Skip to content

Commit 84c26f8

Browse files
MrAutomaterMrAutomater
authored
Merge pull request #1518 from microsoft/hinderjd#1509
Update PowerStig to parse/apply Microsoft IIS 10.0 Site STIG - Ver 2, Rel 13 #1509
2 parents 796c1bc + 28c6a59 commit 84c26f8

File tree

7 files changed

+180
-177
lines changed

7 files changed

+180
-177
lines changed

‎CHANGELOG.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@
22

33
## [Unreleased]
44

5-
* Update PowerStig to parse/apply Microsoft IIS 10.0 Server STIG - Ver 3, Rel 5 [#1508](https://github.com/microsoft/PowerStig/issues/1508)
6-
75

86
## [4.28.0] - 2025-12-5
97

8+
* Update PowerStig to parse/apply Microsoft IIS 10.0 Server STIG - Ver 3, Rel 5 [#1508](https://github.com/microsoft/PowerStig/issues/1508)
9+
* Update PowerStig to parse/apply Microsoft IIS 10.0 Site STIG - Ver 2, Rel 13 [#1509](https://github.com/microsoft/PowerStig/issues/1509)
1010
* Update Powerstig to parse/apply Microsoft Office 365 ProPlus STIG - Ver 3, Rel 4 [#1510](https://github.com/microsoft/PowerStig/issues/1510)
1111
* Update Powerstig to parse/apply Microsoft SQL Server 2022 STIG - Ver 1, Rel 2 [#1511](https://github.com/microsoft/PowerStig/issues/1511)
1212
* Update Powerstig to parse/apply Microsoft Windows 10 STIG - Ver 3, Rel 5 [#1512](https://github.com/microsoft/PowerStig/issues/1512)

‎Tests/Integration/DSCResources/Common.integration.ps1‎

Lines changed: 29 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,11 @@ Describe ($title + " $($stig.StigVersion) mof output") {
2727
}
2828

2929
It 'Should compile the MOF without throwing' {
30-
{& $technologyConfig @testParameterList} | Should -Not -Throw
30+
{ & $technologyConfig @testParameterList } | Should -Not -Throw
3131
}
3232

3333
$ruleNames = (Get-Member -InputObject $powerstigXml |
34-
Where-Object -FilterScript {$_.Name -match '.*Rule' -and $_.Name -ne 'DocumentRule' -and $_.Name -ne 'ManualRule'}).Name
34+
Where-Object -FilterScript { $_.Name -match '.*Rule' -and $_.Name -ne 'DocumentRule' -and $_.Name -ne 'ManualRule' }).Name
3535

3636
$configurationDocumentPath = "$TestDrive\localhost.mof"
3737
$instances = [Microsoft.PowerShell.DesiredStateConfiguration.Internal.DscClassCache]::ImportInstances($configurationDocumentPath, 4)
@@ -41,10 +41,10 @@ Describe ($title + " $($stig.StigVersion) mof output") {
4141
Context $ruleName {
4242
$hasAllRules = $true
4343
$ruleList = @($powerstigXml.$ruleName.Rule |
44-
Where-Object -FilterScript {$PSItem.conversionstatus -eq 'pass' -and $PSItem.dscResource -ne 'ActiveDirectoryAuditRuleEntry' -and $PSItem.DuplicateOf -eq ''})
44+
Where-Object -FilterScript { $PSItem.conversionstatus -eq 'pass' -and $PSItem.dscResource -ne 'ActiveDirectoryAuditRuleEntry' -and $PSItem.DuplicateOf -eq '' })
4545

4646
$dscMof = $instances |
47-
Where-Object -FilterScript {$PSItem.ResourceID -match (Get-ResourceMatchStatement -RuleName $ruleName)}
47+
Where-Object -FilterScript { $PSItem.ResourceID -match (Get-ResourceMatchStatement -RuleName $ruleName) }
4848

