@@ -102,26 +102,58 @@ win22cis_section19: true
102102# errors due to missing features or incompatible syntax in earlier versions of Ansible.
103103min_ansible_version : " 2.16"
104104
105- # win_skip_for_test is the setting that will skip tasks that may cause changes that will affect the system.
106- # Controls that will be skipped:
107- # win22cis_rule_2_2_26 - Breaks Local Admin Connection
108- # win22cis_rule_2_2_27 - Breaks Local Admin Connection
109- # win22cis_rule_2_3_1_3 - Rename default administrator account
110- # win22cis_rule_9_3_4 - Enables Firewall Public Rules *Breaks Reboot*
111- # win22cis_rule_18_10_89_1_1 - Disables WinRM Allow Client Basic Auth
112- # win22cis_rule_18_10_89_1_2 - Disables Client Ensure Allow unencrypted traffic is set to Disabled Control.
113- # win22cis_rule_18_10_89_1_3 - Ensure Disallow Digest authentication is set to Enabled
114- # win22cis_rule_18_10_89_2_1 - Disables WinRM Allow Service Basic Auth
115- # win22cis_rule_18_10_89_2_2 - Disables Remote Server Management through WinRM
116- # win22cis_rule_18_10_89_2_3 - Disables Service Ensure Allow unencrypted traffic is set to Disabled Control.
117- # win22cis_rule_18_10_90_1 - Disables Remote Shell Access
118- win_skip_for_test : true
119-
120105# Changes will be made that will require a system reboot.
121106# The following option will allow whether or not to skip the reboot.
122107# Default: true
123108skip_reboot : true
124109
110+ # ╔═══════════════════════════════════════════════════════════════════════════════╗
111+ # ║ win_skip_for_test ║
112+ # ║ ║
113+ # ║ Skips tasks that may cause disruptive changes to the system during testing. ║
114+ # ║ ║
115+ # ║ NOTE: When set to true, the corresponding GPO entries for the controls ║
116+ # ║ listed below will also not be created. This applies to both the Ansible ║
117+ # ║ remediation path and the GPO creation path. ║
118+ # ║ ║
119+ # ║ Controls that will be skipped: ║
120+ # ║ win22cis_rule_2_2_26 - Breaks Local Admin Connection ║
121+ # ║ win22cis_rule_2_2_27 - Breaks Local Admin Connection ║
122+ # ║ win22cis_rule_2_3_1_3 - Rename default administrator account ║
123+ # ║ win22cis_rule_9_3_4 - Enables Firewall Public Rules *Breaks Reboot* ║
124+ # ║ win22cis_rule_18_10_89_1_1 - Disables WinRM Allow Client Basic Auth ║
125+ # ║ win22cis_rule_18_10_89_1_2 - Disables Client Allow Unencrypted Traffic ║
126+ # ║ win22cis_rule_18_10_89_1_3 - Disallow Digest Authentication ║
127+ # ║ win22cis_rule_18_10_89_2_1 - Disables WinRM Allow Service Basic Auth ║
128+ # ║ win22cis_rule_18_10_89_2_2 - Disables Remote Server Management via WinRM ║
129+ # ║ win22cis_rule_18_10_89_2_3 - Disables Service Allow Unencrypted Traffic ║
130+ # ║ win22cis_rule_18_10_90_1 - Disables Remote Shell Access ║
131+ # ╚═══════════════════════════════════════════════════════════════════════════════╝
132+ win_skip_for_test : true
133+
134+ # ╔═══════════════════════════════════════════════════════════════════════════════╗
135+ # ║ Hosted Virtual System Override ║
136+ # ║ ║
137+ # ║ By default, the role auto-detects whether the target is a cloud-based ║
138+ # ║ hosted virtual system (Azure, AWS, GCE, DigitalOcean, etc.). ║
139+ # ║ ║
140+ # ║ The auto-detection when condition covers the most common combinations of ║
141+ # ║ ansible_virtualization_type and ansible_system_vendor, however the number ║
142+ # ║ of possible hypervisor/cloud combinations makes it impossible to account ║
143+ # ║ for every environment. Known cases where auto-detection has produced ║
144+ # ║ incorrect results include VMware vSphere on-prem, AWS GovCloud EC2, and ║
145+ # ║ standalone (non-domain) VMware instances where virtualization_type ║
146+ # ║ returns 'NA'. In these cases the secedit lockout control order (1.2.1-1.2.4) ║
147+ # ║ will fail with 'The parameter is incorrect' from secedit. ║
148+ # ║ ║
149+ # ║ If you encounter this error, set the override below to force the correct ║
150+ # ║ order for your environment manually. ║
151+ # ║ ║
152+ # ║ true = treat as hosted/cloud virtual system ║
153+ # ║ false = treat as bare-metal or local VM ║
154+ # ╚═══════════════════════════════════════════════════════════════════════════════╝
155+ # hosted_virtual_system_override: true
156+
125157# These variables correspond with the CIS rule IDs or paragraph numbers defined in
126158# the CIS benchmark documents.
127159# PLEASE NOTE: These work in coordination with the section # group variables and tags.
@@ -347,7 +379,6 @@ win22cis_rule_18_1_1_2: true
347379win22cis_rule_18_1_2_2 : true
348380win22cis_rule_18_1_3 : true
349381win22cis_rule_18_4_1 : true
350- # win22cis_rule_18_4_2: true
351382win22cis_rule_18_4_2 : true
352383win22cis_rule_18_4_3 : true
353384win22cis_rule_18_4_4 : true
@@ -827,10 +858,10 @@ win22cis_ldap_client_integrity: 1
827858# Log\Microsoft\Windows\NTLM). Configuring this setting to Deny All also conforms to the benchmark.
828859# The recommended state for this setting is: Audit All.
829860# Note: Possible Valid Settings
830- # 1 - Deny All
831- # 2 - Audit All
832- # Default: 2
833- win22cis_restrict_sending_ntlm_traffic : 2
861+ # 1 - Audit All
862+ # 2 - Deny All
863+ # Default: 1
864+ win22cis_restrict_sending_ntlm_traffic : 1
834865
835866# 2.3.17.2
836867# win22cis_consent_prompt_behavior_admin is the policy setting controls the behavior of the elevation prompt for administrators.
@@ -1052,7 +1083,7 @@ win22cis_remote_encryption_protection_aggressiveness: 1
10521083# win22cis_idle_rdp_session_disconnect_time is the setting that allows you to specify the maximum amount of time that an active Remote Desktop
10531084# Services session can be idle (without user input) before it is automatically disconnected.
10541085# The recommended state for this setting is: Enabled: 15 minutes or less, but not Never (0).
1055- # 1 min = 60000, 5 min = 300000, 10 min = 600000, 15 min = 900000
1086+ # This now accepts any value between 1 and 900000.
10561087# Default: 900000
10571088win22cis_idle_rdp_session_disconnect_time : 900000
10581089
0 commit comments