The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
# Windows PowerShell
# Reconstructed from oval:mil.disa.stig.windows2022:def:254499
# Windows Server 2022 create symbolic links user right must only be assigned to the Administrators group.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
# Create symbolic links - Administrators
# userright_object (userright_test)
function test_1 {
return ((($__tmp = "$env:TEMP\scc_userrights_$([guid]::NewGuid().Guid).cfg"; secedit /export /cfg $__tmp /areas USER_RIGHTS /quiet | Out-Null; $__m = Select-String -Path $__tmp -Pattern '^SeCreateSymbolicLinkPrivilege\s*=\s*(.*)$'; Remove-Item $__tmp -ErrorAction SilentlyContinue; if ($__m -and $__m.Matches[0].Groups[1].Value.Trim().Length -gt 0) { (($__m.Matches[0].Groups[1].Value -split ',') | ForEach-Object { $__sid = $_.Trim().TrimStart('*'); try { (New-Object System.Security.Principal.SecurityIdentifier($__sid)).Translate([System.Security.Principal.NTAccount]).Value -replace '^[^\\]*\\', '' } catch { $__sid } }) -join ',' } else { '' }) -eq '') -or (($__tmp = "$env:TEMP\scc_userrights_$([guid]::NewGuid().Guid).cfg"; secedit /export /cfg $__tmp /areas USER_RIGHTS /quiet | Out-Null; $__m = Select-String -Path $__tmp -Pattern '^SeCreateSymbolicLinkPrivilege\s*=\s*(.*)$'; Remove-Item $__tmp -ErrorAction SilentlyContinue; if ($__m -and $__m.Matches[0].Groups[1].Value.Trim().Length -gt 0) { (($__m.Matches[0].Groups[1].Value -split ',') | ForEach-Object { $__sid = $_.Trim().TrimStart('*'); try { (New-Object System.Security.Principal.SecurityIdentifier($__sid)).Translate([System.Security.Principal.NTAccount]).Value -replace '^[^\\]*\\', '' } catch { $__sid } }) -join ',' } else { '' }) -eq 'Administrators'))
}
# Create symbolic links - Administrators, Virtual Machines
# userright_object (userright_test)
function test_2 {
return ((($__tmp = "$env:TEMP\scc_userrights_$([guid]::NewGuid().Guid).cfg"; secedit /export /cfg $__tmp /areas USER_RIGHTS /quiet | Out-Null; $__m = Select-String -Path $__tmp -Pattern '^SeCreateSymbolicLinkPrivilege\s*=\s*(.*)$'; Remove-Item $__tmp -ErrorAction SilentlyContinue; if ($__m -and $__m.Matches[0].Groups[1].Value.Trim().Length -gt 0) { (($__m.Matches[0].Groups[1].Value -split ',') | ForEach-Object { $__sid = $_.Trim().TrimStart('*'); try { (New-Object System.Security.Principal.SecurityIdentifier($__sid)).Translate([System.Security.Principal.NTAccount]).Value -replace '^[^\\]*\\', '' } catch { $__sid } }) -join ',' } else { '' }) -eq '') -or (($__tmp = "$env:TEMP\scc_userrights_$([guid]::NewGuid().Guid).cfg"; secedit /export /cfg $__tmp /areas USER_RIGHTS /quiet | Out-Null; $__m = Select-String -Path $__tmp -Pattern '^SeCreateSymbolicLinkPrivilege\s*=\s*(.*)$'; Remove-Item $__tmp -ErrorAction SilentlyContinue; if ($__m -and $__m.Matches[0].Groups[1].Value.Trim().Length -gt 0) { (($__m.Matches[0].Groups[1].Value -split ',') | ForEach-Object { $__sid = $_.Trim().TrimStart('*'); try { (New-Object System.Security.Principal.SecurityIdentifier($__sid)).Translate([System.Security.Principal.NTAccount]).Value -replace '^[^\\]*\\', '' } catch { $__sid } }) -join ',' } else { '' }) -eq 'Administrators') -or (($__tmp = "$env:TEMP\scc_userrights_$([guid]::NewGuid().Guid).cfg"; secedit /export /cfg $__tmp /areas USER_RIGHTS /quiet | Out-Null; $__m = Select-String -Path $__tmp -Pattern '^SeCreateSymbolicLinkPrivilege\s*=\s*(.*)$'; Remove-Item $__tmp -ErrorAction SilentlyContinue; if ($__m -and $__m.Matches[0].Groups[1].Value.Trim().Length -gt 0) { (($__m.Matches[0].Groups[1].Value -split ',') | ForEach-Object { $__sid = $_.Trim().TrimStart('*'); try { (New-Object System.Security.Principal.SecurityIdentifier($__sid)).Translate([System.Security.Principal.NTAccount]).Value -replace '^[^\\]*\\', '' } catch { $__sid } }) -join ',' } else { '' }) -match '^(?i)(NT VIRTUAL MACHINE\\)?Virtual Machines$'))
}
# Hyper-V Role is installed
# wmi57_object (wmi57_test)
function test_3 {
return ($null -ne (Get-CimInstance -Namespace 'root\cimv2' -Query 'SELECT ID FROM Win32_ServerFeature'))
}
if ((test_1 -or (test_2 -and test_3))) {
Write-Output "PASS"
} else {
Write-Output "FAIL"
} Assessment Script Powered by AISyntax-verified
A standalone PowerShell script to assess this control automatically. Review before running it in your environment.
Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual ms_windows_server_2022 target this check assesses.
# OVAL Definition: oval:mil.disa.stig.windows2022:def:254499
$userRight = Get-CimInstance -ClassName Win32_Privilege -ErrorAction SilentlyContinue
if ($userRight -eq $null) { exit 0 }
$userRights = Get-CimInstance -ClassName Win32_UserRight -ErrorAction SilentlyContinue
if ($userRights -eq $null) { exit 0 }
$createSymbolicLinkRight = $userRights | Where-Object { $_.Name -eq 'SeCreateSymbolicLinkPrivilege' }
if ($createSymbolicLinkRight -eq $null) { exit 0 }
$admins = $userRights | Where-Object { $_.Name -eq 'SeAssignPrimaryTokenPrivilege' }
if ($admins -eq $null) { exit 0 }
$hyperVFeature = Get-CimInstance -ClassName Win32_ServerFeature -Filter "Name = 'Hyper-V-Hypervisor-ManagementServices'" -ErrorAction SilentlyContinue
if ($hyperVFeature -ne $null) {
$vms = $userRights | Where-Object { $_.Name -match '^(?i)(NT VIRTUAL MACHINE\\\\)?Virtual Machines$' }
if ($vms -eq $null) { exit 1 }
}
if ($createSymbolicLinkRight.Users -notcontains 'Administrators' -and $admins.Users -notcontains 'Administrators') { exit 1 }
exit 0