The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
# Windows PowerShell
# Reconstructed from oval:mil.disa.fso.windows:def:5175
# Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
# - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- 32-bit Installed Components key has no bad rights for non-(users, adminstrator, system, creator owner, all application packages): <set> composition (base object oval:mil.disa.fso.windows:obj:517501): member unresolved -- no extractor for field "key_wow64_res"
# - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- 32-bit Installed Components key has no non-(users, adminstrator, system, creator owner, all application packages) rights to check: <set> composition (base object oval:mil.disa.fso.windows:obj:517501): member unresolved -- cannot derive an existence probe for this object type
# - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- 32-bit Installed Components key has no bad rights for non-(Adminstrators, SYSTEM, CREATOR OWNERS): <set> composition (base object oval:mil.disa.fso.windows:obj:517501): member unresolved -- no extractor for field "key_wow64_res"
# - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- 32-bit Installed Components key has no non-(Adminstrators, SYSTEM, CREATOR OWNERS) rights to check: <set> composition (base object oval:mil.disa.fso.windows:obj:517501): member unresolved -- cannot derive an existence probe for this object type
# - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- 64-bit Installed Components key has no bad rights for non-(users, adminstrator, system, creator owner, all application packages): <set> composition (base object oval:mil.disa.fso.windows:obj:517505): member unresolved -- no extractor for field "key_wow64_res"
# - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- 64-bit Installed Components key has no non-(users, adminstrator, system, creator owner, all application packages) rights to check: <set> composition (base object oval:mil.disa.fso.windows:obj:517505): member unresolved -- cannot derive an existence probe for this object type
# - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- 64-bit Installed Components key has no bad rights for non-(Adminstrators, SYSTEM, CREATOR OWNERS): <set> composition (base object oval:mil.disa.fso.windows:obj:517505): member unresolved -- no extractor for field "key_wow64_res"
# - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- 64-bit Installed Components key has no non-(Adminstrators, SYSTEM, CREATOR OWNERS) rights to check: <set> composition (base object oval:mil.disa.fso.windows:obj:517505): member unresolved -- cannot derive an existence probe for this object type
# HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components exists
# registry_object (registry_test)
function test_1 {
return ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components' -Name ''))
}
# Is this a 64-Bit Operating System.
# wmi57_object (wmi57_test)
function test_6 {
return (((Get-CimInstance -Namespace 'root\cimv2' -Query 'SELECT AddressWidth FROM win32_processor' | Select-Object -First 1) | Select-Object -ExpandProperty 'AddressWidth') -eq '64')
}
# Is this a 64-Bit Operating System.
# wmi57_object (wmi57_test)
function test_7 {
return (((Get-CimInstance -Namespace 'root\cimv2' -Query 'SELECT AddressWidth FROM win32_processor' | Select-Object -First 1) | Select-Object -ExpandProperty 'AddressWidth') -eq '64')
}
# HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components exists
# registry_object (registry_test)
function test_8 {
return ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components' -Name ''))
}
if ((test_1 -and (test_6 -or (test_7 -and test_8)))) {
Write-Output "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
} else {
Write-Output "FAIL (or see MANUAL REVIEW note above)"
} Assessment Script Powered by AISyntax-verified
A standalone PowerShell script to assess this control automatically. Review before running it in your environment.
Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual windows_7 target this check assesses.
# OVAL Definition: oval:mil.disa.fso.windows:def:5175
if (!(Test-Path 'HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components')) { Write-Output "PASS"; Exit 0 } else {
$acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components'
if ($acl.Access | Where-Object { $_.IdentityReference -like "*S-1-5-*" -and $_.IsInherited -eq $false -and $_.PermissionLevel -ne 'Read' }) {
Write-Output "FAIL"; Exit 1
} else {
Write-Output "PASS"; Exit 0
}
}