inspec.yml

name: microsoft-windows-2012r2-memberserver-stig-baseline
title: microsoft-windows-2012r2-memberserver-stig-baseline
maintainer: The MITRE Corporation
copyright: The MITRE Corporation
copyright_email: inspec@mitre.org
license: Apache-2.0
summary: "Inspec Validation Profile for Microsoft Windows Member Server 2012r2 STIG"
version: 2.17.1
inspec_version: ">= 4.0"

inputs:
  - name: av_approved_software
    desc: "This is a list of Approved Anti-Virus Software"
    type: Array
    value:
      - Windows Defender
      - McAfee Host Intrusion Prevention
      - McAfee Endpoint Security
      - McAfee Agent

  - name: shared_accounts
    desc: "List of shared accounts on the system"
    type: Array
    value: 
      -

  - name: backup_operators
    desc: "List of authorized users in the Backup Operators Group"
    type: Array
    value: 
      -

  - name: administrators
    desc: "List of authorized users in the local Administrators group"
    type: Array
    sensitive: true
    value: 
      -
  
  - name: local_administrator
    desc: "Local Administrator Account on Windows Server"
    type: String
    sensitive: true
    value: ""
    
  - name: administrators_domain
    desc: "List of authorized users in the local Administrators domain group"
    type: Array
    sensitive: true
    value: 
      -

  - name: temp_accounts_domain
    desc: "List of temporary accounts on the domain"
    type: Array
    value: 
      -

  - name: temp_accounts_local
    desc: "List of temporary accounts on local system"
    type: Array
    value: 
      -

  - name: emergency_accounts_domain
    desc: "List of emergency accounts on the domain"
    type: Array
    value: 
      - 

  - name: emergency_accounts_local
    desc: "List of emergency accounts on the system"
    type: Array
    value: 
      - 
  
  - name: application_accounts_domain
    desc: "List Application or Service Accounts domain"
    type: Array
    value: 
      - 

  - name: application_accounts_local
    desc: "List Application Local Accounts"
    type: Array
    value: 
      - 
  
  - name: excluded_accounts_domain
    desc: "List Excluded Accounts domain"
    type: Array
    value: 
      - 

  - name: min_pass_len
    desc: "Sets the minimum length of passwords [14]"
    type: Numeric
    value: 14

  - name: enable_pass_complexity
    desc: "If windows should enforce password complexity (0/1) [1]"
    type: Numeric
    value: 1

  - name: min_pass_age
    desc: "Sets the minimum age for a password [1]"
    type: Numeric
    value: 1

  - name: max_pass_age
    desc: "Sets the maximum age for a password [60]"
    type: Numeric
    value: 60

  - name: comp_acct_max_pass_age
    desc: "Sets the maximum age for a password [30]"
    type: Numeric
    value: 30

  - name: pass_lock_time
    desc: "Sets the number of min before a session is locked out [15]"
    type: Numeric
    value: 15

  - name: pass_hist_size
    desc: "Number of passwords remembered in the password history [24]"
    type: Numeric
    value: 24

  - name: max_pass_lockout
    desc: "Account lockout threshold is recommended to be 3 or less invalid logon attempts [3]"
    type: Numeric
    value: 3

  - name: pass_expiry_warning
    desc: "Users must be warned in advance of their passwords expiring[14] or greater"
    type: Numeric
    value: 14

  - name: pass_lock_duration
    desc: "Account lockout duration must be configured to [15] minutes or greater"
    type: Numeric
    value: 15

  - name: LegalNoticeText
    type: string
    value: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
    By using this IS (which includes any device attached to this IS), you consent
    to the following conditions:
    -The USG routinely intercepts and monitors communications on this IS for
    purposes including, but not limited to, penetration testing, COMSEC monitoring,
    network operations and defense, personnel misconduct (PM), law enforcement
    (LE), and counterintelligence (CI) investigations.
    -At any time, the USG may inspect and seize data stored on this IS.
    -Communications using, or data stored on, this IS are not private, are subject
    to routine monitoring, interception, and search, and may be disclosed or used
    for any USG-authorized purpose.
    -This IS includes security measures (e.g., authentication and access controls)
    to protect USG interests--not for your personal benefit or privacy.
    -Notwithstanding the above, using this IS does not constitute consent to PM, LE
    or CI investigative searching or monitoring of the content of privileged
    communications, or work product, related to personal representation or services
    by attorneys, psychotherapists, or clergy, and their assistants.  Such
    communications and work product are private and confidential.  See User
    Agreement for details."