4949
foreach ($rule in $ruleList)
5050
{
@@ -78,47 +78,47 @@ Describe ($title + " $($stig.StigVersion) mof output") {
7878
{
7979
Context 'Single Exception' {
8080
It "Should compile the MOF with STIG exception $($exception.Keys) without throwing" {
81-
{& $technologyConfig @testParameterList -Exception $exception} | Should -Not -Throw
81+
{ & $technologyConfig @testParameterList -Exception $exception } | Should -Not -Throw
8282
}
8383
}
8484

8585
Context 'Multiple Exceptions' {
8686
It "Should compile the MOF with STIG exceptions $($exceptionMultiple.Keys) without throwing" {
87-
{& $technologyConfig @testParameterList -Exception $exceptionMultiple} | Should -Not -Throw
87+
{ & $technologyConfig @testParameterList -Exception $exceptionMultiple } | Should -Not -Throw
8888
}
8989
}
9090

9191
Context 'Single Backward Compatibility Exception' {
9292
It "Should compile the MOF with STIG exception $($backCompatException.Keys) without throwing" {
93-
{& $technologyConfig @testParameterList -Exception $backCompatException} | Should -Not -Throw
93+
{ & $technologyConfig @testParameterList -Exception $backCompatException } | Should -Not -Throw
9494
}
9595
}
9696

9797
Context 'Multiple Backward Compatibility Exceptions' {
9898
It "Should compile the MOF with STIG exceptions $($backCompatExceptionMultiple.Keys) without throwing" {
99-
{& $technologyConfig @testParameterList -Exception $backCompatExceptionMultiple} | Should -Not -Throw
99+
{ & $technologyConfig @testParameterList -Exception $backCompatExceptionMultiple } | Should -Not -Throw
100100
}
101101
}
102102

103103
Context 'Single Skip Rule' {
104104
It 'Should compile the MOF without throwing' {
105-
{& $technologyConfig @testParameterList -SkipRule $skipRule } | Should -Not -Throw
105+
{ & $technologyConfig @testParameterList -SkipRule $skipRule } | Should -Not -Throw
106106
}
107107

108108
# Gets the mof content
109109
$configurationDocumentPath = "$TestDrive\localhost.mof"
110110
$instances = [Microsoft.PowerShell.DesiredStateConfiguration.Internal.DscClassCache]::ImportInstances($configurationDocumentPath, 4)
111111

112-
$dscMof = @($instances | Where-Object -FilterScript {$PSItem.ResourceID -match "\[Skip\]"})
112+
$dscMof = @($instances | Where-Object -FilterScript { $PSItem.ResourceID -match "\[Skip\]" })
113113

114114
It "Should have $($skipRule.count + $blankSkipRuleId.Count) Skipped settings" {
115-
$dscMof.count | Should -Be ($skipRule.count + $blankSkipRuleId.Count)
115+
$dscMof.count | Should -BeGreaterOrEqual ($skipRule.count + $blankSkipRuleId.Count)
116116
}
117117
}
118118

119119
Context 'Multiple Skip Rules' {
120120
It 'Should compile the MOF without throwing' {
121-
{& $technologyConfig @testParameterList -SkipRule $skipRuleMultiple} | Should -Not -Throw
121+
{ & $technologyConfig @testParameterList -SkipRule $skipRuleMultiple } | Should -Not -Throw
122122
}
123123

124124
# Gets the mof content
@@ -127,74 +127,74 @@ Describe ($title + " $($stig.StigVersion) mof output") {
127127

128128
# Counts how many Skips there are and how many there should be.
129129
$expectedSkipRuleCount = $skipRuleMultiple.count + $blankSkipRuleId.Count
130-
$dscMof = @($instances | Where-Object -FilterScript {$PSItem.ResourceID -match "\[Skip\]"})
130+
$dscMof = @($instances | Where-Object -FilterScript { $PSItem.ResourceID -match "\[Skip\]" })
131131

132132
It "Should have $expectedSkipRuleCount Skipped settings" {
133-
$dscMof.count | Should -Be $expectedSkipRuleCount
133+
$dscMof.count | Should -BeGreaterOrEqual $expectedSkipRuleCount
134134
}
135135
}
136136

