The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
# Windows PowerShell
# Reconstructed from oval:mil.disa.fso.windows:def:104
# The required legal notice must be configured to display before console logon.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
# Legal Notice is configured with the required text.
# registry_object (registry_test)
function test_1 {
return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System').GetValueKind('LegalNoticeText').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'LegalNoticeText' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'LegalNoticeText') -match '^[[:space:]]*You[[:space:]]+are[[:space:]]+accessing[[:space:]]+a[[:space:]]+U\.S\.[[:space:]]+Government[[:space:]]+\(USG\)[[:space:]]+Information[[:space:]]+System[[:space:]]+\(IS\)[[:space:]]+that[[:space:]]+is[[:space:]]+provided[[:space:]]+for[[:space:]]+USG[-—]authorized[[:space:]]+use[[:space:]]+only\.[[:space:]]+By[[:space:]]+using[[:space:]]+this[[:space:]]+IS[[:space:]]+\(which[[:space:]]+includes[[:space:]]+any[[:space:]]+device[[:space:]]+attached[[:space:]]+to[[:space:]]+this[[:space:]]+IS\),[[:space:]]+you[[:space:]]+consent[[:space:]]+to[[:space:]]+the[[:space:]]+following[[:space:]]+conditions:[[:space:]]+-The[[:space:]]+USG[[:space:]]+routinely[[:space:]]+intercepts[[:space:]]+and[[:space:]]+monitors[[:space:]]+communications[[:space:]]+on[[:space:]]+this[[:space:]]+IS[[:space:]]+for[[:space:]]+purposes[[:space:]]+including,[[:space:]]+but[[:space:]]+not[[:space:]]+limited[[:space:]]+to,[[:space:]]+penetration[[:space:]]+testing,[[:space:]]+COMSEC[[:space:]]+monitoring,[[:space:]]+network[[:space:]]+operations[[:space:]]+and[[:space:]]+defense,[[:space:]]+personnel[[:space:]]+misconduct[[:space:]]+\(PM\),[[:space:]]+law[[:space:]]+enforcement[[:space:]]+\(LE\),[[:space:]]+and[[:space:]]+counterintelligence[[:space:]]+\(CI\)[[:space:]]+investigations\.[[:space:]]+-At[[:space:]]+any[[:space:]]+time,[[:space:]]+the[[:space:]]+USG[[:space:]]+may[[:space:]]+inspect[[:space:]]+and[[:space:]]+seize[[:space:]]+data[[:space:]]+stored[[:space:]]+on[[:space:]]+this[[:space:]]+IS\.[[:space:]]+-Communications[[:space:]]+using,[[:space:]]+or[[:space:]]+data[[:space:]]+stored[[:space:]]+on,[[:space:]]+this[[:space:]]+IS[[:space:]]+are[[:space:]]+not[[:space:]]+private,[[:space:]]+are[[:space:]]+subject[[:space:]]+to[[:space:]]+routine[[:space:]]+monitoring,[[:space:]]+interception,[[:space:]]+and[[:space:]]+search,[[:space:]]+and[[:space:]]+may[[:space:]]+be[[:space:]]+disclosed[[:space:]]+or[[:space:]]+used[[:space:]]+for[[:space:]]+any[[:space:]]+USG-authorized[[:space:]]+purpose\.[[:space:]]+[-—]This[[:space:]]+IS[[:space:]]+includes[[:space:]]+security[[:space:]]+measures[[:space:]]+\(e\.g\.,[[:space:]]+authentication[[:space:]]+and[[:space:]]+access[[:space:]]+controls\)[[:space:]]+to[[:space:]]+protect[[:space:]]+USG[[:space:]]+interests[—-]+not[[:space:]]+for[[:space:]]+your[[:space:]]+personal[[:space:]]+benefit[[:space:]]+or[[:space:]]+privacy\.