  - name: LegalNoticeCaption
    type: string
    value: "DoD Notice and Consent Banner, US Department of Defense Warning Statement, or a site-defined equivalent."

  - name: reg_winreg_perms
    desc: "This is the values of the winreg registry key"
    type: Array
    value:
      - NT AUTHORITY\LOCAL SERVICE Allow  -2147483648
      - NT AUTHORITY\LOCAL SERVICE Allow  ReadKey
      - BUILTIN\Administrators Allow  268435456
      - BUILTIN\Administrators Allow  FullControl
      - BUILTIN\Backup Operators Allow  ReadKey

  - name: dod_root_certificates
    desc: "List of DoD CA Root Certificates"
    type: Array
    value: 
     - :Subject: "CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US"
       :Thumbprint: "8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561"
       :NotAfter: "Wednesday, December 05, 2029"
     - :Subject: "CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US"
       :Thumbprint: "D73CA91102A2204A36459ED32213B467D7CE97FB"
       :NotAfter: "Sunday, December 30, 2029"
     - :Subject: "CN=DoD Root CA 4, OU=PKI, OU=DoD, O=U.S. Government, C=US"
       :Thumbprint: "B8269F25DBD937ECAFD4C35A9838571723F2D026"
       :NotAfter: "Sunday, July 25, 2032"
     - :Subject: "CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US"
       :Thumbprint: "4ECB5CC3095670454DA1CBD410FC921F46B8564B"
       :NotAfter: "Friday, June 14, 2041"

  - name: dod_interoperability_certificates
    desc: "List of DoD InterOperability CA Certificates"
    type: Array
    value: 
     - :Subject: "CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US"
       :Issuer: "CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US"
       :Thumbprint: "22BBE981F0694D246CC1472ED2B021DC8540A22F"
       :NotAfter: "Friday, September 06, 2019"
     - :Subject: "CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US"
       :Issuer: "CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US"
       :Thumbprint: "AC06108CA348CC03B53795C64BF84403C1DBD341"
       :NotAfter: "Saturday, January 22, 2022"

  - name: dod_cceb_certificates
    desc: "List of CCEB Certificates"
    type: Array
    value: 
     - :Subject: "CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US"
       :Issuer: "CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US"
       :Thumbprint: "929BF3196896994C0A201DF4A5B71F603FEFBF2E"
       :NotAfter: "Friday, September 27, 2019"
  
  - name: sensitive_system
    desc: "Set flag to true if the target system is sensitive"
    type: String
    value: "false"

  - name: reg_install_comp_perms
    desc: "This is the values of the Installed Components registry key"
    type: Array
    value:
     - BUILTIN\Users Allow  ReadKey
     - BUILTIN\Users Allow  -2147483648
     - BUILTIN\Administrators Allow  FullControl
     - BUILTIN\Administrators Allow  268435456
     - NT AUTHORITY\SYSTEM Allow  FullControl
     - NT AUTHORITY\SYSTEM Allow  268435456
     - CREATOR OWNER Allow  268435456
     - APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Allow  ReadKey
     - APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Allow  -2147483648

  - name: reg_wow6432_install_comp_perms
    desc: "This is the values of the Installed Components under WoW643Node registry key"
    type: Array
    value:
     - BUILTIN\Users Allow  ReadKey
     - BUILTIN\Administrators Allow  FullControl
     - NT AUTHORITY\SYSTEM Allow  FullControl
     - CREATOR OWNER Allow  FullControl
     - APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Allow  ReadKey

