Registry Permissions in DISA Benchmarks

[PfeilImKopf]

Operating System

Microsoft Windows Server 2022

Report Name

Microsoft Windows Server 2019 DC

Benchmark and ID (OPTIONAL)

DISA Windows Server 2019 Security Technical Implementation Guide, Version: V1R2 | RegistryPermissions | WN19-00-000170 A ; WN19-00-000170 B; WN19-00-000170 C

What happened?

1. The Hive-names in the tasks corresponding to those IDs are named incorrectly.
2. The output of the ID (C) seems to be duplicated
   

What did you expect?

1. Further information to the hive names: further information here: https://www.stigviewer.com/stig/windows_server_2019/2019-12-12/finding/V-93025
2. no duplicates
3. probably in other DISA benchmarks as well!

Current Version?

I used the latest official release.

[TuemmlerKelch]

Good find.
Not only are we missing the specific hint towards which hive is checked (SECURITY, SOFTWARE, SYSTEM) but also does DISA explicitly declared the long SID (related to Edge Sandbox feature) being mentioned in the B and C-check as "not being a finding".
Also, C-Check seems to spit out duplicate messages for each account.

[TuemmlerKelch]

These got removed during Update from V1R2 to V1R5.
With next update to current DISA Benchmarks, this will get a proper implementation. Set to "ON HOLD"