Solved

Problems with Windows 7 STIG

Posted on 2014-02-26
4
776 Views
Last Modified: 2014-04-08
Attempting to STIG a Windows 7 laptop.  We loaded the Non-Compliance Report – U_Windows_7_V1R19_STIG_Benchmark in the Security Automation Compliance Checker (SCAP) 3.1.1.1.  First analyzation of the system with no remediation returned a 31% compliancy reading.  We’ve gotten the compliance status up to 87.22% but need to get it to at least 95% to be acceptable.  What is holding us back right now are false positives for the following examples (there are 30 of these):
•Audit - Credential Validation - Success
The system will be configured to audit "Account Logon -> Credential Validation" successes. - (CCE-9725-3) - Error
•Audit - Credential Validation - Failure
The system will be configured to audit "Account Logon -> Credential Validation" failures. - (CCE-9718-8) - Error
•Audit - Computer Account Management - Success
The system will be configured to audit "Account Management -> Computer Account Management" successes. - (CCE-9498-7) - Error
•Audit - Computer Account Management - Failure
The system will be configured to audit "Account Management -> Computer Account Management" failures. - (CCE-9608-1) - Error

Explanation example-When configuring the setting in gpedit under Computer Configuration-Windows Settings-Security Settings-Advanced Audit Policy Configuration-System Audit Policy-Audit Logon, according to the STIG, the key, Audit Credential Validation should be set at ‘Enabled’ with both ‘Success’ and ‘Failure’ checked.  However, enabling the policy and checking both ‘success’ and ‘failure’ returns error messages as shown above and prevents us from achieving the 95% compliance.  Does anyone have a workaround for this issue or have seen this before?
0
Comment
Question by:amiic93769
  • 3
4 Comments
 
LVL 51

Expert Comment

by:Netman66
ID: 39890651
Does it do that when you attempt it manually?

Is the computer joined to the domain?  If so, that policy element might be set on a domain policy and enforced.
0
 

Author Comment

by:amiic93769
ID: 39891208
Yes, we are attempting it manually.  We use the version 1 rev 19 Windows 7 benchmark STIG with SCAP and then complete it with the manual STIG in Stigviewer.

No, the computer is not joined to a domain.  It is a standalone utility laptop.  It will not join a domain at any time.  It will only connect to our out-of-bank network to receive WSUS updates, run Retina scans, etc.
0
 

Accepted Solution

by:
amiic93769 earned 0 total points
ID: 39914012
Discovered the solution.  Needed to configure all of the settings using auditpol.  Thanks
0
 

Author Closing Comment

by:amiic93769
ID: 39985501
Auditpol settings worked.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction: I have always been a big fan of Windows but my liking towards it is slowly being eroded by the variety of other Applications that I encounter, when I browse the Web. Most of the software available is free and maybe Open Source too. …
In a hurry?.. scroll down to "HERE's HOW TO DO IT" Section. Greetings All, I was going to post this as question/solution, but its seems more appropriate as an article considering its length.  I felt it important to illucidate all the details c…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now