  - name: winevt_logs_application_perms
    desc: "This is the values of the Application.evtx file under system32"
    type: Array
    value:
     - NT SERVICE\EventLog Allow  FullControl
     - NT AUTHORITY\SYSTEM Allow  FullControl
     - BUILTIN\Administrators Allow  FullControl

  - name: winevt_logs_security_perms
    desc: "This is the values of the Security.evtx file under system32"
    type: Array
    value:
     - NT SERVICE\EventLog Allow  FullControl
     - NT AUTHORITY\SYSTEM Allow  FullControl
     - BUILTIN\Administrators Allow  FullControl

  - name: winevt_logs_system_perms
    desc: "This is the values of the System.evtx file under system32"
    type: Array
    value:
     - NT SERVICE\EventLog Allow  FullControl
     - NT AUTHORITY\SYSTEM Allow  FullControl
     - BUILTIN\Administrators Allow  FullControl

  - name: eventvwr_perms
    desc: "This is the values of the Eventvwr.exe file under system32"
    type: Array
    value:
     - NT AUTHORITY\SYSTEM Allow  ReadAndExecute, Synchronize
     - BUILTIN\Administrators Allow  ReadAndExecute, Synchronize
     - BUILTIN\Users Allow  ReadAndExecute, Synchronize
     - NT SERVICE\TrustedInstaller Allow  FullControl
     - APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Allow  ReadAndExecute, Synchronize

