80.x → 18.10.81.x
95+
- 18.10.86.x → 18.10.87.x
96+
- 18.10.88.x.x → 18.10.89.x.x
97+
- 18.10.89.x → 18.10.90.x
98+
- 18.10.91.x.x → 18.10.92.x.x
99+
- 18.10.92.x.x → 18.10.93.x.x
100+
- Structural Changes
101+
- Section 17: Credential Validation auditing now uses the GUID {0CCE923F-69AE-11D9-BED3-505054503030}
102+
- This makes auditing language-agnostic and more consistent across regional builds.
103+
3104
## Release 3.0.5
4105
September 2025 Update
5106
- Issues Addressed:
@@ -11,7 +112,6 @@ May 2025 Update #2
11112
- Issues Addressed:
12113
- Fixed 1.1.6 to apply to all systems except for Domain Controllers. This is present in standalone version. - Thanks @mfortin
13114
- Re-Verified 18.10.79.2 Paths
14-
- Fixed 18.9.26.2 GPO Registry Entry
15115

16116
## Release 3.0.3
17117

@@ -20,7 +120,7 @@ May 2025 Update
20120
- Fixed Control 18.6.14.1 For Missing RequirePrivacy=1 in Ansible Hardening. - Thanks @mfortin
21121
- Updated 18.10.56.3.10.2 value to 60000 from 6000 in remediate and GPO - Thanks @mfortin
22122
- Verified 18.10.79.2 Path In Remediate - Thanks @mfortin
23-
- Updated 18.10.92.4.1 ManagePreviewBuildsPolicyValue to 1. - Thanks @mfortin
123+
- Updated 18.10.93.4.1 ManagePreviewBuildsPolicyValue to 1. - Thanks @mfortin
24124
- Updated Pipelines Branches Trigger
25125
- Updated Readme with New Badges
26126

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
## Configure a Microsoft Server 2022 machine to be [CIS](https://www.cisecurity.org/cis-benchmarks/) compliant
44

5-
### Based on [ CIS Microsoft Windows Server 2022 v3.0.0 - 03-19-2024 ](https://www.cisecurity.org/cis-benchmarks/)
5+
### Based on [ CIS Microsoft Windows Server 2022 v4.0.0 - 05-23-2025 ](https://www.cisecurity.org/cis-benchmarks/)
66

77
---
88

0 commit comments

Comments
 (0)