PowerStig
PowerStig copied to clipboard
Generating a checklist with manualchecklist entry behavior is different when using mof versus dsc
When generating a new DISA STIG checklist, PowerStig will inject entries from a supplied manual checklist entries file when using the -DscResult option and supplying DSC results. This also works with -ReferenceConfiguration and supplying a .mof file, but has a different outcome.
- With DSC results, the manual checklist entries are always applied to the generated checklist.
- With a MOF file, the manual checklist entries are only applied when PowerStig does not automate a rule.
This should be consistent.
Expected behavior Creating a checklist with a manual checklist entries file should always inject the manual entries into the checklist, regardless of whether PowerStig has/will automate the rule.
The Documentation States that the manual entry xml will only inject comments,etc to non automated rules, I didnt see it specify that all manual entries get injected when using -DscResults, However I second this as the comments that are injected by default "Addressed by PowerStig MOF via MSFT_ResourceInDesiredState" are not detailed enough. A security auditor from DCSA doing an inspection probably will not understand this and will want more info on how DSC PowerSTIG is applying these rules. I made this issue #771 before realizing that this request is basically asking for the same functionality.