  - name: basic_window_services
    desc: "This is list of Windows Services That are Installed on OS"
    type: Array
    value:
    - :Name: "AeLookupSvc"
      :DisplayName: "Application Experience"
      :StartMode: "Manual"
    - :Name: "ALG"
      :DisplayName: "Application Layer Gateway Service"
      :StartMode: "Manual"
    - :Name: "AppHostSvc"
      :DisplayName: "Application Host Helper Service"
      :StartMode: "Auto"
    - :Name: "AppIDSvc"
      :DisplayName: "Application Identity "
      :StartMode: "Manual"
    - :Name: "Appinfo"
      :DisplayName: "Application Information"
      :StartMode: "Manual"
    - :Name: "AppMgmt"
      :DisplayName: "Application Management"
      :StartMode: "Manual"
    - :Name: "AppReadiness"
      :DisplayName: "App Readiness"
      :StartMode: "Manual"
    - :Name: "AppXSvc"
      :DisplayName: "AppX Deployment Service (AppXSVC)"
      :StartMode: "Manual"
    - :Name: "AudioEndpointBuilder"
      :DisplayName: "Windows Audio Endpoint Builder"
      :StartMode: "Manual"
    - :Name: "Audiosrv"
      :DisplayName: "Windows Audio"
      :StartMode: "Manual"
    - :Name: "AxInstSV"
      :DisplayName: "ActiveX Installer (AxInstSV)"
      :StartMode: "Manual"
    - :Name: "BFE"
      :DisplayName: "Base Filtering Engine"
      :StartMode: "Auto"
    - :Name: "BITS"
      :DisplayName: "Background Intelligent Transfer Service"
      :StartMode: "Manual"
    - :Name: "BrokerInfrastructure"
      :DisplayName: "Background Tasks Infrastructure Service"
      :StartMode: "Manual"
    - :Name: "CertPropSvc"
      :DisplayName: "Certificate Propagation"
      :StartMode: "Manual"
    - :Name: "COMSysApp"
      :DisplayName: "COM+ System Application"
      :StartMode: "Manual"
    - :Name: "CryptSvc"
      :DisplayName: "Cryptographic Services"
      :StartMode: "Auto"
    - :Name: "CscService"
      :DisplayName: "Offline Files"
      :StartMode: "Disabled"
    - :Name: "DcomLaunch"
      :DisplayName: "DCOM Server Process Launcher"
      :StartMode: "Auto"
    - :Name: "defragsvc"
      :DisplayName: "Optimize drives"
      :StartMode: "Manual"
    - :Name: "DeviceAssociationService"
      :DisplayName: "Device Association Service"
      :StartMode: "Manual"
    - :Name: "DeviceInstall"
      :DisplayName: "Device Install Service"
      :StartMode: "Manual"
    - :Name: "Dhcp"
      :DisplayName: "DHCP Client"
      :StartMode: "Auto"
    - :Name: "dDiagTrack"
      :DisplayName: "Diagnostics Tracking Service"
      :StartMode: "Auto"
    - :Name: "Dnscache"
      :DisplayName: "DNS Client"
      :StartMode: "Auto"
    - :Name: "dot3svc"
      :DisplayName: "Wired AutoConfig"
      :StartMode: "Manual"
    - :Name: "DPS"
      :DisplayName: "Diagnostic Policy Service"
      :StartMode: "Auto"
    - :Name: "DsmSvc"
      :DisplayName: "Device Setup Manager"
      :StartMode: "Manual"
    - :Name: "Eaphost"
      :DisplayName: "Extensible Authentication Protocol"
      :StartMode: "Manual"
    - :Name: "EFS"
      :DisplayName: "Encrypting File System (EFS)"
      :StartMode: "Manual"
    - :Name: "EventLog"
      :DisplayName: "Windows Event Log"
      :StartMode: "Auto" 
    - :Name: "EventSystem"
      :DisplayName: "COM+ Event System"
      :StartMode: "Auto"
    - :Name: "fdPHost"
      :DisplayName: "Function Discovery Provider Host"
      :StartMode: "Manual"
    - :Name: "FDResPub"
      :DisplayName: "Function Discovery Resource Publication"
      :StartMode: "Manual"
    - :Name: "FontCache"
      :DisplayName: "Windows Font Cache Service"
      :StartMode: "Auto"
    - :Name: "gpsvc"
      :DisplayName: "Group Policy Client"
      :StartMode: "auto"
    - :Name: "hidserv"
      :DisplayName: "Human Interface Device Service"
