Updates for CIS Win10 21H1

[StWightman]

Hi, it looks like there have been numerous changes or updates to the CIS Win10 21H1 document that haven't been reflected in the csv yet. The Benchmark was updated February 15th of this year, a bunch of the IDs have changed, and I'm seeing some discrepancies between what the Benchmark states for recommendations and what the csv has. I would imagine other OS Benchmarks have also been updated, is there any mechanism to get the csv files updated? The stable build doesn't include Win10 21H1 files, so I think I'm looking at the newest ones from December last year.
Thank you for this, it looks like a great solution to creating a hardened environment. Cheers!

[0x6d69636b]

Thanks for your feedback. As far as I can see CIS published a new benchmark for 21H2, but the naming of the document is misleading "CIS Microsoft Windows 10 Enterprise Benchmark v1.12.0". The 21H1 is still in version v1.11.0, so therefore the CSV is up-to-date. I update the CSVs when I have time for it. Everybody is welcome to contribute and create additional CSVs or make changes to the current ones. Sadly there is not automation process

[StWightman]

Here's the most recent, I've only included the 21H2 sheet with the updates. There were still a couple rows that my interpretation of admx.help confirmed the 0/1 change, two entries that seemed to be missing from the sheet, and at the very end there is one entry that I don't find in the CIS Benchmark yet is on admx.help. You can probably verify the status on that one. Please let me know if there's anything else I can do.
CIS_21H2_compared_to_Benchmark_and_admx.help_20220323.xlsx

[0x6d69636b]

The settings 18.8.7.2 and 18.8.21.3 are correct in the list, I changed the recommenced value for 18.9.11.1.10. The two missing settings are there, they have new the IDs 18.9.14.x. I checked the ID's for ASR, they seem to match (see https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide). The recommendation 18.9.108.4.2 is split in more than one registry. The ID 18.9.108.4.2.2 checks for the registry item BranchReadinessLevel (see https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsUpdate::DeferFeatureUpdates)

[StWightman]

Great, thanks! I'm attaching a screenshot of the CIS_Microsoft_Windows_10_Enterprise_Benchmark_v1.12.0, which is where I found the new ASR ID, it looks like there's a conflict between those two sources.

Likewise with 18.9.108.4.2.2, I don't see the BranchReadinessLevel (recommended set to 16) in the Benchmark, it does split into 2 registry entries, to defer and to defer for X days. It certainly makes sense it should be included.

I thought because the Benchmark is published by CIS that it would be the appropriate resource to follow for the CSVs, and I don't know their relationship with Microsoft and which bases their recommendations off of the other's.

[0x6d69636b]

I double checked all ASR IDs, they are correct. The description was updated by Microsoft, but not the IDs. I'll double check 18.9.108.4.2.2 later

[0x6d69636b]

Alright, CIS does not recommend any setting for the BranchReadinessLevel (anymore). However, if this policy is configured, the registry item will be set. Since CIS does not provide a recommendation, I'll change it to the pre-selected value (2) and a low severity

[StWightman]

BTW, I did some testing by creating a CSV from the 21H2 sheet, and when I run the command

• Invoke-HardeningKitty -Mode HailMary -Log -Report -FileFindingList .\lists\test_finding_list.csv
  It works, the log shows a successful run, however the Report is blank with only column headers. Is this expected, or is it because the CSV is now different from the hardening.md and policyrules files?

I've run a post-hardening report using the test CSV and have compared it to the backup CSV. I'm not able to attempt a restore from the backup though, it throws an error:
Cannot validate argument on parameter 'FileFindingList'. The "Test-Path $_" validation script
for the argument with value ".\lists\hardeningkitty_backup_win10b_finding_list_0x6d69636b_machine-20220322-110917.csv"
did not return a result of True. Determine why the validation script failed, and then try the command again.
At line:1 char:68

The files are in their original location with their original names.

Cheers!

[StWightman]

Thanks. That was my confusion, The two CSVs are the CIS Windows 10 Enterprise 21H1 and 21H2 files from the HardeningKitty zip file. I didn't alter the registry path/item structure, so if I understand you correctly HardeningKitty will work with the 21H2 format. I will try with the full path in the morning.
Cheers!

[StWightman]

The full path worked, thanks for the suggestion. I'm starting fresh tomorrow, and will also look at the other CIS CSVs to see which ones have the combined path:item and which don't. It will be easy enough to pull the column into a new sheet and delimit at the colon and paste the results into the two columns, I'm just curious because that 21H1 CSV was included in your lists folder so shouldn't have worked properly. If I understand correctly.

[0x6d69636b]

Sorry I don't get it, no list should have the combined path:item, because HardeningKitty can work with that. If there is one, this is a bug and must be fixed

[StWightman]

Thanks for the response. When I expanded to view all of the registry paths there are actually only a handful use the path:item format. I'm attaching screenshots. I think a lot of problems were generated from trying to update the 21h1 to 21h2 before you provided the 21h2 file, so I've removed that link above. Now that you created the 21h2 file, I sent just the 21h2 sheet and we've worked on this, that first file is obsolete anyway.


.

[0x6d69636b]

I checked the lists in the repo, there are (thankfully) no such combinations: :-) However, if you spot any, please create an issue or pull request