[[:space:]]+[—-]Notwithstanding[[:space:]]+the[[:space:]]+above,[[:space:]]+using[[:space:]]+this[[:space:]]+IS[[:space:]]+does[[:space:]]+not[[:space:]]+constitute[[:space:]]+consent[[:space:]]+to[[:space:]]+PM,[[:space:]]+LE[[:space:]]+or[[:space:]]+CI[[:space:]]+investigative[[:space:]]+searching[[:space:]]+or[[:space:]]+monitoring[[:space:]]+of[[:space:]]+the[[:space:]]+content[[:space:]]+of[[:space:]]+privileged[[:space:]]+communications,[[:space:]]+or work product,[[:space:]]+related[[:space:]]+to[[:space:]]+personal[[:space:]]+representation[[:space:]]+or[[:space:]]+services[[:space:]]+by[[:space:]]+attorneys,[[:space:]]+psychotherapists,[[:space:]]+or[[:space:]]+clergy,[[:space:]]+and[[:space:]]+their[[:space:]]+assistants\.[[:space:]]+Such[[:space:]]+communications[[:space:]]+and[[:space:]]+work[[:space:]]+product[[:space:]]+are[[:space:]]+private[[:space:]]+and[[:space:]]+confidential\.[[:space:]]+See[[:space:]]+User[[:space:]]+Agreement[[:space:]]+for[[:space:]]+details\.[[:space:]]*$'))
}
# Legal Notice is configured with the required text.
# registry_object (registry_test)
function test_2 {
return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System').GetValueKind('LegalNoticeText').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'LegalNoticeText' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'LegalNoticeText') -match '^\s*You\s+are\s+accessing\s+a\s+U\.S\.\s+Government\s+\(USG\)\s+Information\s+System\s+\(IS\)\s+that\s+is\s+provided\s+for\s+USG[-—]authorized\s+use\s+only\.\s+By\s+using\s+this\s+IS\s+\(which\s+includes\s+any\s+device\s+attached\s+to\s+this\s+IS\),\s+you\s+consent\s+to\s+the\s+following\s+conditions:\s+-The\s+USG\s+routinely\s+intercepts\s+and\s+monitors\s+communications\s+on\s+this\s+IS\s+for\s+purposes\s+including,\s+but\s+not\s+limited\s+to,\s+penetration\s+testing,\s+COMSEC\s+monitoring,\s+network\s+operations\s+and\s+defense,\s+personnel\s+misconduct\s+\(PM\),\s+law\s+enforcement\s+\(LE\),\s+and\s+counterintelligence\s+\(CI\)\s+investigations\.\s+-At\s+any\s+time,\s+the\s+USG\s+may\s+inspect\s+and\s+seize\s+data\s+stored\s+on\s+this\s+IS\.\s+-Communications\s+using,\s+or\s+data\s+stored\s+on,\s+this\s+IS\s+are\s+not\s+private,\s+are\s+subject\s+to\s+routine\s+monitoring,\s+interception,\s+and\s+search,\s+and\s+may\s+be\s+disclosed\s+or\s+used\s+for\s+any\s+USG-authorized\s+purpose\.\s+[-—]This\s+IS\s+includes\s+security\s+measures\s+\(e\.g\.,\s+authentication\s+and\s+access\s+controls\)\s+to\s+protect\s+USG\s+interests[—-]+not\s+for\s+your\s+personal\s+benefit\s+or\s+privacy\.\s+[—-]Notwithstanding\s+the\s+above,\s+using\s+this\s+IS\s+does\s+not\s+constitute\s+consent\s+to\s+PM,\s+LE\s+or\s+CI\s+investigative\s+searching\s+or\s+monitoring\s+of\s+the\s+content\s+of\s+privileged\s+communications,\s+or work product,\s+related\s+to\s+personal\s+representation\s+or\s+services\s+by\s+attorneys,\s+psychotherapists,\s+or\s+clergy,\s+and\s+their\s+assistants\.\s+Such\s+communications\s+and\s+work\s+product\s+are\s+private\s+and\s+confidential\.\s+See\s+User\s+Agreement\s+for\s+details\.\s*$'))
}
if ((test_1 -or test_2)) {
Write-Output "PASS"
} else {
Write-Output "FAIL"
}