      :StartMode: "Manual"
    - :Name: "hkmsvc"
      :DisplayName: "Health Key and Certificate Management"
      :StartMode: "Manual"
    - :Name: "IEEtwCollectorService"
      :DisplayName: "Internet Explorer ETW Collector Service"
      :StartMode: "Manual" 
    - :Name: "IKEEXT"
      :DisplayName: "Human Interface Device Service"
      :StartMode: "Auto"
    - :Name: "iphlpsvc"
      :DisplayName: "IP Helper"
      :StartMode: "Auto"
    - :Name: "KeyIso"
      :DisplayName: "CNG Key Isolation"
      :StartMode: "Manual"
    - :Name: "KPSSVC"
      :DisplayName: "KDC Proxy Server service (KPS)"
      :StartMode: "Manual"
    - :Name: "KtmRm"
      :DisplayName: "KtmRm for Distributed Transaction Coordinator"
      :StartMode: "Manual"
    - :Name: "LanmanServer"
      :DisplayName: "Server"
      :StartMode: "Auto"
    - :Name: "LanmanWorkstation"
      :DisplayName: "Workstation"
      :StartMode: "Auto"
    - :Name: "lltdsvc"
      :DisplayName: "Link-Layer Topology Discovery Mapper"
      :StartMode: "Manual"
    - :Name: "lmhosts"
      :DisplayName: "TCP/IP NetBIOS Helper"
      :StartMode: "Auto"
    - :Name: "LSM"
      :DisplayName: "Local Session Manager"
      :StartMode: "Auto"
    - :Name: "MMCSS"
      :DisplayName: "Multimedia Class Scheduler"
      :StartMode: "Manual"
    - :Name: "MpsSvc"
      :DisplayName: "Windows Firewall"
      :StartMode: "Auto"
    - :Name: "MSDTC"
      :DisplayName: "Distributed Transaction Coordinator"
      :StartMode: "Auto"
    - :Name: "MSiSCSI"
      :DisplayName: "Microsoft iSCSI Initiator Service"
      :StartMode: "Manual"
    - :Name: "msiserver"
      :DisplayName: "Windows Installer"
      :StartMode: "Manual"
    - :Name: "napagent"
      :DisplayName: "Network Access Protection Agent"
      :StartMode: "Manual"
    - :Name: "NcaSvc"
      :DisplayName: "Network Connectivity Assistant"
      :StartMode: "Manual"
    - :Name: "NcbService"
      :DisplayName: "Network Connection Broker"
      :StartMode: "Manual"
    - :Name: "Netlogon"
      :DisplayName: "Netlogon"
      :StartMode: "Auto"
    - :Name: "Netman"
      :DisplayName: "Network Connections"
      :StartMode: "Manual"
    - :Name: "netprofm"
      :DisplayName: "Network List Service"
      :StartMode: "Manual"
    - :Name: "NetTcpPortSharing"
      :DisplayName: "Net.Tcp Port Sharing Service"
      :StartMode: "Disabled"
    - :Name: "NlaSvc"
      :DisplayName: "Network Location Awareness"
      :StartMode: "Auto"
    - :Name: "nsi"
      :DisplayName: "Network Store Interface Service"
      :StartMode: "Auto"
    - :Name: "PerfHost"
      :DisplayName: "Performance Counter DLL Host"
      :StartMode: "Manual"
    - :Name: "pla"
      :DisplayName: "Performance Logs \\u0026 Alerts"
      :StartMode: "Manual"
    - :Name: "PlugPlay"
      :DisplayName: "Plug and Play"
      :StartMode: "Manual"
    - :Name: "PolicyAgent"
      :DisplayName: "IPsec Policy Agent"
      :StartMode: "Disabled"
    - :Name: "Power"
      :DisplayName: "Power"
      :StartMode: "Auto"
    - :Name: "PrintNotify"
      :DisplayName: "Printer Extensions and Notifications"
      :StartMode: "Manual"
    - :Name: "ProfSvc"
      :DisplayName: "User Profile Service"
      :StartMode: "Auto"
    - :Name: "RasAuto"
      :DisplayName: "Remote Access Auto Connection Manager"
      :StartMode: "Manual"
    - :Name: "RasMan"
      :DisplayName: "Remote Access Connection Manager"
      :StartMode: "Manual"
    - :Name: "RemoteAccess"
      :DisplayName: "Routing and Remote Access"
      :StartMode: "Disabled"
    - :Name: "RemoteRegistry"
      :DisplayName: "Remote Registry"
      :StartMode: "Auto"
    - :Name: "RpcEptMapper"
      :DisplayName: "RPC Endpoint Mapper"