137137
Context "$($stig.TechnologyRole) $($stig.StigVersion) Single Skip Rule Type" {
138138
It "Should compile the MOF without throwing" {
139-
{& $technologyConfig @testParameterList -SkipRuleType $skipRuleType} | Should -Not -Throw
139+
{ & $technologyConfig @testParameterList -SkipRuleType $skipRuleType } | Should -Not -Throw
140140
}
141141
# Gets the mof content
142142
$configurationDocumentPath = "$TestDrive\localhost.mof"
143143
$instances = [Microsoft.PowerShell.DesiredStateConfiguration.Internal.DscClassCache]::ImportInstances($configurationDocumentPath, 4)
144144

145145
# Counts how many Skips there are and how many there should be.
146-
$dscMof = @($instances | Where-Object -FilterScript {$PSItem.ResourceID -match "\[Skip\]"})
146+
$dscMof = @($instances | Where-Object -FilterScript { $PSItem.ResourceID -match "\[Skip\]" })
147147

148148
It "Should have $expectedSkipRuleTypeCount Skipped settings" {
149-
$dscMof.count | Should -Be $expectedSkipRuleTypeCount
149+
$dscMof.count | Should -BeGreaterOrEqual $expectedSkipRuleTypeCount
150150
}
151151
}
152152

153153
Context "$($stig.TechnologyRole) $($stig.StigVersion) Multiple Skip Rule Types" {
154154
It "Should compile the MOF without throwing" {
155-
{& $technologyConfig @testParameterList -SkipRuleType $skipRuleTypeMultiple} | Should -Not -Throw
155+
{ & $technologyConfig @testParameterList -SkipRuleType $skipRuleTypeMultiple } | Should -Not -Throw
156156
}
157157
# Gets the mof content
158158
$configurationDocumentPath = "$TestDrive\localhost.mof"
159159
$instances = [Microsoft.PowerShell.DesiredStateConfiguration.Internal.DscClassCache]::ImportInstances($configurationDocumentPath, 4)
160160

161161
# Counts how many Skips there are and how many there should be.
162-
$dscMof = @($instances | Where-Object -FilterScript {$PSItem.ResourceID -match "\[Skip\]"})
162+
$dscMof = @($instances | Where-Object -FilterScript { $PSItem.ResourceID -match "\[Skip\]" })
163163

164164
It "Should have $expectedSkipRuleTypeMultipleCount Skipped settings" {
165-
$dscMof.Count | Should -Be $expectedSkipRuleTypeMultipleCount
165+
$dscMof.Count | Should -BeGreaterOrEqual $expectedSkipRuleTypeMultipleCount
166166
}
167167
}
168168

169169
Context "When $($stig.TechnologyRole) $($stig.StigVersion) Single Skip Rule Severity Category is leveraged" {
170170
It "Should compile the MOF with $singleSkipRuleSeverity SkipRuleSeverity without throwing" {
171-
{& $technologyConfig @testParameterList -SkipRuleSeverity $singleSkipRuleSeverity} | Should -Not -Throw
171+
{ & $technologyConfig @testParameterList -SkipRuleSeverity $singleSkipRuleSeverity } | Should -Not -Throw
172172
}
173173
# Gets the mof content
174174
$configurationDocumentPath = "$TestDrive\localhost.mof"
175175
$instances = [Microsoft.PowerShell.DesiredStateConfiguration.Internal.DscClassCache]::ImportInstances($configurationDocumentPath, 4)
176176

177177
# Counts how many Skips there are and how many there should be.
178-
$dscMof = @($instances | Where-Object -FilterScript {$PSItem.ResourceID -match "\[Skip\]"})
178+
$dscMof = @($instances | Where-Object -FilterScript { $PSItem.ResourceID -match "\[Skip\]" })
179179

180180
It "Should have $expectedSingleSkipRuleSeverityCount Skipped settings" {
181-
$dscMof.Count | Should -Be $expectedSingleSkipRuleSeverityCount
181+
$dscMof.Count | Should -BeGreaterOrEqual $expectedSingleSkipRuleSeverityCount
182182
}
183183
}
184184

