PowerStig icon indicating copy to clipboard operation
PowerStig copied to clipboard

Generating a checklist with manualchecklist entry behavior is different when using mof versus dsc

Open stevehose opened this issue 5 years ago • 1 comments

When generating a new DISA STIG checklist, PowerStig will inject entries from a supplied manual checklist entries file when using the -DscResult option and supplying DSC results. This also works with -ReferenceConfiguration and supplying a .mof file, but has a different outcome.

  • With DSC results, the manual checklist entries are always applied to the generated checklist.
  • With a MOF file, the manual checklist entries are only applied when PowerStig does not automate a rule.

This should be consistent.

Expected behavior Creating a checklist with a manual checklist entries file should always inject the manual entries into the checklist, regardless of whether PowerStig has/will automate the rule.

stevehose avatar Oct 08 '20 15:10 stevehose

The Documentation States that the manual entry xml will only inject comments,etc to non automated rules, I didnt see it specify that all manual entries get injected when using -DscResults, However I second this as the comments that are injected by default "Addressed by PowerStig MOF via MSFT_ResourceInDesiredState" are not detailed enough. A security auditor from DCSA doing an inspection probably will not understand this and will want more info on how DSC PowerSTIG is applying these rules. I made this issue #771 before realizing that this request is basically asking for the same functionality.

EngThis avatar Nov 03 '20 20:11 EngThis