The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
# Windows PowerShell
# Reconstructed from oval:mil.disa.fso.windows:def:5176
# Standard user accounts must only have Read permissions to the Winlogon registry key.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
# - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- Winlogon key has no non-(Users group, Administrators group, SYSTEM, TrustedInstaller, ALL APPLICATION PACKAGES) rights to check: <set> composition (base object oval:mil.disa.fso.windows:obj:498002): member unresolved -- no extractor for field "key_wow64_res"
# - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- Winlogon key has no bad rights for non-(Users group, Administrators group, SYSTEM, TrustedInstaller, ALL APPLICATION PACKAGES): <set> composition (base object oval:mil.disa.fso.windows:obj:498002): member unresolved -- cannot derive an existence probe for this object type
# - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- Winlogon key has no non-(Administrators group, SYSTEM, TrustedInstaller) rights to check: <set> composition (base object oval:mil.disa.fso.windows:obj:498002): member unresolved -- no extractor for field "key_wow64_res"
# - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- Winlogon key has no bad rights for non-(Administrators group, SYSTEM, TrustedInstaller): <set> composition (base object oval:mil.disa.fso.windows:obj:498002): member unresolved -- cannot derive an existence probe for this object type
# HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon key exists
# registry_object (registry_test)
function test_1 {
return ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name ''))
}
if (test_1) {
Write-Output "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
} else {
Write-Output "FAIL (or see MANUAL REVIEW note above)"
} Assessment Script Powered by AISyntax-verified
A standalone PowerShell script to assess this control automatically. Review before running it in your environment.
Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual ms_windows_2012_and_2012_r2_ms target this check assesses.
# OVAL Definition: oval:mil.disa.fso.windows:def:5176
$winlogonPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
if (-Not (Test-Path $winlogonPath)) {exit 0}
$winlogonPermissions = Get-ItemProperty $winlogonPath -ErrorAction SilentlyContinue
if ($null -eq $winlogonPermissions -or $null -eq $winlogonPermissions.GetAccessControl()) {exit 0}
$expectedRights = [System.Security.AccessControl.RegistryRights]::Read
$expectedTrustees = "BUILTIN\Users", "ALL APPLICATION PACKAGES"
$actualRights = $winlogonPermissions.GetAccessControl().GetEffectiveAccess([System.Security.Principal.NTAccount]$expectedTrustees)|% AccessControlType
if (($actualRights -notcontains $expectedRights) -or ($winlogonPermissions.GetAccessControl().GetAccessRule([System.Security.Principal.NTAccount]@("BUILTIN\Administrators", "NT AUTHORITY\SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE", "NT SERVICE\TrustedInstaller")) -contains @{AccessControlType='Allow';InheritanceFlags=[System.Security.AccessControl.RegistryInheritanceFlags]::None})) {exit 1}
exit 0