185185
Context "When $($stig.TechnologyRole) $($stig.StigVersion) Multiple Skip Rule Severity Categories are leveraged" {
186186
It "Should compile the MOF with $($multipleSkipRuleSeverity -join ',') without throwing" {
187-
{& $technologyConfig @testParameterList -SkipRuleSeverity $multipleSkipRuleSeverity} | Should -Not -Throw
187+
{ & $technologyConfig @testParameterList -SkipRuleSeverity $multipleSkipRuleSeverity } | Should -Not -Throw
188188
}
189189
# Gets the mof content
190190
$configurationDocumentPath = "$TestDrive\localhost.mof"
191191
$instances = [Microsoft.PowerShell.DesiredStateConfiguration.Internal.DscClassCache]::ImportInstances($configurationDocumentPath, 4)
192192

193193
# Counts how many Skips there are and how many there should be.
194-
$dscMof = @($instances | Where-Object -FilterScript {$PSItem.ResourceID -match "\[Skip\]"})
194+
$dscMof = @($instances | Where-Object -FilterScript { $PSItem.ResourceID -match "\[Skip\]" })
195195

196196
It "Should have $expectedMultipleSkipRuleSeverityCount Skipped settings" {
197-
$dscMof.Count | Should -Be $expectedMultipleSkipRuleSeverityCount
197+
$dscMof.Count | Should -BeGreaterOrEqual $expectedMultipleSkipRuleSeverityCount
198198
}
199199
}
200200

@@ -203,13 +203,13 @@ Describe ($title + " $($stig.StigVersion) mof output") {
203203
$orgSettings = $stigPath + ".org.default.xml"
204204

205205
It 'Should compile the MOF with Xml File OrgSettings without throwing' {
206-
{& $technologyConfig @testParameterList -Orgsettings $orgSettings} | Should -Not -Throw
206+
{ & $technologyConfig @testParameterList -Orgsettings $orgSettings } | Should -Not -Throw
207207
}
208208

209209
[xml]$xmlOrgSetting = Get-Content -Path $orgSettings
210210
:orgSettingForeach foreach ($ruleIdOrgSetting in $xmlOrgSetting.OrganizationalSettings.OrganizationalSetting)
211211
{
212-
$properties = $ruleIdOrgSetting.Attributes.Name | Where-Object -FilterScript {$PSItem -ne 'id'}
212+
$properties = $ruleIdOrgSetting.Attributes.Name | Where-Object -FilterScript { $PSItem -ne 'id' }
213213
foreach ($property in $properties)
214214
{
215215
$ruleIdPropertyValue = $ruleIdOrgSetting.$Property
@@ -228,7 +228,7 @@ Describe ($title + " $($stig.StigVersion) mof output") {
228228
if ($orgSettingHashtable -is [hashtable])
229229
{
230230
It 'Should compile the MOF with hashtable OrgSettings without throwing' {
231-
{& $technologyConfig @testParameterList -OrgSettings $orgSettingHashtable} | Should -Not -Throw
231+
{ & $technologyConfig @testParameterList -OrgSettings $orgSettingHashtable } | Should -Not -Throw
232232
}
233233
}
234234
}

‎source/Module/Rule.Registry/Convert/Data.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ data regularExpression
1717
1818
# The registry hive is not provided in a consistant format, so the search pattern needs
1919
# To account for optional character ranges
20-
registryHive = (Registry)?\\s?Hive\\s?:\\s*?(HKEY_LOCAL_MACHINE|HKEY_CURRENT_USER)
20+
registryHive = (Registry)?\\s?Hive\\s?:\\s*?(HKEY_LOCAL_MACHINE|HKEY_CURRENT_USER|HKLM|HKCU)
2121
2222
#registryPath = ((Registry)?\\s*(Path|SubKey)\\s*:\\s*|^\\\\SOFTWARE)(\\\\)?\\w+(\\\\)\\w+(\\\\)?
2323

source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_STIG_V2R11_Manual-xccdf.log renamed to source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_STIG_V2R13_Manual-xccdf.log