      :StartMode: "Auto"
    - :Name: "RpcLocator"
      :DisplayName: "Remote Procedure Call (RPC) Locator"
      :StartMode: "Manual"
    - :Name: "RpcSs"
      :DisplayName: "Remote Procedure Call (RPC)"
      :StartMode: "Auto"
    - :Name: "RSoPProv"
      :DisplayName: "Resultant Set of Policy Provider"
      :StartMode: "Manual"
    - :Name: "sacsvr"
      :DisplayName: "Special Administration Console Helper"
      :StartMode: "Manual"
    - :Name: "SamSs"
      :DisplayName: "Security Accounts Manager"
      :StartMode: "Auto"
    - :Name: "SCardSvr"
      :DisplayName: "Smart Card"
      :StartMode: "Manual"
    - :Name: "ScDeviceEnu"
      :DisplayName: "Smart Card Device Enumeration Service"
      :StartMode: "Manual"
    - :Name: "Schedule"
      :DisplayName: "Task Scheduler"
      :StartMode: "Auto"
    - :Name: "SCPolicySvc"
      :DisplayName: "Smart Card Removal Policy"
      :StartMode: "Auto"
    - :Name: "seclogon"
      :DisplayName: "Secondary Logon"
      :StartMode: "Manual"
    - :Name: "SecurityService"
      :DisplayName: "PC Security Management Service"
      :StartMode: "Auto"
    - :Name: "SecurityServiceMonitor"
      :DisplayName: "PC Security Management Monitoring Service"
      :StartMode: "Auto"
    - :Name: "SENS"
      :DisplayName: "System Event Notification Service"
      :StartMode: "Auto"
    - :Name: "SessionEnv"
      :DisplayName: "Remote Desktop Configuration"
      :StartMode: "Manual"
    - :Name: "SharedAccess"
      :DisplayName: "Internet Connection Sharing (ICS)"
      :StartMode: "Disabled"
    - :Name: "ShellHWDetection"
      :DisplayName: "Shell Hardware Detection"
      :StartMode: "Auto"
    - :Name: "simptcp"
      :DisplayName: "Simple TCP/IP Services"
      :StartMode: "Disabled"
    - :Name: "smphost"
      :DisplayName: "Microsoft Storage Spaces SMP"
      :StartMode: "Manual"
    - :Name: "SNMPTRAP"
      :DisplayName: "SNMP Trap"
      :StartMode: "Manual"
    - :Name: "Spooler"
      :DisplayName: "Print Spooler"
      :StartMode: "Auto"
    - :Name: "sppsvc"
      :DisplayName: "Software Protection"
      :StartMode: "Auto"
    - :Name: "SSDPSRV"
      :DisplayName: "SSDP DiscoveryP"
      :StartMode: "Disabled"
    - :Name: "SstpSvc"
      :DisplayName: "Secure Socket Tunneling Protocol Servic"
      :StartMode: "Manual"
    - :Name: "stisvc"
      :DisplayName: "Windows Image Acquisition (WIA)"
      :StartMode: "Manual"
    - :Name: "svsvc"
      :DisplayName: "Spot Verifier"
      :StartMode: "Manual"
    - :Name: "swprv"
      :DisplayName: "Microsoft Software Shadow Copy Provider"
      :StartMode: "Manual"
    - :Name: "SysMain"
      :DisplayName: "Superfetch"
      :StartMode: "Manual"
    - :Name: "SystemEventsBroker"
      :DisplayName: "System Events Broker"
      :StartMode: "Auto"
    - :Name: "TabletInputService"
      :DisplayName: "Touch Keyboard and Handwriting Panel Service"
      :StartMode: "Manual"
    - :Name: "TapiSrv"
      :DisplayName: "Telephony"
      :StartMode: "Manual"
    - :Name: "TermService"
      :DisplayName: "Remote Desktop Services"
      :StartMode: "Manual"
    - :Name: "Themes"
      :DisplayName: "Themes"
      :StartMode: "Auto"
    - :Name: "THREADORDER"
      :DisplayName: "Thread Ordering Server"
      :StartMode: "Manual"
    - :Name: "TieringEngineService"
      :DisplayName: "Storage Tiers Management"
      :StartMode: "Manual"
    - :Name: "TimeBroker"
      :DisplayName: "Time Broker"
      :StartMode: "Manual"
    - :Name: "TrkWks"
      :DisplayName: "Distributed Link Tracking Client"
      :StartMode: "Auto"
    - :Name: "TrustedInstaller"
      :DisplayName: "Windows Modules Installer"
      :StartMode: "Manual"
    - :Name: "UALSVC"
