Windows CIS module usage

Limitations

This module has been tested and is supported on Domain Controllers, Domain Members, and standalone systems running the following Windows versions:

Windows 2012 R2
Windows Server 2016 (v1607)
Windows Server 2019 (v1809)
Windows Server 2022 (v2102)

CIS recommendations in section 19 contain settings that must be enforced per user. These settings are not easily enforced via Puppet at this time. To enforce these recommendations we have provided Group Policy templates with compliant settings in the files folder of the module. These templates will be copied to C:\Windows\Temp\SIMP-GP on all Domain Controllers by default. To modify the destination directory, set the following parameter in Hiera at a higher level than compliance_markup.

simp_enterprise_windows_cis::usergpo_dest_folder: `C:\Windows\Temp\SIMP-GP`

To disable copying the template files to Domain Controllers, set the following parameter in Hiera at a higher level than compliance_markup:

simp_enterprise_windows_cis::add_usergpo_templates: false

To import the template to Active Directory:

Create a new Group Policy Object in Active Directory.
- Settings can also be imported into existing Group Policy Objects, but this is not recommended.
Right-click the new GPO and select import settings.
Click Next on the initial description screen.
Click Next on the backup screen.
Click Browse on the backup location screen and select either USER-L1 or USER-L2 from C:\Windows\Temp\SIMP-GP. Click OK to return to the import wizard. Click Next to continue.
- The ‘USER-L1’ folder contains the settings for L1 profiles, and the ‘USER-L2’ folder contains settings for L2 profiles. If you wish to enforce an L2 profile, you will need to import settings for both L1 and L2.
Click the name of the backup in the list if it is not already and click Next.
Click Next on the Scanning Backup screen.
Click Finish on the completion summary screen.
Link the new GPO to Organization Units containing User accounts.