Problems with Windows 7 STIG

Attempting to STIG a Windows 7 laptop.  We loaded the Non-Compliance Report – U_Windows_7_V1R19_STIG_Benchmark in the Security Automation Compliance Checker (SCAP) 3.1.1.1.  First analyzation of the system with no remediation returned a 31% compliancy reading.  We’ve gotten the compliance status up to 87.22% but need to get it to at least 95% to be acceptable.  What is holding us back right now are false positives for the following examples (there are 30 of these):
•Audit - Credential Validation - Success
The system will be configured to audit "Account Logon -> Credential Validation" successes. - (CCE-9725-3) - Error
•Audit - Credential Validation - Failure
The system will be configured to audit "Account Logon -> Credential Validation" failures. - (CCE-9718-8) - Error
•Audit - Computer Account Management - Success
The system will be configured to audit "Account Management -> Computer Account Management" successes. - (CCE-9498-7) - Error
•Audit - Computer Account Management - Failure
The system will be configured to audit "Account Management -> Computer Account Management" failures. - (CCE-9608-1) - Error

Explanation example-When configuring the setting in gpedit under Computer Configuration-Windows Settings-Security Settings-Advanced Audit Policy Configuration-System Audit Policy-Audit Logon, according to the STIG, the key, Audit Credential Validation should be set at ‘Enabled’ with both ‘Success’ and ‘Failure’ checked.  However, enabling the policy and checking both ‘success’ and ‘failure’ returns error messages as shown above and prevents us from achieving the 95% compliance.  Does anyone have a workaround for this issue or have seen this before?
amiic93769Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Netman66Commented:
Does it do that when you attempt it manually?

Is the computer joined to the domain?  If so, that policy element might be set on a domain policy and enforced.
0
amiic93769Author Commented:
Yes, we are attempting it manually.  We use the version 1 rev 19 Windows 7 benchmark STIG with SCAP and then complete it with the manual STIG in Stigviewer.

No, the computer is not joined to a domain.  It is a standalone utility laptop.  It will not join a domain at any time.  It will only connect to our out-of-bank network to receive WSUS updates, run Retina scans, etc.
0
amiic93769Author Commented:
Discovered the solution.  Needed to configure all of the settings using auditpol.  Thanks
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
amiic93769Author Commented:
Auditpol settings worked.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Legacy OS

From novice to tech pro — start learning today.