      :DisplayName: "User Access Logging Service"
      :StartMode: "Auto"
    - :Name: "UI0Detect"
      :DisplayName: "Interactive Services Detection"
      :StartMode: "Manual"
    - :Name: "UmRdpService"
      :DisplayName: "Remote Desktop Services UserMode Port Redirector"
      :StartMode: "Manual"
    - :Name: "upnphost"
      :DisplayName: "UPnP Device Host"
      :StartMode: "Disabled"
    - :Name: "VaultSvc"
      :DisplayName: "Credential Manager"
      :StartMode: "Manual"
    - :Name: "vmicguestinterface"
      :DisplayName: "Hyper-V Guest Service Interface"
      :StartMode: "Manual"
    - :Name: "vmicheartbeat"
      :DisplayName: "Hyper-V Heartbeat Service"
      :StartMode: "Manual"
    - :Name: "vmickvpexchange"
      :DisplayName: "Hyper-V Data Exchange Service"
      :StartMode: "Manual"
    - :Name: "vmicrdv"
      :DisplayName: "Hyper-V Remote Desktop Virtualization Service"
      :StartMode: "Manual"
    - :Name: "vmicshutdown"
      :DisplayName: "Hyper-V Guest Shutdown Service"
      :StartMode: "Manual"
    - :Name: "vmictimesync"
      :DisplayName: "Hyper-V Time Synchronization Service"
      :StartMode: "Manual"
    - :Name: "vmicvss"
      :DisplayName: "Hyper-V Volume Shadow Copy Requestor"
      :StartMode: "Manual"
    - :Name: "VSS"
      :DisplayName: "Volume Shadow Copy"
      :StartMode: "Manual"
    - :Name: "W32Time"
      :DisplayName: "Windows Time"
      :StartMode: "Manual"
    - :Name: "w3logsvc"
      :DisplayName: "W3C Logging Service"
      :StartMode: "Manual"
    - :Name: "W3SVC"
      :DisplayName: "World Wide Web Publishing Service"
      :StartMode: "Auto"
    - :Name: "WAS"
      :DisplayName: "Windows Process Activation Service"
      :StartMode: "Manual"
    - :Name: "Wcmsvc"
      :DisplayName: "Windows Connection Manager"
      :StartMode: "Auto"
    - :Name: "WcsPlugInService"
      :DisplayName: "Windows Color System"
      :StartMode: "Manual"
    - :Name: "WdiServiceHost"
      :DisplayName: "Diagnostic Service Host"
      :StartMode: "Manual"
    - :Name: "WdiSystemHost"
      :DisplayName: "Diagnostic System Host"
      :StartMode: "Manual"
    - :Name: "WebClient"
      :DisplayName: "WebClient"
      :StartMode: "Manual"
    - :Name: "Wecsvc"
      :DisplayName: "Windows Event Collector"
      :StartMode: "Manual"
    - :Name: "WEPHOSTSVC"
      :DisplayName: "Windows Encryption Provider Host Service"
      :StartMode: "Manual"
    - :Name: "wercplsupport"
      :DisplayName: "Problem Reports and Solutions Control Panel Support"
      :StartMode: "Manual"
    - :Name: "WerSvc"
      :DisplayName: "Windows Error Reporting Service"
      :StartMode: "Manual"
    - :Name: "WiaRpc"
      :DisplayName: "Still Image Acquisition Events"
      :StartMode: "Manual"
    - :Name: "WinHttpAutoProxySvc"
      :DisplayName: "WinHTTP Web Proxy Auto-Discovery Service"
      :StartMode: "Manual"
    - :Name: "Winmgmt"
      :DisplayName: "Windows Management Instrumentation"
      :StartMode: "Auto"
    - :Name: "WinRM"
      :DisplayName: "Windows Remote Management (WS-Management)"
      :StartMode: "Auto"
    - :Name: "wlidsvc"
      :DisplayName: "Microsoft Account Sign-in Assistant"
      :StartMode: "Manual"
    - :Name: "wmiApSrv"
      :DisplayName: "WMI Performance Adapter"
      :StartMode: "Manual"
    - :Name: "WPDBusEnum"
      :DisplayName: "Portable Device Enumerator Service"
      :StartMode: "Manual"
    - :Name: "WSService"
      :DisplayName: "Windows Store Service (WSService)"
      :StartMode: "Manual"
    - :Name: "wuauserv"
      :DisplayName: "Windows Update"
      :StartMode: "Manual"
    - :Name: "wudfsvc"
      :DisplayName: "Windows Driver Foundation - User-mode Driver Framework"
      :StartMode: "Manual"
      