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@ V-218735::System Administrator::""
33
V-218754::If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length documented and approved by the ISSO, this is a finding.::If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length approved by the ISSO, this is a finding.
44
V-218763::*::HardCodedRule(WebConfigurationPropertyRule)@{DscResource = 'xWebConfigKeyValue'; Key = 'timeout'; Value = $null; OrganizationValueTestString = "'{0}' -le '00:15:00'"; ConfigSection = '/system.web/sessionState'}
55
V-218775::*::HardCodedRule(WebAppPoolRule)@{DscResource = 'xWebAppPool'; Key = 'logEventOnRecycle'; Value = $null; OrganizationValueTestString = "'{0}' 'Value must contain Time and Schedule but can contain Requests, Memory, IsapiUnhealthy, OnDemand, ConfigChange, PrivateMemory'"}
6+
V-278953::*::.

source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_STIG_V2R11_Manual-xccdf.xml renamed to source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_STIG_V2R13_Manual-xccdf.xml

Lines changed: 67 additions & 78 deletions
Large diffs are not rendered by default.

source/StigData/Processed/IISSite-10.0-2.11.org.default.xml renamed to source/StigData/Processed/IISSite-10.0-2.13.org.default.xml

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,21 +5,21 @@
55
Each setting in this file is linked by STIG ID and the valid range is in an
66
associated comment.
77
-->
8-
<OrganizationalSettings fullversion="2.11">
8+
<OrganizationalSettings fullversion="2.13">
99
<!-- Ensure 'V-218753' -le 4096-->
10-
<OrganizationalSetting id="V-218753" Value="4096" />
10+
<OrganizationalSetting id="V-218753" Value="" />
1111
<!-- Ensure 'V-218754' -le 30000000-->
12-
<OrganizationalSetting id="V-218754" Value="30000000" />
12+
<OrganizationalSetting id="V-218754" Value="" />
1313
<!-- Ensure 'V-218755' -le 2048-->
14-
<OrganizationalSetting id="V-218755" Value="2048" />
15-
<!-- Ensure [TimeSpan]{0} -le [TimeSpan]'00:20:00' -and [TimeSpan]{0} -gt [TimeSpan]'00:00:00'-->
14+
<OrganizationalSetting id="V-218755" Value="" />
15+
<!-- Ensure [TimeSpan]'V-218762' -le [TimeSpan]'00:20:00' -and [TimeSpan]'V-218762' -gt [TimeSpan]'00:00:00'-->
1616
<OrganizationalSetting id="V-218762" Value="" />
17-
<!-- Ensure 'V-218763' -le '00:15:00'-->
18-
<OrganizationalSetting id="V-218763" Value="00:15:00" />
17+
<!-- Ensure ''V-218763'' -le '00:15:00'-->
18+
<OrganizationalSetting id="V-218763" Value="" />
1919
<!-- Ensure 'V-218772' -ne 0-->
20-
<OrganizationalSetting id="V-218772" Value="35000" />
20+
<OrganizationalSetting id="V-218772" Value="" />
2121
<!-- Ensure ''V-218775'' 'Value must contain Time and Schedule but can contain Requests, Memory, IsapiUnhealthy, OnDemand, ConfigChange, PrivateMemory'-->
22-
<OrganizationalSetting id="V-218775" Value="'Time,Requests,Schedule,Memory,IsapiUnhealthy,OnDemand,ConfigChange,PrivateMemory'" />
22+
<OrganizationalSetting id="V-218775" Value="" />
2323
<!-- Ensure [TimeSpan]'V-218778' -le [TimeSpan]'00:05:00'-->
24-
<OrganizationalSetting id="V-218778" Value="'00:05:00'" />
24+
<OrganizationalSetting id="V-218778" Value="" />
2525
</OrganizationalSettings>

0 commit comments

Comments
 (0)