  - name: vmware_window_services
    desc: "This is list of VMware Services That are Installed on OS"
    type: Array
    value:
    - :Name: "VGAuthService"
      :DisplayName: "VMware Alias Manager and Ticket Service"
      :StartMode: "Auto"
    - :Name: "VMTools"
      :DisplayName: "VMware Tools"
      :StartMode: "Auto"
    - :Name: "vmvss"
      :DisplayName: "WVMware Snapshot Provider"
      :StartMode: "Manual"

  - name: application_services
    desc: "This is a list of Services that are Application"
    type: Array
    value:
      -

  - name: reg_winlogon_perms
    desc: "This is the values of the Winlogon Registry Key"
    type: Array
    value:
     - NT SERVICE\TrustedInstaller Allow  FullControl
     - NT SERVICE\TrustedInstaller Allow  268435456
     - NT AUTHORITY\SYSTEM Allow  FullControl
     - NT AUTHORITY\SYSTEM Allow  268435456
     - BUILTIN\Administrators Allow  FullControl
     - BUILTIN\Administrators Allow  268435456
     - BUILTIN\Users Allow  ReadKey
     - BUILTIN\Users Allow  -2147483648
     - APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Allow  ReadKey
     - APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Allow  -2147483648
  
  - name: ntds_permissions
    desc: "Permissions on folder and file for NTDS Directory"
    type: Array
    value:
      - BUILTIN\Administrators:(I)(F)
      - NT AUTHORITY\SYSTEM:(I)(F)

  - name: ad_approved_services
    desc: "This is a list of services that are suppose to run on AD Boxes"
    type: Array
    value: 
      - 

  - name: c_windows_sysvol_perm
    desc: "Permissions on folder and file for SYSVOL Directory"
    type: Array
    value:
      - NT AUTHORITY\Authenticated Users:(RX)
      - NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(GR,GE)
      - BUILTIN\Server Operators:(RX)
      - BUILTIN\Server Operators:(OI)(CI)(IO)(GR,GE)
      - BUILTIN\Administrators:(M,WDAC,WO)
      - BUILTIN\Administrators:(OI)(CI)(IO)(F)
      - NT AUTHORITY\SYSTEM:(F)
      - NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
      - BUILTIN\Administrators:(M,WDAC,WO)
      - CREATOR OWNER:(OI)(CI)(IO)(F)

  - name: c_program_files_perm
    desc: "Permissions on folder and file for C:\\Program Files and C:\\Program Files(x86) Directory"
    type: Array
    value:
      - NT SERVICE\TrustedInstaller:(F)
      - NT SERVICE\TrustedInstaller:(CI)(IO)(F)
      - NT AUTHORITY\SYSTEM:(M)
      - NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
      - BUILTIN\Administrators:(M)
      - BUILTIN\Administrators:(OI)(CI)(IO)(F)
      - BUILTIN\Users:(RX)
      - BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
      - CREATOR OWNER:(OI)(CI)(IO)(F)
      - APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
      - APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)

  - name: c_perm
    desc: "Permissions on folder and file for C:\\ Directory"
    type: Array
    value:
      - NT AUTHORITY\\SYSTEM:(OI)(CI)(F)
      - BUILTIN\Administrators:(OI)(CI)(F)
      - BUILTIN\Users:(OI)(CI)(RX)
      - BUILTIN\Users:(CI)(AD)
      - BUILTIN\Users:(CI)(IO)(WD)
      - CREATOR OWNER:(OI)(CI)(IO)(F)

  - name: c_windows_perm
    desc: "Permissions on folder and file for C:\\Windows Directory"
    type: Array
    value:
      - NT SERVICE\TrustedInstaller:(F)
      - NT SERVICE\TrustedInstaller:(CI)(IO)(F)
      - NT AUTHORITY\SYSTEM:(M)
      - NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
      - BUILTIN\Administrators:(M)
      - BUILTIN\Administrators:(OI)(CI)(IO)(F)
      - BUILTIN\Users:(RX)
      - BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
      - CREATOR OWNER:(OI)(CI)(IO)(F)
      - APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
      - APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)
      - APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)
      - APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)